AWS parallelcluster documentation change
Summary
Minor grammatical improvements and clarifications in LDAP/AD integration documentation (e.g., secret creation instructions, certificate bundle description, access control examples)
Security assessment
Changes are editorial improvements to existing security-related documentation but do not introduce new security controls or address specific vulnerabilities. The modifications clarify certificate bundle usage and secret management best practices without altering security posture.
Diff
diff --git a/parallelcluster/latest/ug/DirectoryService-v3.md b/parallelcluster/latest/ug/DirectoryService-v3.md index 294776764..dd115b374 100644 --- a//parallelcluster/latest/ug/DirectoryService-v3.md +++ b//parallelcluster/latest/ug/DirectoryService-v3.md @@ -85 +85 @@ The Amazon Resource Name (ARN) of the AWS Secrets Manager secret that contains t -When creating a secret using the AWS Secrets Manager console be sure to select "Other type of secret", select plaintext, and only include the password text in the secret. +When you use the AWS Secrets Manager console to create a secret, be sure to select "Other type of secret", select plaintext, and only include the password text in the secret. @@ -89 +89 @@ For more information on how to use AWS Secrets Manager to create a secret refer -The LDAP client uses the password to authenticate to the AD domain as a `DomainReadOnlyUser` when requesting identity information. +The LDAP client uses the password to authenticate to the AD domain as a `DomainReadOnlyUser` when it requests identity information. @@ -123 +123 @@ Specify the identity in the form required by the specific LDAP client that's on -The absolute path to a certificates bundle containing the certificates for every certification authority in the certification chain that issued a certificate for the domain controllers. It corresponds to the SSSD-LDAP parameter that's called `ldap_tls_cacert`. +The absolute path to a certificates bundle that contains the certificates for every certification authority in the certification chain that issued a certificate for the domain controllers. It corresponds to the SSSD-LDAP parameter that's called `ldap_tls_cacert`. @@ -125 +125 @@ The absolute path to a certificates bundle containing the certificates for every -A certificate bundle is a file that's composed of the concatenation of distinct certificates in PEM format, also known as DER Base64 format in Windows. It is used to verify the identity of the AD domain controller that is acting as the LDAP server. +A certificate bundle is a file that's composed of the concatenation of distinct certificates in PEM format, also known as DER Base64 format in Windows. It is used to verify the identity of the AD domain controller that acts as the LDAP server. @@ -164,2 +164,2 @@ Examples: - "!(cn=SomeUser*)" # denies access to every user with alias starting with "SomeUser" - "(cn=SomeUser*)" # allows access to every user with alias starting with "SomeUser" + "!(cn=SomeUser*)" # denies access to every user with an alias that starts with "SomeUser" + "(cn=SomeUser*)" # allows access to every user with alias that starts with "SomeUser" @@ -197 +197 @@ The default is `true`. -A dictionary of key-value pairs containing SSSD parameters and values to write to the SSSD config file on cluster instances. For a full description of the SSSD configuration file, see the on-instance man pages for `SSSD` and related configuration files. +A dictionary of key-value pairs that contain SSSD parameters and values to write to the SSSD config file on cluster instances. For a full description of the SSSD configuration file, see the on-instance man pages for `SSSD` and related configuration files.