AWS aws-backup documentation change
Summary
Updated encryption options documentation for AWS Backup restore process, clarifying default encryption behavior and CLI usage
Security assessment
The changes clarify encryption options and default behavior, which is related to security features, but there is no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/aws-backup/latest/devguide/restoring-ebs.md index 1c4cdc226..9a72c64ea 100644 --- a/aws-backup/latest/devguide/restoring-ebs.md +++ b/aws-backup/latest/devguide/restoring-ebs.md @@ -31 +31 @@ If your snapshot contains multiple partitions, specify the file system identifie -**Encryption** | **Optional**. You can choose an existing AWS KMS key or create a new KMS key. | | Required. Choose SSE-S3 (default) or SSE-KMS. +**Encryption** | **Optional**. You can choose an existing AWS KMS key or create a new KMS key. | | Required. Choose from SSE-S3, SSE-KMS, or the default destination bucket encryption1. @@ -35,0 +36,2 @@ If your snapshot contains multiple partitions, specify the file system identifie +1In the AWS Backup console, you select one of the three encryption options; if you use CLI to restore, omit `encryptionType` to restore to the default destination bucket encryption. + @@ -58 +60 @@ If you choose **file level restore** , you can include up to 5 objects or folder - * Set the encryption of the restored object(s) (for details on encryption choices, see Step 7 in [Restore S3 data using AWS Backup](./restoring-s3.html). + * Set the encryption of the restored object(s). You can choose the default destination bucket encryption, SSE-S3, or SSE-KMS. For additional detail, see [Restore S3 data using AWS Backup](./restoring-s3.html). @@ -135,2 +137,2 @@ Example: - encryptionType // - fileLevelRestoreKmsKeyId // + encryptionType // You can specify SSE-S3 or SSE-KMS; do not include if you want to restore to default encryption + kmsKeyId //