AWS aws-backup documentation change

Service: aws-backup · 2025-10-16 · Documentation medium

File: aws-backup/latest/devguide/API_CopyJob.md

Summary

Added documentation for destination encryption (DestinationEncryptionKeyArn), lifecycle management, and vault lock state/type fields for copy operations

Security assessment

Documents security controls for cross-vault copy operations including encryption key management and compliance locking features, but shows no evidence of patching a specific security issue

Diff

diff --git a/aws-backup/latest/devguide/API_CopyJob.md b/aws-backup/latest/devguide/API_CopyJob.md
index 4af8d21c1..de316d320 100644
--- a//aws-backup/latest/devguide/API_CopyJob.md
+++ b//aws-backup/latest/devguide/API_CopyJob.md
@@ -97,0 +98,9 @@ Required: No
+**DestinationEncryptionKeyArn**
+    
+
+The Amazon Resource Name (ARN) of the KMS key used to encrypt the copied backup in the destination vault. This can be a customer-managed key or an AWS managed key.
+
+Type: String
+
+Required: No
+
@@ -106,0 +116,33 @@ Required: No
+**DestinationRecoveryPointLifecycle**
+    
+
+Specifies the time period, in days, before a recovery point transitions to cold storage or is deleted.
+
+Backups transitioned to cold storage must be stored in cold storage for a minimum of 90 days. Therefore, on the console, the retention setting must be 90 days greater than the transition to cold after days setting. The transition to cold after days setting can't be changed after a backup has been transitioned to cold.
+
+Resource types that can transition to cold storage are listed in the [Feature availability by resource](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-feature-availability.html#features-by-resource) table. AWS Backup ignores this expression for other resource types.
+
+To remove the existing lifecycle and retention periods and keep your recovery points indefinitely, specify -1 for `MoveToColdStorageAfterDays` and `DeleteAfterDays`.
+
+Type: [Lifecycle](./API_Lifecycle.html) object
+
+Required: No
+
+**DestinationVaultLockState**
+    
+
+The lock state of the destination backup vault. For logically air-gapped vaults, this indicates whether the vault is locked in compliance mode. Valid values include `LOCKED` and `UNLOCKED`.
+
+Type: String
+
+Required: No
+
+**DestinationVaultType**
+    
+
+The type of destination backup vault where the copied recovery point is stored. Valid values are `BACKUP_VAULT` for standard backup vaults and `LOGICALLY_AIR_GAPPED_BACKUP_VAULT` for logically air-gapped vaults.
+
+Type: String
+
+Required: No
+