AWS documentdb medium security documentation change

Service: documentdb · 2025-03-26 · Security-related medium

File: documentdb/latest/developerguide/encryption-at-rest.md

Summary

Corrected CLI command reference from describe-db-clusters to create-db-cluster and updated example parameters for encryption configuration

Security assessment

Fixes a critical documentation error where an incorrect CLI command (describe-db-clusters) was referenced for enabling encryption. Using the wrong command could lead to clusters being created without encryption, introducing security risks.

Diff

diff --git a/documentdb/latest/developerguide/encryption-at-rest.md b/documentdb/latest/developerguide/encryption-at-rest.md
index da5c5d058..ff9bf9ebf 100644
--- a/documentdb/latest/developerguide/encryption-at-rest.md
+++ b/documentdb/latest/developerguide/encryption-at-rest.md
@@ -74 +74 @@ Using the AWS CLI
-To encrypt an Amazon DocumentDB cluster using the AWS CLI, you must specify the `--storage-encrypted` option when creating the cluster. Amazon DocumentDB clusters created using the AWS CLI do not enable storage encryption by default.
+To encrypt an Amazon DocumentDB cluster using the AWS CLI, run the [`create-db-cluster`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/docdb/describe-db-clusters.html) command and specify the `--storage-encrypted` option. Amazon DocumentDB clusters created using the AWS CLI do not enable storage encryption by default.
@@ -77,0 +78,2 @@ The following example creates an Amazon DocumentDB cluster with storage encrypti
+In the following examples, replace each `user input placeholder` with your cluster's information.
+
@@ -82 +84 @@ For Linux, macOS, or Unix:
-          --db-cluster-identifier sample-cluster \
+      --db-cluster-identifier mydocdbcluster \
@@ -85,2 +87,2 @@ For Linux, macOS, or Unix:
-          --master-username yourPrimaryUsername \
-          --master-user-password yourPrimaryPassword \
+      --master-username SampleUser1 \
+      --master-user-password primaryPassword \
@@ -93 +95 @@ For Windows:
-          --db-cluster-identifier sample-cluster ^
+      --db-cluster-identifier SampleUser1 ^
@@ -96,2 +98,2 @@ For Windows:
-          --master-username yourPrimaryUsername ^
-          --master-user-password yourPrimaryPassword ^
+      --master-username SampleUser1 ^
+      --master-user-password primaryPassword ^
@@ -106 +108 @@ For Linux, macOS, or Unix:
-          --db-cluster-identifier sample-cluster \
+      --db-cluster-identifier SampleUser1 \
@@ -109 +111 @@ For Linux, macOS, or Unix:
-          --master-username yourPrimaryUsername \
+      --master-username primaryUsername \
@@ -118 +120 @@ For Windows:
-          --db-cluster-identifier sample-cluster ^
+      --db-cluster-identifier SampleUser1 ^
@@ -121,2 +123,2 @@ For Windows:
-          --master-username yourPrimaryUsername ^
-          --master-user-password yourPrimaryPassword ^
+      --master-username SampleUser1 ^
+      --master-user-password primaryPassword ^