AWS datasync high security documentation change

Service: datasync · 2025-05-31 · Security-related high

File: datasync/latest/userguide/API_UpdateLocationAzureBlob.md

Summary

Added CmkSecretConfig and CustomSecretConfig parameters for managing encryption secrets, updated agent ARN description with agentless transfer note, added validation about agent modification restrictions, and expanded AuthenticationType values

Security assessment

The addition of CmkSecretConfig and CustomSecretConfig directly relates to encryption key management and secret storage configuration, which are security controls. The agent modification restriction note helps prevent unauthorized configuration changes. The 'NONE' AuthenticationType expansion could have security implications but is mitigated by secret configuration requirements.

Diff

diff --git a/datasync/latest/userguide/API_UpdateLocationAzureBlob.md b/datasync/latest/userguide/API_UpdateLocationAzureBlob.md
index fd696fbbf..547d23184 100644
--- a//datasync/latest/userguide/API_UpdateLocationAzureBlob.md
+++ b//datasync/latest/userguide/API_UpdateLocationAzureBlob.md
@@ -20,0 +21,8 @@ For more information, see [Configuring DataSync transfers with Azure Blob Storag
+       "CmkSecretConfig": { 
+          "[KmsKeyArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-KmsKeyArn)": "string",
+          "[SecretArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-SecretArn)": "string"
+       },
+       "CustomSecretConfig": { 
+          "[SecretAccessRoleArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretAccessRoleArn)": "string",
+          "[SecretArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretArn)": "string"
+       },
@@ -48 +56 @@ Required: No
-Specifies the Amazon Resource Name (ARN) of the DataSync agent that can connect with your Azure Blob Storage container.
+(Optional) Specifies the Amazon Resource Name (ARN) of the DataSync agent that can connect with your Azure Blob Storage container. If you are setting up an agentless cross-cloud transfer, you do not need to specify a value for this parameter.
@@ -51,0 +60,4 @@ You can specify more than one agent. For more information, see [Using multiple a
+###### Note
+
+You cannot add or remove agents from a storage location after you initially create it.
+
@@ -69 +81 @@ Type: String
-Valid Values: `SAS`
+Valid Values: `SAS | NONE`
@@ -83,0 +96,18 @@ Required: No
+**CmkSecretConfig **
+    
+
+Specifies configuration information for a DataSync-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed AWS KMS key.
+
+Type: [CmkSecretConfig](./API_CmkSecretConfig.html) object
+
+Required: No
+
+**CustomSecretConfig **
+    
+
+Specifies configuration information for a customer-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed AWS KMS key.
+
+Type: [CustomSecretConfig](./API_CustomSecretConfig.html) object
+
+Required: No
+