AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2025-05-16 · Documentation medium

File: AWSCloudFormation/latest/UserGuide/aws-resource-dsql-cluster.md

Summary

Expanded cluster creation documentation with multi-region support details and required IAM permissions

Security assessment

Documents required IAM permissions for multi-region clusters including security-sensitive actions like PutWitnessRegion and AddPeerCluster. While not fixing a vulnerability, it adds security-relevant documentation about access control requirements.

Diff

diff --git a/AWSCloudFormation/latest/UserGuide/aws-resource-dsql-cluster.md b/AWSCloudFormation/latest/UserGuide/aws-resource-dsql-cluster.md
index edb23eb7c..b22221659 100644
--- a//AWSCloudFormation/latest/UserGuide/aws-resource-dsql-cluster.md
+++ b//AWSCloudFormation/latest/UserGuide/aws-resource-dsql-cluster.md
@@ -7 +7,58 @@ SyntaxPropertiesReturn valuesRemarksSee also
-Creates a cluster in Amazon Aurora DSQL.
+The CreateCluster API allows you to create both single-region clusters and multi-Region clusters. With the addition of the _multiRegionProperties_ parameter, you can create a cluster with witness Region support and establish peer relationships with clusters in other Regions during creation.
+
+###### Note
+
+Creating multi-Region clusters requires additional IAM permissions beyond those needed for single-Region clusters, as detailed in the **Required permissions** section below.
+
+**Required permissions**
+
+dsql:CreateCluster
+    
+
+Required to create a cluster.
+
+Resources: `arn:aws:dsql:region:account-id:cluster/*`
+
+dsql:TagResource
+    
+
+Permission to add tags to a resource.
+
+Resources: `arn:aws:dsql:region:account-id:cluster/*`
+
+dsql:PutMultiRegionProperties
+    
+
+Permission to configure multi-region properties for a cluster.
+
+Resources: `arn:aws:dsql:region:account-id:cluster/*`
+
+dsql:AddPeerCluster
+    
+
+When specifying `multiRegionProperties.clusters`, permission to add peer clusters.
+
+Resources:
+
+  * Local cluster: `arn:aws:dsql:region:account-id:cluster/*`
+
+  * Each peer cluster: exact ARN of each specified peer cluster
+
+
+
+
+dsql:PutWitnessRegion
+    
+
+When specifying `multiRegionProperties.witnessRegion`, permission to set a witness Region. This permission is checked both in the cluster Region and in the witness Region.
+
+Resources: `arn:aws:dsql:region:account-id:cluster/*`
+
+Condition Keys: `dsql:WitnessRegion` (matching the specified witness region)
+
+###### Important
+
+  * The witness Region specified in `multiRegionProperties.witnessRegion` cannot be the same as the cluster's Region.
+
+
+