AWS secretsmanager documentation change
Summary
Revised DataSync integration details to clarify credential management. Added distinction between service-managed secrets and custom secrets, including billing implications.
Security assessment
Clarifies credential storage practices and access patterns, which improves security documentation but does not address a specific vulnerability. The change emphasizes proper secret management best practices.
Diff
diff --git a/secretsmanager/latest/userguide/integrating_how-services-use-secrets_datasync.md b/secretsmanager/latest/userguide/integrating_how-services-use-secrets_datasync.md index 99191a253..da028fbf4 100644 --- a//secretsmanager/latest/userguide/integrating_how-services-use-secrets_datasync.md +++ b//secretsmanager/latest/userguide/integrating_how-services-use-secrets_datasync.md @@ -7 +7 @@ -AWS DataSync is an online data transfer service that simplifies, automates, and accelerates moving data between storage systems and services. DataSync Discovery helps you accelerate your migration to AWS. +AWS DataSync is an online data transfer service that simplifies, automates, and accelerates moving data between storage systems and services. @@ -9 +9 @@ AWS DataSync is an online data transfer service that simplifies, automates, and -To collect information about an on-premises storage system, DataSync Discovery uses the credentials for the storage system's management interface. DataSync stores those credentials in a Secrets Manager [managed secret](./service-linked-secrets.html) with the prefix `datasync`. You are charged for that secret. For more information, see [Adding your on-premises storage system to DataSync Discovery](https://docs.aws.amazon.com/datasync/latest/userguide/discovery-configure-storage.html) in the _AWS DataSync User Guide_. +Some of the storage systems supported by DataSync require credentials to read and write data. DataSync uses Secrets Manager to store or access storage credentials. You can configure DataSync to create secrets on your behalf or you can provide a custom secret. Service-managed secrets begin with the prefix `aws-datasync`. You are charged only for the use of secrets that you create outside of DataSync. See [Providing credentials for storage locations](https://docs.aws.amazon.com/datasync/latest/userguide/location-credentials.html) in the _AWS DataSync User Guide_.