AWS AWSCloudFormation documentation change
Summary
Updated DSQL Cluster documentation to clarify multi-Region configuration, add status values for multi-Region operations, remove import restriction warnings, and reorganize content.
Security assessment
The changes primarily restructure documentation and clarify multi-Region cluster behavior. The added Important note about witness Region restrictions prevents misconfiguration but does not address a specific security vulnerability. While IAM permissions for multi-Region clusters are mentioned, this is a pre-existing security consideration, not a new security feature or fix.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-dsql-cluster.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-dsql-cluster.md index f9a670714..e6a929734 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-dsql-cluster.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-dsql-cluster.md @@ -3 +3 @@ -SyntaxPropertiesReturn valuesRemarksSee also +SyntaxPropertiesReturn valuesSee also @@ -9 +9,3 @@ This is the new _AWS CloudFormation Template Reference Guide_. Please update you -The CreateCluster API allows you to create both single-Region clusters and multi-Region clusters. With the addition of the _multiRegionProperties_ parameter, you can create a cluster with witness Region support and establish peer relationships with clusters in other Regions during creation. +The `AWS::DSQL::Cluster` resource specifies an cluster. You can use this resource to create, modify, and manage clusters. + +This resource supports both single-Region clusters and multi-Region clusters through the `MultiRegionProperties` parameter. @@ -13 +15,8 @@ The CreateCluster API allows you to create both single-Region clusters and multi -Creating multi-Region clusters requires additional IAM permissions beyond those needed for single-Region clusters, as detailed in the **Required permissions** section below. +Creating multi-Region clusters requires additional IAM permissions beyond those needed for single-Region clusters. + +###### Important + + * The witness Region specified in `multiRegionProperties.witnessRegion` cannot be the same as the cluster's Region. + + + @@ -61,7 +69,0 @@ Condition Keys: `dsql:WitnessRegion` (matching the specified witness region) -###### Important - - * The witness Region specified in `multiRegionProperties.witnessRegion` cannot be the same as the cluster's Region. - - - - @@ -113 +115 @@ _Required_ : No -The multi-Region cluster configuration details that were set during cluster creation +Defines the structure for multi-Region cluster configurations, containing the witness Region and peered cluster settings. @@ -168 +170 @@ The current status of the cluster. Possible values include: CREATING, ACTIVE, DE -`VpcEndpointServiceName` +The cluster can have two additional status values when working with multi-Region clusters: @@ -169,0 +172 @@ The current status of the cluster. Possible values include: CREATING, ACTIVE, DE +`PENDING_SETUP`—Indicates the cluster is being configured @@ -171 +174 @@ The current status of the cluster. Possible values include: CREATING, ACTIVE, DE -The VPC Endpoint Service name for the cluster. This can be used to create a VPC endpoint to connect to the cluster from within a VPC. +`PENDING_DELETE`—Indicates the cluster is being deleted @@ -173 +176 @@ The VPC Endpoint Service name for the cluster. This can be used to create a VPC -## Remarks +**Note:** These status values only appear for multi-Region cluster operations. @@ -175 +178 @@ The VPC Endpoint Service name for the cluster. This can be used to create a VPC -The `AWS::DSQL::Cluster` resource only creates single-Region clusters. It’s equivalent to calling [CreateClusters](https://docs.aws.amazon.com/aurora-dsql/latest/APIReference/API_CreateCluster.html) not [CreateMultiRegionClusters](https://docs.aws.amazon.com/aurora-dsql/latest/APIReference/API_CreateMultiRegionClusters.html). +`VpcEndpointServiceName` @@ -177 +179,0 @@ The `AWS::DSQL::Cluster` resource only creates single-Region clusters. It’s eq -**Multi-Region cluster imports are not supported.** @@ -179 +181 @@ The `AWS::DSQL::Cluster` resource only creates single-Region clusters. It’s eq -If you attempt to import an existing multi-Region cluster into your stack of resources as an `AWS::DSQL::Cluster`, the changeset to import will fail. +The VPC Endpoint Service name for the cluster. This can be used to create a VPC endpoint to connect to the cluster from within a VPC. @@ -181 +183 @@ If you attempt to import an existing multi-Region cluster into your stack of res -You will return a message similar to the following `Operations on multi-region cluster muabt5rq24otlvno3gqyqpcm7m are not supported`, where `muabt5rq24otlvno3gqyqpcm7m` is the multi-Region cluster that failed to import. +## See also @@ -183 +185 @@ You will return a message similar to the following `Operations on multi-region c -**Single-Region cluster imports are supported.** +See [ API reference](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/CHAP_api_reference.html) for a full list of API operations to manage your resources in Aurora DSQL. @@ -185 +187 @@ You will return a message similar to the following `Operations on multi-region c -## See also +See [MultiRegionProperties](https://docs.aws.amazon.com/aurora-dsql/latest/APIReference/API_MultiRegionProperties.html) for the data structure used for multi-Region clusters. @@ -187 +189 @@ You will return a message similar to the following `Operations on multi-region c -See [Aurora DSQL API reference](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/CHAP_api_reference.html) for a full list of API operations to manage your resources in Aurora DSQL. +See [Configuring multi-Region clusters using CloudFormation](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/mr-cluster-setup.html) to create multi-Region clusters using this CloudFormation resource.