AWS datasync high security documentation change

Service: datasync · 2025-05-31 · Security-related high

File: datasync/latest/userguide/API_UpdateLocationObjectStorage.md

Summary

Added CmkSecretConfig/CustomSecretConfig parameters, updated agent ARN description with agentless transfer note, added agent modification restriction, and clarified secret storage fallback to Secrets Manager

Security assessment

The secret configuration parameters and explicit mention of Secrets Manager integration demonstrate enhanced security controls for credential management. The agent modification restriction prevents post-creation tampering. The fallback to Secrets Manager ensures proper secret storage by default.

Diff

diff --git a/datasync/latest/userguide/API_UpdateLocationObjectStorage.md b/datasync/latest/userguide/API_UpdateLocationObjectStorage.md
index e1181d5e3..9a86caade 100644
--- a//datasync/latest/userguide/API_UpdateLocationObjectStorage.md
+++ b//datasync/latest/userguide/API_UpdateLocationObjectStorage.md
@@ -18,0 +19,8 @@ For more information, see [Configuring DataSync transfers with an object storage
+       "CmkSecretConfig": { 
+          "[KmsKeyArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-KmsKeyArn)": "string",
+          "[SecretArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-SecretArn)": "string"
+       },
+       "CustomSecretConfig": { 
+          "[SecretAccessRoleArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretAccessRoleArn)": "string",
+          "[SecretArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretArn)": "string"
+       },
@@ -50 +58,5 @@ Required: No
-Specifies the Amazon Resource Names (ARNs) of the DataSync agents that can connect with your object storage system.
+(Optional) Specifies the Amazon Resource Names (ARNs) of the DataSync agents that can connect with your object storage system. If you are setting up an agentless cross-cloud transfer, you do not need to specify a value for this parameter.
+
+###### Note
+
+You cannot add or remove agents from a storage location after you initially create it.
@@ -61,0 +74,18 @@ Required: No
+**CmkSecretConfig **
+    
+
+Specifies configuration information for a DataSync-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed AWS KMS key.
+
+Type: [CmkSecretConfig](./API_CmkSecretConfig.html) object
+
+Required: No
+
+**CustomSecretConfig **
+    
+
+Specifies configuration information for a customer-managed secret, such as an authentication token or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed AWS KMS key.
+
+Type: [CustomSecretConfig](./API_CustomSecretConfig.html) object
+
+Required: No
+
@@ -79,0 +110,4 @@ Specifies the secret key (for example, a password) if credentials are required t
+###### Note
+
+If you provide a secret using `SecretKey`, but do not provide secret configuration details using `CmkSecretConfig` or `CustomSecretConfig`, then DataSync stores the token using your AWS account's Secrets Manager secret.
+