AWS datasync documentation change

Service: datasync · 2025-05-31 · Documentation low

File: datasync/latest/userguide/API_CreateLocationObjectStorage.md

Summary

Added documentation for CmkSecretConfig and CustomSecretConfig parameters, clarified agent usage, and updated SecretKey handling notes

Security assessment

The changes introduce documentation for new secret management configurations (CmkSecretConfig/CustomSecretConfig) involving KMS keys and Secrets Manager. While this adds security-related documentation about credential storage mechanisms, there is no evidence of addressing a specific vulnerability.

Diff

diff --git a/datasync/latest/userguide/API_CreateLocationObjectStorage.md b/datasync/latest/userguide/API_CreateLocationObjectStorage.md
index 4b590eee8..6384584ad 100644
--- a//datasync/latest/userguide/API_CreateLocationObjectStorage.md
+++ b//datasync/latest/userguide/API_CreateLocationObjectStorage.md
@@ -9 +9 @@ Request SyntaxRequest ParametersResponse SyntaxResponse ElementsErrorsSee Also
-Creates a transfer _location_ for an object storage system. AWS DataSync can use this location as a source or destination for transferring data.
+Creates a transfer _location_ for an object storage system. AWS DataSync can use this location as a source or destination for transferring data. You can make transfers with or without a [DataSync agent](https://docs.aws.amazon.com/datasync/latest/userguide/do-i-need-datasync-agent.html#when-agent-required).
@@ -19,0 +20,8 @@ Before you begin, make sure that you understand the [prerequisites](https://docs
+       "CmkSecretConfig": { 
+          "[KmsKeyArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-KmsKeyArn)": "string",
+          "[SecretArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-SecretArn)": "string"
+       },
+       "CustomSecretConfig": { 
+          "[SecretAccessRoleArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretAccessRoleArn)": "string",
+          "[SecretArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretArn)": "string"
+       },
@@ -56 +64,5 @@ Required: No
-Specifies the Amazon Resource Names (ARNs) of the DataSync agents that can connect with your object storage system.
+(Optional) Specifies the Amazon Resource Names (ARNs) of the DataSync agents that can connect with your object storage system. If you are setting up an agentless cross-cloud transfer, you do not need to specify a value for this parameter.
+
+###### Note
+
+Make sure you configure this parameter correctly when you first create your storage location. You cannot add or remove agents from a storage location after you create it.
@@ -66 +78 @@ Pattern: `^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):datasync:[a-z\-0-9]+:[0
-Required: Yes
+Required: No
@@ -80,0 +93,30 @@ Required: Yes
+**CmkSecretConfig **
+    
+
+Specifies configuration information for a DataSync-managed secret, which includes the `SecretKey` that DataSync uses to access a specific object storage location, with a customer-managed AWS KMS key.
+
+When you include this paramater as part of a `CreateLocationObjectStorage` request, you provide only the KMS key ARN. DataSync uses this KMS key together with the value you specify for the `SecretKey` parameter to create a DataSync-managed secret to store the location access credentials.
+
+Make sure the DataSync has permission to access the KMS key that you specify.
+
+###### Note
+
+You can use either `CmkSecretConfig` (with `SecretKey`) or `CustomSecretConfig` (without `SecretKey`) to provide credentials for a `CreateLocationObjectStorage` request. Do not provide both parameters for the same request.
+
+Type: [CmkSecretConfig](./API_CmkSecretConfig.html) object
+
+Required: No
+
+**CustomSecretConfig **
+    
+
+Specifies configuration information for a customer-managed Secrets Manager secret where the secret key for a specific object storage location is stored in plain text. This configuration includes the secret ARN, and the ARN for an IAM role that provides access to the secret.
+
+###### Note
+
+You can use either `CmkSecretConfig` (with `SecretKey`) or `CustomSecretConfig` (without `SecretKey`) to provide credentials for a `CreateLocationObjectStorage` request. Do not provide both parameters for the same request.
+
+Type: [CustomSecretConfig](./API_CustomSecretConfig.html) object
+
+Required: No
+
@@ -85,0 +128,4 @@ Specifies the secret key (for example, a password) if credentials are required t
+###### Note
+
+If you provide a secret using `SecretKey`, but do not provide secret configuration details using `CmkSecretConfig` or `CustomSecretConfig`, then DataSync stores the token using your AWS account's Secrets Manager secret.
+