AWS cli documentation change
Summary
Added documentation for account-based endpoints configuration including environment variables and config file settings, updated endpoint precedence order, and removed CloudWatch Logs from service identifiers table
Security assessment
The changes introduce account-based endpoint configuration options but do not address any specific security vulnerabilities or weaknesses. While account-based endpoints might have security implications, the documentation focuses on performance/scalability improvements rather than security features or vulnerability mitigation. No security advisories or vulnerability references are present in the diff.
Diff
diff --git a/cli/v1/userguide/cli-configure-endpoints.md index ad1e10633..fe0b4992f 100644 --- a/cli/v1/userguide/cli-configure-endpoints.md +++ b/cli/v1/userguide/cli-configure-endpoints.md @@ -5 +5 @@ -Set endpoint for a single commandSet global endpoint for all AWS servicesSet to use FIPs endpoints for all AWS servicesSet to use dual-stack endpoints for all AWS servicesSet service-specific endpointsEndpoint configuration and settings precedence +Set endpoint for a single commandSet global endpoint for all AWS servicesSet to use FIPs endpoints for all AWS servicesSet to use dual-stack endpoints for all AWS servicesSet service-specific endpointsAccount-based endpointsEndpoint configuration and settings precedence @@ -30,0 +31,2 @@ To connect programmatically to an AWS service, you use an endpoint. An _endpoint + * [Account-based endpoints](./cli-configure-endpoints.html#endpoints-accountid) + @@ -327,2 +328,0 @@ The AWS service identifier is based on the API model’s `serviceId` by replacin -The following service identifier example uses AWS Elastic Beanstalk. AWS Elastic Beanstalk has a `serviceId` of `[Elastic Beanstalk](https://github.com/boto/botocore/blob/bcaf618c4b93c067efa0b85d3e92f3985ff60906/botocore/data/elasticbeanstalk/2010-12-01/service-2.json#L9)`, therefore the service identifier key is `elastic_beanstalk`. - @@ -544 +543,0 @@ The following table lists all service-specific identifiers, `config` file keys, -`CloudWatch Logs` | `cloudwatch_logs` | `AWS_ENDPOINT_URL_CLOUDWATCH_LOGS` @@ -714,0 +714,74 @@ The following table lists all service-specific identifiers, `config` file keys, +## Account-based endpoints + +Account-based endpoints can be specified in the following ways: + + * Environment variables + + * `[AWS_ACCOUNT_ID](./cli-configure-envvars.html#envvars-list-AWS_ACCOUNT_ID)` \- Specifies the AWS account-based endpoint ID to use for calls to supported AWS services. + +Linux or macOS + + + $ export AWS_ACCOUNT_ID=<account-id> + +Windows Command Prompt + + +**To set for all sessions** + + C:\> setx AWS_ACCOUNT_ID <account-id> + +**To set for current session only** + + C:\> set AWS_ACCOUNT_ID=<account-id> + +PowerShell + + + PS C:\> $Env:AWS_ACCOUNT_ID="<account-id>" + + * `[AWS_ACCOUNT_ID_ENDPOINT_MODE](./cli-configure-envvars.html#envvars-list-AWS_ACCOUNT_ID_ENDPOINT_MODE)` \- Specifies whether to use AWS account-based endpoint IDs for calls to supported AWS services. Can be set to `preferred`, `disabled`, or `required`. Default value is `preferred`. + +Linux or macOS + + + $ export AWS_ACCOUNT_ID_ENDPOINT_MODE=preferred + +Windows Command Prompt + + +**To set for all sessions** + + C:\> setx AWS_ACCOUNT_ID_ENDPOINT_MODE preferred + +**To set for current session only** + + C:\> set AWS_ACCOUNT_ID_ENDPOINT_MODE=preferred + +PowerShell + + + PS C:\> $Env:AWS_ACCOUNT_ID_ENDPOINT_MODE="preferred" + + * The `config` file: + + * `[aws_account_id](./cli-configure-files.html#cli-config-aws_account_id)` \- Specifies the AWS account-based endpoint ID to use for calls to supported AWS services. + + aws_account_id = <account-id> + + * `[account_id_endpoint_mode](./cli-configure-files.html#cli-config-account_id_endpoint_mode)` \- Specifies whether to use AWS account-based endpoint IDs for calls to supported AWS services. Can be set to `preferred`, `disabled`, or `required`. Default value is preferred. + + account_id_endpoint_mode = preferred + + + + +Account-based endpoints help ensure high performance and scalability by using your AWS account ID to streamline the routing of AWS service requests for services that support this feature. When you use a credential provider and a service that supports account-based endpoints, the AWS CLI automatically constructs and uses an account-based endpoint instead of a regional endpoint. + +Account-based endpoints use the following format, where `<account-id>` is replaced with your AWS account ID and `<region>` is replaced with your AWS Region: + + + https://<account-id>.myservice.<region>.amazonaws.com + +By default in the AWS CLI, the account-based endpoint mode is set to `preferred`. + @@ -727 +800,5 @@ Endpoint configuration settings are located in multiple places, such as the syst - 5. The service-specific endpoint value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `services` section of the shared `config` file. + 5. The `[AWS_ACCOUNT_ID_ENDPOINT_MODE](./cli-configure-envvars.html#envvars-list-AWS_ACCOUNT_ID_ENDPOINT_MODE)` environment variable is set to `preferred` or `required` using the Account ID in the `[AWS_ACCOUNT_ID](./cli-configure-envvars.html#envvars-list-AWS_ACCOUNT_ID)` environment variable or `[aws_account_id](./cli-configure-files.html#cli-config-aws_account_id)` setting. + + 6. The service-specific endpoint value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `services` section of the shared `config` file. + + 7. The value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `profile` of the shared `config` file. @@ -729 +806 @@ Endpoint configuration settings are located in multiple places, such as the syst - 6. The value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `profile` of the shared `config` file. + 8. `[use_dualstack_endpoint](./cli-configure-files.html#cli-config-use_dualstack_endpoint)`, `[use_fips_endpoint](./cli-configure-files.html#cli-config-use_fips_endpoint)`, and `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` settings. @@ -731 +808 @@ Endpoint configuration settings are located in multiple places, such as the syst - 7. `[use_dualstack_endpoint](./cli-configure-files.html#cli-config-use_dualstack_endpoint)`, `[use_fips_endpoint](./cli-configure-files.html#cli-config-use_fips_endpoint)`, and `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` settings. + 9. The `[account_id_endpoint_mode](./cli-configure-files.html#cli-config-account_id_endpoint_mode)` setting is set to `preferred` or `required` using the Account ID in the `[AWS_ACCOUNT_ID](./cli-configure-envvars.html#envvars-list-AWS_ACCOUNT_ID)` environment variable or `[aws_account_id](./cli-configure-files.html#cli-config-aws_account_id)` setting. @@ -733 +810 @@ Endpoint configuration settings are located in multiple places, such as the syst - 8. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. + 10. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. @@ -744 +821 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Using an HTTP proxy for the AWS CLI +HTTP proxies