AWS AWSCloudFormation documentation change
Summary
Added RootVolume and VolumeKmsKeyId properties with encryption configuration details
Security assessment
Documents encryption configuration options using KMS keys for EBS volumes, which is a security feature but does not address a specific vulnerability
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-sagemaker-cluster-clusterebsvolumeconfig.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-sagemaker-cluster-clusterebsvolumeconfig.md index 0e74fa7d6..ff919ee46 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-sagemaker-cluster-clusterebsvolumeconfig.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-sagemaker-cluster-clusterebsvolumeconfig.md @@ -18,0 +19,2 @@ To declare this entity in your AWS CloudFormation template, use the following sy + "RootVolume" : Boolean, + "VolumeKmsKeyId" : String, @@ -25,0 +28,2 @@ To declare this entity in your AWS CloudFormation template, use the following sy + RootVolume: Boolean + VolumeKmsKeyId: String @@ -30,0 +35,48 @@ To declare this entity in your AWS CloudFormation template, use the following sy +`RootVolume` + + +Specifies whether the configuration is for the cluster's root or secondary Amazon EBS volume. You can specify two `ClusterEbsVolumeConfig` fields to configure both the root and secondary volumes. Set the value to `True` if you'd like to provide your own customer managed AWS KMS key to encrypt the root volume. When `True`: + + * The configuration is applied to the root volume. + + * You can't specify the `VolumeSizeInGB` field. The size of the root volume is determined for you. + + * You must specify a KMS key ID for `VolumeKmsKeyId` to encrypt the root volume with your own KMS key instead of an AWS owned KMS key. + + + + +Otherwise, by default, the value is `False`, and the following applies: + + * The configuration is applied to the secondary volume, while the root volume is encrypted with an AWS owned key. + + * You must specify the `VolumeSizeInGB` field. + + * You can optionally specify the `VolumeKmsKeyId` to encrypt the secondary volume with your own KMS key instead of an AWS owned KMS key. + + + + +_Required_ : No + + _Type_ : Boolean + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + +`VolumeKmsKeyId` + + +The ID of a KMS key to encrypt the Amazon EBS volume. + +_Required_ : No + + _Type_ : String + + _Pattern_ : `^[a-zA-Z0-9:/_-]*$` + +_Minimum_ : `0` + + _Maximum_ : `2048` + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + @@ -52 +104 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -CapacitySizeConfig +ClusterAutoScalingConfig