AWS cli documentation change
Summary
Added documentation for account-based endpoint configuration settings (account_id_endpoint_mode, aws_account_id), updated endpoint precedence references to a centralized section, expanded FIPS/dual-stack endpoint documentation, and improved formatting throughout.
Security assessment
The changes primarily document configuration options for account-based endpoints and endpoint precedence. While FIPS endpoints relate to security compliance, the changes only add explanatory documentation rather than addressing a specific vulnerability. The updates enhance documentation about existing security features (FIPS, dual-stack) but don't indicate remediation of a security issue.
Diff
diff --git a/cli/v1/userguide/cli-configure-files.md index 1b4024f86..b0eff0a73 100644 --- a/cli/v1/userguide/cli-configure-files.md +++ b/cli/v1/userguide/cli-configure-files.md @@ -406 +406,17 @@ The following settings are supported in the `config` file. The values listed in -_ +** + +`account_id_endpoint_mode` ** + + +Specifies whether to use AWS account-based endpoint IDs for calls to supported AWS services. For more information on account-based endpoints, see [Account-based endpoints](./cli-configure-endpoints.html#endpoints-accountid). + +This setting can be set to the following: + + * **(default)** **`preferred`** – The endpoint should include account ID if available. + + * **`disabled`** – A resolved endpoint doesn't include account ID. + + * **`required`** – The endpoint must include account ID. If the account ID isn't available, the SDK throws an error. + + + @@ -408 +424,12 @@ _ -`api_versions`_ +Can be overridden by the `[AWS_ACCOUNT_ID_ENDPOINT_MODE](./cli-configure-envvars.html#envvars-list-AWS_ACCOUNT_ID_ENDPOINT_MODE)` environment variable. To use account-based endpoints, the ID must be set in the `[AWS_ACCOUNT_ID](./cli-configure-envvars.html#envvars-list-AWS_ACCOUNT_ID)` environment variable or `aws_account_id` setting. + + + account_id_endpoint_mode = preferred + +###### Endpoint precedence + +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). + +** + +`api_versions` ** @@ -437,0 +465,16 @@ Can be overridden by the `AWS_ACCESS_KEY_ID` environment variable. You can't spe +`aws_account_id` ** + + +Specifies the AWS account-based endpoint ID to use for calls to supported AWS services. For more information on account-based endpoints, see [Account-based endpoints](./cli-configure-endpoints.html#endpoints-accountid). + +Can be overridden by the `[AWS_ACCOUNT_ID](./cli-configure-envvars.html#envvars-list-AWS_ACCOUNT_ID)` environment variable. The `[AWS_ACCOUNT_ID_ENDPOINT_MODE](./cli-configure-envvars.html#envvars-list-AWS_ACCOUNT_ID_ENDPOINT_MODE)` environment variable or `account_id_endpoint_mode` setting must be set to `preferred` or `required` to use this setting. + + + aws_account_id = 123456789EXAMPLE + +###### Endpoint precedence + +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). + +** + @@ -575 +618 @@ Specifies the maximum duration of the role session, in seconds. The value can ra -Specifies the endpoint that is used for all service requests. If this setting is used in the services section of the `config` file, then the endpoint is used only for the specified service. +Specifies the endpoint that is used for all service requests. If this setting is used in the services section of the `config` file, then the endpoint is used only for the specified service. For more information, see [Set global endpoint for all AWS services](./cli-configure-endpoints.html#endpoints-global). @@ -588,19 +631 @@ The following example uses the global endpoint `http://localhost:1234` and a ser -Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI endpoint configuration settings take precedence in the following order: - - 1. The `[--endpoint-url](./cli-configure-options.html#cli-configure-options-endpoint-url)` command line option. - - 2. If enabled, the `[AWS_IGNORE_CONFIGURED_ENDPOINT_URLS](./cli-configure-envvars.html#envvars-list-AWS_IGNORE_CONFIGURED_URLS)` global endpoint environment variable or profile setting `ignore_configure_endpoint_urls` to ignore custom endpoints. - - 3. The value provided by a service-specific environment variable `[AWS_ENDPOINT_URL_<SERVICE>](./cli-configure-envvars.html#envvars-list-AWS_ENDPOINT_URL_SERVICE)`, such as `AWS_ENDPOINT_URL_DYNAMODB`. - - 4. The values provided by the `[AWS_USE_DUALSTACK_ENDPOINT](./cli-configure-envvars.html#envvars-list-AWS_USE_DUALSTACK_ENDPOINT)`, `[AWS_USE_FIPS_ENDPOINT](./cli-configure-envvars.html#envvars-list-AWS_USE_FIPS_ENDPOINT)`, and `[AWS_ENDPOINT_URL](./cli-configure-envvars.html#envvars-list-AWS_ENDPOINT_URL)` environment variables. - - 5. The service-specific endpoint value provided by the `endpoint_url` setting within a `services` section of the shared `config` file. - - 6. The value provided by the `endpoint_url` setting within a `profile` of the shared `config` file. - - 7. `use_dualstack_endpoint`, `use_fips_endpoint`, and `endpoint_url` settings. - - 8. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. - - +###### Endpoint precedence @@ -607,0 +633 @@ Endpoint configuration settings are located in multiple places, such as the syst +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). @@ -619,19 +645 @@ If enabled, the AWS CLI ignores all custom endpoint configurations specified in -Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI endpoint configuration settings take precedence in the following order: - - 1. The `[--endpoint-url](./cli-configure-options.html#cli-configure-options-endpoint-url)` command line option. - - 2. If enabled, the `[AWS_IGNORE_CONFIGURED_ENDPOINT_URLS](./cli-configure-envvars.html#envvars-list-AWS_IGNORE_CONFIGURED_URLS)` global endpoint environment variable or profile setting `ignore_configure_endpoint_urls` to ignore custom endpoints. - - 3. The value provided by a service-specific environment variable `[AWS_ENDPOINT_URL_<SERVICE>](./cli-configure-envvars.html#envvars-list-AWS_ENDPOINT_URL_SERVICE)`, such as `AWS_ENDPOINT_URL_DYNAMODB`. - - 4. The values provided by the `[AWS_USE_DUALSTACK_ENDPOINT](./cli-configure-envvars.html#envvars-list-AWS_USE_DUALSTACK_ENDPOINT)`, `[AWS_USE_FIPS_ENDPOINT](./cli-configure-envvars.html#envvars-list-AWS_USE_FIPS_ENDPOINT)`, and `[AWS_ENDPOINT_URL](./cli-configure-envvars.html#envvars-list-AWS_ENDPOINT_URL)` environment variables. - - 5. The service-specific endpoint value provided by the `endpoint_url` setting within a `services` section of the shared `config` file. - - 6. The value provided by the `endpoint_url` setting within a `profile` of the shared `config` file. - - 7. `use_dualstack_endpoint`, `use_fips_endpoint`, and `endpoint_url` settings. - - 8. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. - - +###### Endpoint precedence @@ -638,0 +647 @@ Endpoint configuration settings are located in multiple places, such as the syst +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). @@ -870 +879 @@ Specifies a named profile with long-term credentials that the AWS CLI can use to -_ +** @@ -872 +881 @@ _ -`sts_regional_endpoints`_ +`sts_regional_endpoints`** @@ -888 +897 @@ This setting can be overwritten by using the `AWS_STS_REGIONAL_ENDPOINTS` enviro -_ +** @@ -890 +899 @@ _ -`use_dualstack_endpoint`_ +`use_dualstack_endpoint`** @@ -893 +902 @@ _ -Enables the use of dual-stack endpoints to send AWS requests. To learn more about dual-stack endpoints, which support both IPv4 and IPv6 traffic, see [Using Amazon S3 dual-stack endpoints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/dual-stack-endpoints.html) in the _Amazon Simple Storage Service User Guide_. Dual-stack endpoints are available for some services in some regions. If a dual-stack endpoint does not exist for the service or AWS Region, the request fails. This is disabled by default. +Enables the use of dual-stack endpoints to send AWS requests. To learn more about dual-stack endpoints, which support both IPv4 and IPv6 traffic, see [Using Amazon S3 dual-stack endpoints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/dual-stack-endpoints.html) in the _Amazon Simple Storage Service User Guide_. Dual-stack endpoints are available for some services in some regions. If a dual-stack endpoint does not exist for the service or AWS Region, the request fails. Valid settings are `true` and `false`. This is disabled by default. For more information, see [Set to use dual-stack endpoints for all AWS services](./cli-configure-endpoints.html#endpoints-dual-stack). @@ -897,3 +906 @@ This is mutually exclusive with the `use_accelerate_endpoint` setting. -Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI endpoint configuration settings take precedence in the following order: - - 1. The `[--endpoint-url](./cli-configure-options.html#cli-configure-options-endpoint-url)` command line option. +###### Endpoint precedence @@ -901 +908 @@ Endpoint configuration settings are located in multiple places, such as the syst - 2. If enabled, the `[AWS_IGNORE_CONFIGURED_ENDPOINT_URLS](./cli-configure-envvars.html#envvars-list-AWS_IGNORE_CONFIGURED_URLS)` global endpoint environment variable or profile setting `ignore_configure_endpoint_urls` to ignore custom endpoints. +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). @@ -903,16 +910 @@ Endpoint configuration settings are located in multiple places, such as the syst - 3. The value provided by a service-specific environment variable `[AWS_ENDPOINT_URL_<SERVICE>](./cli-configure-envvars.html#envvars-list-AWS_ENDPOINT_URL_SERVICE)`, such as `AWS_ENDPOINT_URL_DYNAMODB`. - - 4. The values provided by the `[AWS_USE_DUALSTACK_ENDPOINT](./cli-configure-envvars.html#envvars-list-AWS_USE_DUALSTACK_ENDPOINT)`, `[AWS_USE_FIPS_ENDPOINT](./cli-configure-envvars.html#envvars-list-AWS_USE_FIPS_ENDPOINT)`, and `[AWS_ENDPOINT_URL](./cli-configure-envvars.html#envvars-list-AWS_ENDPOINT_URL)` environment variables. - - 5. The service-specific endpoint value provided by the `endpoint_url` setting within a `services` section of the shared `config` file. - - 6. The value provided by the `endpoint_url` setting within a `profile` of the shared `config` file. - - 7. `use_dualstack_endpoint`, `use_fips_endpoint`, and `endpoint_url` settings. - - 8. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. - - - - -_ +** @@ -920 +912 @@ _ -`use_fips_endpoint`_ +`use_fips_endpoint`** @@ -923 +915 @@ _ -Some AWS services offer endpoints that support [Federal Information Processing Standard (FIPS) 140-2](http://aws.amazon.com/compliance/fips/) in some AWS Regions. When the AWS service supports FIPS, this setting specifies what FIPS endpoint the AWS CLI should use . Unlike standard AWS endpoints, FIPS endpoints use a TLS software library that complies with FIPS 140-2. These endpoints might be required by enterprises that interact with the United States government. +Some AWS services offer endpoints that support [Federal Information Processing Standard (FIPS) 140-2](http://aws.amazon.com/compliance/fips/) in some AWS Regions. When the AWS service supports FIPS, this setting specifies what FIPS endpoint the AWS CLI should use . Unlike standard AWS endpoints, FIPS endpoints use a TLS software library that complies with FIPS 140-2. These endpoints might be required by enterprises that interact with the United States government. For more information see, [Set to use FIPs endpoints for all AWS services](./cli-configure-endpoints.html#endpoints-fips). @@ -927 +919 @@ If this setting is enabled, but a FIPS endpoint does not exist for the service i -For more information on specifying FIPS endpoints by AWS Region, see [FIPS Endpoints by Service](https://aws.amazon.com/compliance/fips/). +###### Endpoint precedence @@ -929 +921 @@ For more information on specifying FIPS endpoints by AWS Region, see [FIPS Endpo -Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI endpoint configuration settings take precedence in the following order: +Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, see [Endpoint configuration and settings precedence](./cli-configure-endpoints.html#endpoints-precedence). @@ -931,20 +923 @@ Endpoint configuration settings are located in multiple places, such as the syst - 1. The `[--endpoint-url](./cli-configure-options.html#cli-configure-options-endpoint-url)` command line option. - - 2. If enabled, the `[AWS_IGNORE_CONFIGURED_ENDPOINT_URLS](./cli-configure-envvars.html#envvars-list-AWS_IGNORE_CONFIGURED_URLS)` global endpoint environment variable or profile setting `ignore_configure_endpoint_urls` to ignore custom endpoints. - - 3. The value provided by a service-specific environment variable `[AWS_ENDPOINT_URL_<SERVICE>](./cli-configure-envvars.html#envvars-list-AWS_ENDPOINT_URL_SERVICE)`, such as `AWS_ENDPOINT_URL_DYNAMODB`. - - 4. The values provided by the `[AWS_USE_DUALSTACK_ENDPOINT](./cli-configure-envvars.html#envvars-list-AWS_USE_DUALSTACK_ENDPOINT)`, `[AWS_USE_FIPS_ENDPOINT](./cli-configure-envvars.html#envvars-list-AWS_USE_FIPS_ENDPOINT)`, and `[AWS_ENDPOINT_URL](./cli-configure-envvars.html#envvars-list-AWS_ENDPOINT_URL)` environment variables. - - 5. The service-specific endpoint value provided by the `endpoint_url` setting within a `services` section of the shared `config` file. - - 6. The value provided by the `endpoint_url` setting within a `profile` of the shared `config` file. - - 7. `use_dualstack_endpoint`, `use_fips_endpoint`, and `endpoint_url` settings. - - 8. Any default endpoint URL for the respective AWS service is used last. For a list of the standard service endpoints available in each Region, see [AWS Regions and Endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) in the _Amazon Web Services General Reference_. - - - - -_ +** @@ -952 +925 @@ _ -`[web_identity_token_file](./cli-configure-role.html#cli-configure-role-oidc)`_ +`[web_identity_token_file](./cli-configure-role.html#cli-configure-role-oidc)`** @@ -961 +934 @@ For more information on using web identities, see [Assume role with web identity -_ +** @@ -963 +936 @@ _ -`tcp_keepalive`_ +`tcp_keepalive`** @@ -1024,0 +998,9 @@ If set to true, the AWS CLI directs all Amazon S3 requests to the `S3 Accelerate +** + +`use_dualstack_endpoint`** + + +Enables the use of dual-stack endpoints to send `s3` and `s3api` requests. To learn more about dual-stack endpoints, which support both IPv4 and IPv6 traffic, see [Using Amazon S3 dual-stack endpoints](https://docs.aws.amazon.com/AmazonS3/latest/userguide/dual-stack-endpoints.html) in the _Amazon Simple Storage Service User Guide_. Dual-stack endpoints are available for some services in some regions. If a dual-stack endpoint does not exist for the service or AWS Region, the request fails. Valid settings are `true` and `false`. This is disabled by default. For more information, see [Set to use dual-stack endpoints for all AWS services](./cli-configure-endpoints.html#endpoints-dual-stack). + +This is mutually exclusive with the `use_accelerate_endpoint` setting. +