AWS documentdb documentation change
Summary
Updated CLI command examples and parameter descriptions for TLS configuration management. Added FIPS-140-3 enablement example, improved documentation links, and standardized placeholder values.
Security assessment
The changes add explicit documentation about enabling FIPS-140-3 TLS mode, which is a security feature. However, there is no evidence this addresses a specific vulnerability or incident.
Diff
diff --git a/documentdb/latest/developerguide/security.encryption.ssl.md b/documentdb/latest/developerguide/security.encryption.ssl.md index 6e2482d22..8092c97f2 100644 --- a/documentdb/latest/developerguide/security.encryption.ssl.md +++ b/documentdb/latest/developerguide/security.encryption.ssl.md @@ -118 +118 @@ Unless you specify differently when you create a cluster, the cluster is created -Use the `describe-db-clusters` command with the following parameters: +Run the [`describe-db-clusters`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/docdb/describe-db-clusters.html) command with the following options: @@ -120 +120 @@ Use the `describe-db-clusters` command with the following parameters: - * `--db-cluster-identifier` — Required. The name of the cluster of interest. + * `--db-cluster-identifier` @@ -122 +122,3 @@ Use the `describe-db-clusters` command with the following parameters: - * `--query` — Optional. A query that limits the output to just the fields of interest, in this case, the cluster name and its cluster parameter group name. + * `--query` + +In the following example, replace each `user input placeholder` with your cluster's information. @@ -125 +127 @@ Use the `describe-db-clusters` command with the following parameters: - --db-cluster-identifier docdb-2019-05-07-13-57-08 \ + --db-cluster-identifier mydocdbcluster \ @@ -128 +130 @@ Use the `describe-db-clusters` command with the following parameters: -Output from this operation looks something like the following (JSON format). +Output from this operation looks something like the following (JSON format): @@ -132,2 +134,2 @@ Output from this operation looks something like the following (JSON format). - "docdb-2019-05-07-13-57-08", - "custom3-6-param-grp" + "mydocdbcluster", + "myparametergroup" @@ -146 +147,5 @@ If the name of the cluster's parameter group is `default` (for example, `default -To get more information about this cluster parameter group, use the `describe-db-cluster-parameters` operation with the following parameters: +To get more information about this cluster parameter group, run the [`describe-db-cluster-parameters`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/docdb/describe-db-cluster-parameters.html) command with the following options: + + * `--db-cluster-parameter-group-name` + + * `--query` @@ -148 +153 @@ To get more information about this cluster parameter group, use the `describe-db - * `--db-cluster-parameter-group-name` — Required. Use the cluster parameter group name from the output of the previous command. +Limits the output to just the fields of interest: `ParameterName`, `ParameterValue`,`AllowedValues`, and `ApplyType`. @@ -150 +155 @@ To get more information about this cluster parameter group, use the `describe-db - * `--query` — Optional. A query that limits the output to just the fields of interest, in this case, the `ParameterName`, `ParameterValue`, `AllowedValues`, and `ApplyType`. +In the following example, replace each `user input placeholder` with your cluster's information. @@ -153 +158 @@ To get more information about this cluster parameter group, use the `describe-db - --db-cluster-parameter-group-name custom3-6-param-grp \ + --db-cluster-parameter-group-name myparametergroup \ @@ -156 +161 @@ To get more information about this cluster parameter group, use the `describe-db -Output from this operation looks something like the following (JSON format). +Output from this operation looks something like the following (JSON format): @@ -166 +171 @@ Output from this operation looks something like the following (JSON format). - "tls", + **"tls", @@ -169 +174 @@ Output from this operation looks something like the following (JSON format). - "static" + "static"** @@ -182 +186 @@ Output from this operation looks something like the following (JSON format). -If the value of `tls` is not what it needs to be, modify its value for this cluster parameter group. To change the value of the `tls` cluster parameter, use the `modify-db-cluster-parameter-group` operation with the following parameters. +If the value of `tls` is not what it needs to be, modify its value for this cluster parameter group. To change the value of the `tls` cluster parameter, run the [`modify-db-cluster-parameter-group`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/docdb/modify-db-cluster-parameter-group.html) command with the following options: @@ -206 +210,3 @@ If the value of `tls` is not what it needs to be, modify its value for this clus -The following code _disables_ `tls`, applying the change to each DB instance when it is rebooted. +In the following examples, replace each `user input placeholder` with your cluster's information. + +The following code _disables_ `tls`, applying the change to each instance when it is rebooted. @@ -209 +215 @@ The following code _disables_ `tls`, applying the change to each DB instance whe - --db-cluster-parameter-group-name custom3-6-param-grp \ + --db-cluster-parameter-group-name myparametergroup \ @@ -215 +221 @@ The following code _enables_ `tls` (version 1.0 through 1.3) applying the change - --db-cluster-parameter-group-name custom3-6-param-grp \ + --db-cluster-parameter-group-name myparametergroup \ @@ -218 +224 @@ The following code _enables_ `tls` (version 1.0 through 1.3) applying the change -The following code _enables_ TLS with `fips-140-3`, applying the change to each DB instance when it is rebooted. +The following code _enables_ TLS with `fips-140-3`, applying the change to each instance when it is rebooted. @@ -221 +227 @@ The following code _enables_ TLS with `fips-140-3`, applying the change to each - ‐‐db-cluster-parameter-group-name custom5-0-param-grp \ + ‐‐db-cluster-parameter-group-name myparametergroup2 \ @@ -224 +230 @@ The following code _enables_ TLS with `fips-140-3`, applying the change to each -Output from this operation looks something like the following (JSON format). +Output from this operation looks something like the following (JSON format): @@ -227 +233 @@ Output from this operation looks something like the following (JSON format). - "DBClusterParameterGroupName": "custom3-6-param-grp" + "DBClusterParameterGroupName": "myparametergroup" @@ -232 +238,3 @@ Output from this operation looks something like the following (JSON format). -Reboot each instance of the cluster so that the change is applied to all instances in the cluster. To reboot an Amazon DocumentDB instance, use the `reboot-db-instance` operation with the following parameter: +Reboot each instance of the cluster so that the change is applied to all instances in the cluster. To reboot an Amazon DocumentDB instance, run the [`reboot-db-instance`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/docdb/reboot-db-instance.html) command with the following option: + + * `--db-instance-identifier` @@ -234 +242 @@ Reboot each instance of the cluster so that the change is applied to all instanc - * `--db-instance-identifier` — Required. The identifier for the instance to be rebooted. +The following code reboots the instance `mydocdbinstance`. @@ -236 +244 @@ Reboot each instance of the cluster so that the change is applied to all instanc -The following code reboots the instance `sample-db-instance`. +In the following examples, replace each `user input placeholder` with your cluster's information. @@ -241 +249 @@ For Linux, macOS, or Unix: - --db-instance-identifier sample-db-instance + --db-instance-identifier mydocdbinstance @@ -246 +254 @@ For Windows: - --db-instance-identifier sample-db-instance + --db-instance-identifier mydocdbinstance @@ -248 +256 @@ For Windows: -Output from this operation looks something like the following (JSON format). +Output from this operation looks something like the following (JSON format): @@ -321 +329 @@ Output from this operation looks something like the following (JSON format). - "DBInstanceIdentifier": "sample-cluster-instance-00", + "DBInstanceIdentifier": "mydocdbinstance", @@ -327 +335 @@ Output from this operation looks something like the following (JSON format). - "Address": "sample-cluster-instance-00.corcjozrlsfc.us-east-1.docdb.amazonaws.com", + "Address": "mydocdbinstance.corcjozrlsfc.us-east-1.docdb.amazonaws.com", @@ -331 +339 @@ Output from this operation looks something like the following (JSON format). - "DBClusterIdentifier": "sample-cluster" + "DBClusterIdentifier": "mydocdbcluster"