AWS cli documentation change
Summary
Added documentation for AWS_ACCOUNT_ID and AWS_ACCOUNT_ID_ENDPOINT_MODE environment variables, consolidated endpoint precedence explanations by referencing a centralized guide, and updated descriptions for AWS_ENDPOINT_URL, AWS_USE_FIPS_ENDPOINT, and other settings with links to endpoint configuration documentation.
Security assessment
The changes add documentation for FIPS endpoints (security compliance feature) and account-based endpoint controls, but there is no explicit evidence of addressing a specific security vulnerability. The FIPS-related documentation improvements qualify as adding security feature documentation.
Diff
diff --git a/cli/v1/userguide/cli-configure-envvars.md index f57b7f1b3..14e5ad964 100644 --- a/cli/v1/userguide/cli-configure-envvars.md +++ b/cli/v1/userguide/cli-configure-envvars.md @@ -92,0 +93,37 @@ If defined, this environment variable overrides the value for the profile settin +`AWS_ACCOUNT_ID`** + + +Specifies the AWS account-based endpoint ID to use for calls to supported AWS services. For more information on account-based endpoints, see [Account-based endpoints](./cli-configure-endpoints.html#endpoints-accountid). + +This setting overrides the `[aws_account_id](./cli-configure-files.html#cli-config-aws_account_id)` setting. The `AWS_ACCOUNT_ID_ENDPOINT_MODE` environment variable or `[account_id_endpoint_mode](./cli-configure-files.html#cli-config-account_id_endpoint_mode)` setting must be set to `preferred` or `required` to use this setting. + +###### Endpoint precedence + +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). + +** + +`AWS_ACCOUNT_ID_ENDPOINT_MODE`** + + +Specifies whether to use AWS account-based endpoint IDs for calls to supported AWS services. For more information on account-based endpoints, see [Account-based endpoints](./cli-configure-endpoints.html#endpoints-accountid). + +This setting can be set to the following: + + * **(default)** **`preferred`** – The endpoint should include account ID if available. + + * **`disabled`** – A resolved endpoint doesn't include account ID. + + * **`required`** – The endpoint must include account ID. If the account ID isn't available, the SDK throws an error. + + + + +This setting overrides the `[account_id_endpoint_mode](./cli-configure-files.html#cli-config-account_id_endpoint_mode)` setting. To use account-based endpoints, the ID must be set in the `AWS_ACCOUNT_ID` environment variable or `[aws_account_id](./cli-configure-files.html#cli-config-aws_account_id)` setting. + +###### Endpoint precedence + +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). + +** + @@ -163,20 +200 @@ If set to true, user credentials or configuration (like the Region) are not requ -Specifies the endpoint that is used for all service requests. - -Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI endpoint configuration settings take precedence in the following order: - - 1. The `[--endpoint-url](./cli-configure-options.html#cli-configure-options-endpoint-url)` command line option. - - 2. If enabled, the `AWS_IGNORE_CONFIGURED_ENDPOINT_URLS` global endpoint environment variable or profile setting `[ignore_configure_endpoint_urls](./cli-configure-files.html#cli-config-ignore_configure_endpoint_urls)` to ignore custom endpoints. - - 3. The value provided by a service-specific environment variable `AWS_ENDPOINT_URL_<SERVICE>`, such as `AWS_ENDPOINT_URL_DYNAMODB`. - - 4. The values provided by the `AWS_USE_DUALSTACK_ENDPOINT`, `AWS_USE_FIPS_ENDPOINT`, and `AWS_ENDPOINT_URL` environment variables. - - 5. The service-specific endpoint value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `services` section of the shared `config` file. - - 6. The value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `profile` of the shared `config` file. - - 7. `[use_dualstack_endpoint](./cli-configure-files.html#cli-config-use_dualstack_endpoint)`, `[use_fips_endpoint](./cli-configure-files.html#cli-config-use_fips_endpoint)`, and `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` settings. - - 8. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. - +Specifies the endpoint that is used for all service requests. For more information, see [Set global endpoint for all AWS services](./cli-configure-endpoints.html#endpoints-global). @@ -183,0 +202 @@ Endpoint configuration settings are located in multiple places, such as the syst +###### Endpoint precedence @@ -184,0 +204 @@ Endpoint configuration settings are located in multiple places, such as the syst +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). @@ -195,19 +215 @@ For a list of all service-specific environment variables, see [List of service-s -Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI endpoint configuration settings take precedence in the following order: - - 1. The `[--endpoint-url](./cli-configure-options.html#cli-configure-options-endpoint-url)` command line option. - - 2. If enabled, the `AWS_IGNORE_CONFIGURED_ENDPOINT_URLS` global endpoint environment variable or profile setting `[ignore_configure_endpoint_urls](./cli-configure-files.html#cli-config-ignore_configure_endpoint_urls)` to ignore custom endpoints. - - 3. The value provided by a service-specific environment variable `AWS_ENDPOINT_URL_<SERVICE>`, such as `AWS_ENDPOINT_URL_DYNAMODB`. - - 4. The values provided by the `AWS_USE_DUALSTACK_ENDPOINT`, `AWS_USE_FIPS_ENDPOINT`, and `AWS_ENDPOINT_URL` environment variables. - - 5. The service-specific endpoint value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `services` section of the shared `config` file. - - 6. The value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `profile` of the shared `config` file. - - 7. `[use_dualstack_endpoint](./cli-configure-files.html#cli-config-use_dualstack_endpoint)`, `[use_fips_endpoint](./cli-configure-files.html#cli-config-use_fips_endpoint)`, and `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` settings. - - 8. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. - - +###### Endpoint precedence @@ -214,0 +217 @@ Endpoint configuration settings are located in multiple places, such as the syst +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). @@ -221,19 +224 @@ Endpoint configuration settings are located in multiple places, such as the syst -If enabled, the AWS CLI ignores all custom endpoint configurations. Valid values are `**true**` and `**false**`. - -Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI endpoint configuration settings take precedence in the following order: - - 1. The `[--endpoint-url](./cli-configure-options.html#cli-configure-options-endpoint-url)` command line option. - - 2. If enabled, the `AWS_IGNORE_CONFIGURED_ENDPOINT_URLS` global endpoint environment variable or profile setting `[ignore_configure_endpoint_urls](./cli-configure-files.html#cli-config-ignore_configure_endpoint_urls)` to ignore custom endpoints. - - 3. The value provided by a service-specific environment variable `AWS_ENDPOINT_URL_<SERVICE>`, such as `AWS_ENDPOINT_URL_DYNAMODB`. - - 4. The values provided by the `AWS_USE_DUALSTACK_ENDPOINT`, `AWS_USE_FIPS_ENDPOINT`, and `AWS_ENDPOINT_URL` environment variables. - - 5. The service-specific endpoint value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `services` section of the shared `config` file. - - 6. The value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `profile` of the shared `config` file. - - 7. `[use_dualstack_endpoint](./cli-configure-files.html#cli-config-use_dualstack_endpoint)`, `[use_fips_endpoint](./cli-configure-files.html#cli-config-use_fips_endpoint)`, and `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` settings. - - 8. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. +If enabled, the AWS CLI ignores all custom endpoint configurations. Valid values are `**true**` and `**false**`. For more information, see [Set global endpoint for all AWS services](./cli-configure-endpoints.html#endpoints-global). @@ -240,0 +226 @@ Endpoint configuration settings are located in multiple places, such as the syst +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. For endpoint precedence, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). @@ -241,0 +228 @@ Endpoint configuration settings are located in multiple places, such as the syst +###### Endpoint precedence @@ -242,0 +230 @@ Endpoint configuration settings are located in multiple places, such as the syst +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). @@ -424,20 +412 @@ You can specify one of two values: -Enables the use of dual-stack endpoints to send AWS requests. To learn more about dual-stack endpoints, which support both IPv4 and IPv6 traffic, see [Using Amazon S3 dual-stack endpoints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/dual-stack-endpoints.html) in the _Amazon Simple Storage Service User Guide_. Dual-stack endpoints are available for some services in some regions. If a dual-stack endpoint does not exist for the service or AWS Region, the request fails. This is disabled by default. - -Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI endpoint configuration settings take precedence in the following order: - - 1. The `[--endpoint-url](./cli-configure-options.html#cli-configure-options-endpoint-url)` command line option. - - 2. If enabled, the `AWS_IGNORE_CONFIGURED_ENDPOINT_URLS` global endpoint environment variable or profile setting `[ignore_configure_endpoint_urls](./cli-configure-files.html#cli-config-ignore_configure_endpoint_urls)` to ignore custom endpoints. - - 3. The value provided by a service-specific environment variable `AWS_ENDPOINT_URL_<SERVICE>`, such as `AWS_ENDPOINT_URL_DYNAMODB`. - - 4. The values provided by the `AWS_USE_DUALSTACK_ENDPOINT`, `AWS_USE_FIPS_ENDPOINT`, and `AWS_ENDPOINT_URL` environment variables. - - 5. The service-specific endpoint value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `services` section of the shared `config` file. - - 6. The value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `profile` of the shared `config` file. - - 7. `[use_dualstack_endpoint](./cli-configure-files.html#cli-config-use_dualstack_endpoint)`, `[use_fips_endpoint](./cli-configure-files.html#cli-config-use_fips_endpoint)`, and `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` settings. - - 8. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. - +Enables the use of dual-stack endpoints to send AWS requests. To learn more about dual-stack endpoints, which support both IPv4 and IPv6 traffic, see [Using Amazon S3 dual-stack endpoints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/dual-stack-endpoints.html) in the _Amazon Simple Storage Service User Guide_. Dual-stack endpoints are available for some services in some regions. If a dual-stack endpoint does not exist for the service or AWS Region, the request fails. This is disabled by default. For more information, see [Set to use dual-stack endpoints for all AWS services](./cli-configure-endpoints.html#endpoints-dual-stack). @@ -444,0 +414 @@ Endpoint configuration settings are located in multiple places, such as the syst +###### Endpoint precedence @@ -445,0 +416 @@ Endpoint configuration settings are located in multiple places, such as the syst +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). @@ -452 +423 @@ Endpoint configuration settings are located in multiple places, such as the syst -Some AWS services offer endpoints that support [Federal Information Processing Standard (FIPS) 140-2](http://aws.amazon.com/compliance/fips/) in some AWS Regions. When the AWS service supports FIPS, this setting specifies what FIPS endpoint the AWS CLI should use . Unlike standard AWS endpoints, FIPS endpoints use a TLS software library that complies with FIPS 140-2. These endpoints might be required by enterprises that interact with the United States government. +Some AWS services offer endpoints that support [Federal Information Processing Standard (FIPS) 140-2](http://aws.amazon.com/compliance/fips/) in some AWS Regions. When the AWS service supports FIPS, this setting specifies what FIPS endpoint the AWS CLI should use . Unlike standard AWS endpoints, FIPS endpoints use a TLS software library that complies with FIPS 140-2. These endpoints might be required by enterprises that interact with the United States government. For more information see, [Set to use FIPs endpoints for all AWS services](./cli-configure-endpoints.html#endpoints-fips). @@ -456,21 +427 @@ If this setting is enabled, but a FIPS endpoint does not exist for the service i -For more information on specifying FIPS endpoints by AWS Region, see [FIPS Endpoints by Service](https://aws.amazon.com/compliance/fips/). - -Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI endpoint configuration settings take precedence in the following order: - - 1. The `[--endpoint-url](./cli-configure-options.html#cli-configure-options-endpoint-url)` command line option. - - 2. If enabled, the `AWS_IGNORE_CONFIGURED_ENDPOINT_URLS` global endpoint environment variable or profile setting `[ignore_configure_endpoint_urls](./cli-configure-files.html#cli-config-ignore_configure_endpoint_urls)` to ignore custom endpoints. - - 3. The value provided by a service-specific environment variable `AWS_ENDPOINT_URL_<SERVICE>`, such as `AWS_ENDPOINT_URL_DYNAMODB`. - - 4. The values provided by the `AWS_USE_DUALSTACK_ENDPOINT`, `AWS_USE_FIPS_ENDPOINT`, and `AWS_ENDPOINT_URL` environment variables. - - 5. The service-specific endpoint value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `services` section of the shared `config` file. - - 6. The value provided by the `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` setting within a `profile` of the shared `config` file. - - 7. `[use_dualstack_endpoint](./cli-configure-files.html#cli-config-use_dualstack_endpoint)`, `[use_fips_endpoint](./cli-configure-files.html#cli-config-use_fips_endpoint)`, and `[endpoint_url](./cli-configure-files.html#cli-config-endpoint_url)` settings. - - 8. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. - - +###### Endpoint precedence @@ -477,0 +429 @@ Endpoint configuration settings are located in multiple places, such as the syst +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). @@ -502 +454 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Configuration and credential file settings in the AWS CLI +Configuration settings @@ -504 +456 @@ Configuration and credential file settings in the AWS CLI -Command line options in the AWS CLI +Command line options