AWS cli medium security documentation change

Service: cli · 2025-06-28 · Security-related medium

File: cli/latest/reference/keyspaces/update-table.md

Summary

Added documentation for CDC stream specifications including status, view types, tags, and propagateTags parameters

Security assessment

The change introduces documentation for CDC stream view types that control what data is recorded (NEW_IMAGE/OLD_IMAGE/KEYS_ONLY), which impacts data exposure in change streams. The tags section explicitly mentions security considerations about AWS-assigned tags and access control through Cost Allocation Reports. While not fixing a vulnerability, these controls help manage sensitive data exposure through streams.

Diff

diff --git a/cli/latest/reference/keyspaces/update-table.md b/cli/latest/reference/keyspaces/update-table.md
index 75238e2be..f87ecf9db 100644
--- a//cli/latest/reference/keyspaces/update-table.md
+++ b//cli/latest/reference/keyspaces/update-table.md
@@ -13 +13 @@
-  * [next](../kinesis/index.html "kinesis") |
+  * [next](../keyspacesstreams/index.html "keyspacesstreams") |
@@ -15 +15 @@
-  * [AWS CLI 2.27.42 Command Reference](../../index.html) »
+  * [AWS CLI 2.27.45 Command Reference](../../index.html) »
@@ -23 +23 @@
-  * [kinesis →](../kinesis/index.html "next chapter \(use the right arrow\)")
+  * [keyspacesstreams →](../keyspacesstreams/index.html "next chapter \(use the right arrow\)")
@@ -77,0 +78 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/keyspa
+    [--cdc-specification <value>]
@@ -578,0 +580,68 @@ JSON Syntax:
+`--cdc-specification` (structure)
+
+> The CDC stream settings of the table.
+> 
+> status -> (string)
+>
+>> The status of the CDC stream. You can enable or disable a stream for a table.
+> 
+> viewType -> (string)
+>
+>> The view type specifies the changes Amazon Keyspaces records for each changed row in the stream. After you create the stream, you can’t make changes to this selection.
+>> 
+>> The options are:
+>> 
+>>   * `NEW_AND_OLD_IMAGES` \- both versions of the row, before and after the change. This is the default.
+>>   * `NEW_IMAGE` \- the version of the row after the change.
+>>   * `OLD_IMAGE` \- the version of the row before the change.
+>>   * `KEYS_ONLY` \- the partition and clustering keys of the row that was changed.
+>> 
+
+> 
+> tags -> (list)
+>
+>> The tags (key-value pairs) that you want to apply to the stream.
+>> 
+>> (structure)
+>>
+>>> Describes a tag. A tag is a key-value pair. You can add up to 50 tags to a single Amazon Keyspaces resource.
+>>> 
+>>> Amazon Web Services-assigned tag names and values are automatically assigned the `aws:` prefix, which the user cannot assign. Amazon Web Services-assigned tag names do not count towards the tag limit of 50. User-assigned tag names have the prefix `user:` in the Cost Allocation Report. You cannot backdate the application of a tag.
+>>> 
+>>> For more information, see [Adding tags and labels to Amazon Keyspaces resources](https://docs.aws.amazon.com/keyspaces/latest/devguide/tagging-keyspaces.html) in the _Amazon Keyspaces Developer Guide_ .
+>>> 
+>>> key -> (string)
+>>>
+>>>> The key of the tag. Tag keys are case sensitive. Each Amazon Keyspaces resource can only have up to one tag with the same key. If you try to add an existing tag (same key), the existing tag value will be updated to the new value.
+>>> 
+>>> value -> (string)
+>>>
+>>>> The value of the tag. Tag values are case-sensitive and can be null.
+> 
+> propagateTags -> (string)
+>
+>> Specifies that the stream inherits the tags from the table.
+
+Shorthand Syntax:
+    
+    
+    status=string,viewType=string,tags=[{key=string,value=string},{key=string,value=string}],propagateTags=string
+    
+
+JSON Syntax:
+    
+    
+    {
+      "status": "ENABLED"|"ENABLING"|"DISABLED"|"DISABLING",
+      "viewType": "NEW_IMAGE"|"OLD_IMAGE"|"KEYS_ONLY"|"NEW_AND_OLD_IMAGES",
+      "tags": [
+        {
+          "key": "string",
+          "value": "string"
+        }
+        ...
+      ],
+      "propagateTags": "TABLE"|"NONE"
+    }
+    
+
@@ -683 +752 @@ resourceArn -> (string)
-  * [kinesis →](../kinesis/index.html "next chapter \(use the right arrow\)")
+  * [keyspacesstreams →](../keyspacesstreams/index.html "next chapter \(use the right arrow\)")
@@ -690 +759 @@ resourceArn -> (string)
-  * [next](../kinesis/index.html "kinesis") |
+  * [next](../keyspacesstreams/index.html "keyspacesstreams") |
@@ -692 +761 @@ resourceArn -> (string)
-  * [AWS CLI 2.27.42 Command Reference](../../index.html) »
+  * [AWS CLI 2.27.45 Command Reference](../../index.html) »