AWS datasync medium security documentation change
Summary
Added documentation for new CmkSecretConfig and CustomSecretConfig parameters, clarified agent requirements, updated AuthenticationType valid values, and added security-related configuration notes for Azure Blob Storage locations.
Security assessment
The change introduces new security-related parameters (CmkSecretConfig/CustomSecretConfig) for managing authentication tokens with KMS/Secrets Manager. It explicitly documents credential storage mechanisms and access requirements. The addition of 'NONE' AuthenticationType with corresponding secret configurations indicates enhanced security controls for credential management.
Diff
diff --git a/datasync/latest/userguide/API_CreateLocationAzureBlob.md b/datasync/latest/userguide/API_CreateLocationAzureBlob.md index a17d59ad9..41f4b9ac7 100644 --- a//datasync/latest/userguide/API_CreateLocationAzureBlob.md +++ b//datasync/latest/userguide/API_CreateLocationAzureBlob.md @@ -9 +9 @@ Request SyntaxRequest ParametersResponse SyntaxResponse ElementsErrorsSee Also -Creates a transfer _location_ for a Microsoft Azure Blob Storage container. AWS DataSync can use this location as a transfer source or destination. +Creates a transfer _location_ for a Microsoft Azure Blob Storage container. AWS DataSync can use this location as a transfer source or destination. You can make transfers with or without a [DataSync agent](https://docs.aws.amazon.com/datasync/latest/userguide/creating-azure-blob-location.html#azure-blob-creating-agent) that connects to your container. @@ -11 +11 @@ Creates a transfer _location_ for a Microsoft Azure Blob Storage container. AWS -Before you begin, make sure you know [how DataSync accesses Azure Blob Storage](https://docs.aws.amazon.com/datasync/latest/userguide/creating-azure-blob-location.html#azure-blob-access) and works with [access tiers](https://docs.aws.amazon.com/datasync/latest/userguide/creating-azure-blob-location.html#azure-blob-access-tiers) and [blob types](https://docs.aws.amazon.com/datasync/latest/userguide/creating-azure-blob-location.html#blob-types). You also need a [DataSync agent](https://docs.aws.amazon.com/datasync/latest/userguide/creating-azure-blob-location.html#azure-blob-creating-agent) that can connect to your container. +Before you begin, make sure you know [how DataSync accesses Azure Blob Storage](https://docs.aws.amazon.com/datasync/latest/userguide/creating-azure-blob-location.html#azure-blob-access) and works with [access tiers](https://docs.aws.amazon.com/datasync/latest/userguide/creating-azure-blob-location.html#azure-blob-access-tiers) and [blob types](https://docs.aws.amazon.com/datasync/latest/userguide/creating-azure-blob-location.html#blob-types). @@ -20,0 +21,4 @@ Before you begin, make sure you know [how DataSync accesses Azure Blob Storage]( + "CmkSecretConfig": { + "[KmsKeyArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-KmsKeyArn)": "string", + "[SecretArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-SecretArn)": "string" + }, @@ -21,0 +26,4 @@ Before you begin, make sure you know [how DataSync accesses Azure Blob Storage]( + "CustomSecretConfig": { + "[SecretAccessRoleArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretAccessRoleArn)": "string", + "[SecretArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretArn)": "string" + }, @@ -54 +62 @@ Required: No -Specifies the Amazon Resource Name (ARN) of the DataSync agent that can connect with your Azure Blob Storage container. +(Optional) Specifies the Amazon Resource Name (ARN) of the DataSync agent that can connect with your Azure Blob Storage container. If you are setting up an agentless cross-cloud transfer, you do not need to specify a value for this parameter. @@ -57,0 +66,4 @@ You can specify more than one agent. For more information, see [Using multiple a +###### Note + +Make sure you configure this parameter correctly when you first create your storage location. You cannot add or remove agents from a storage location after you create it. + @@ -66 +78 @@ Pattern: `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0 -Required: Yes +Required: No @@ -75 +87 @@ Type: String -Valid Values: `SAS` +Valid Values: `SAS | NONE` @@ -89,0 +102,17 @@ Required: No +**CmkSecretConfig ** + + +Specifies configuration information for a DataSync-managed secret, which includes the authentication token that DataSync uses to access a specific AzureBlob storage location, with a customer-managed AWS KMS key. + +When you include this paramater as part of a `CreateLocationAzureBlob` request, you provide only the KMS key ARN. DataSync uses this KMS key together with the authentication token you specify for `SasConfiguration` to create a DataSync-managed secret to store the location access credentials. + +Make sure the DataSync has permission to access the KMS key that you specify. + +###### Note + +You can use either `CmkSecretConfig` (with `SasConfiguration`) or `CustomSecretConfig` (without `SasConfiguration`) to provide credentials for a `CreateLocationAzureBlob` request. Do not provide both parameters for the same request. + +Type: [CmkSecretConfig](./API_CmkSecretConfig.html) object + +Required: No + @@ -102,0 +132,13 @@ Required: Yes +**CustomSecretConfig ** + + +Specifies configuration information for a customer-managed Secrets Manager secret where the authentication token for an AzureBlob storage location is stored in plain text. This configuration includes the secret ARN, and the ARN for an IAM role that provides access to the secret. + +###### Note + +You can use either `CmkSecretConfig` (with `SasConfiguration`) or `CustomSecretConfig` (without `SasConfiguration`) to provide credentials for a `CreateLocationAzureBlob` request. Do not provide both parameters for the same request. + +Type: [CustomSecretConfig](./API_CustomSecretConfig.html) object + +Required: No + @@ -107,0 +150,4 @@ Specifies the SAS configuration that allows DataSync to access your Azure Blob S +###### Note + +If you provide an authentication token using `SasConfiguration`, but do not provide secret configuration details using `CmkSecretConfig` or `CustomSecretConfig`, then DataSync stores the token using your AWS account's secrets manager secret. +