AWS cli medium security documentation change

Service: cli · 2025-10-01 · Security-related medium

File: cli/latest/reference/transfer/create-server.md

Summary

Added clarification about SecurityGroupIds response behavior and S3 directory optimization defaults

Security assessment

The SecurityGroupIds clarification prevents misconfiguration by explicitly stating security groups must be managed through VPC endpoints. This addresses potential security risks from assuming security groups are managed through the Transfer Family API.

Diff

diff --git a/cli/latest/reference/transfer/create-server.md b/cli/latest/reference/transfer/create-server.md
index 120ae276f..11eefedce 100644
--- a//cli/latest/reference/transfer/create-server.md
+++ b//cli/latest/reference/transfer/create-server.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.3 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.5 Command Reference](../../index.html) »
@@ -224,0 +225,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf
+>> While `SecurityGroupIds` appears in the response syntax for consistency with `CreateServer` and `UpdateServer` operations, this field is not populated in `DescribeServer` responses. Security groups are managed at the VPC endpoint level and can be modified outside of the Transfer Family service. To retrieve current security group information, use the EC2 `DescribeVpcEndpoints` API with the `VpcEndpointId` returned in the response.
+>> 
@@ -853 +855,6 @@ Syntax:
-> Specifies whether or not performance for your Amazon S3 directories is optimized. This is disabled by default.
+> Specifies whether or not performance for your Amazon S3 directories is optimized.
+> 
+>   * If using the console, this is enabled by default.
+>   * If using the API or CLI, this is disabled by default.
+> 
+
@@ -859 +866,6 @@ Syntax:
->> Specifies whether or not performance for your Amazon S3 directories is optimized. This is disabled by default.
+>> Specifies whether or not performance for your Amazon S3 directories is optimized.
+>> 
+>>   * If using the console, this is enabled by default.
+>>   * If using the API or CLI, this is disabled by default.
+>> 
+
@@ -1029 +1041 @@ ServerId -> (string)
-  * [AWS CLI 2.31.3 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.5 Command Reference](../../index.html) »