AWS cli documentation change
Summary
Added documentation for recovery point lifecycle management, vault type/lock state details, encryption status fields, and backup plan/rule metadata
Security assessment
The changes add documentation about encryption status (IsEncrypted), KMS key usage (EncryptionKeyArn), logically air-gapped vault security (VaultType/VaultLockState), and retention policies. While these relate to security features like encryption and access controls, there is no evidence this addresses a specific vulnerability. The updates improve transparency about existing security mechanisms.
Diff
diff --git a/cli/latest/reference/backup/describe-backup-job.md b/cli/latest/reference/backup/describe-backup-job.md index f5a373e96..60d304d72 100644 --- a//cli/latest/reference/backup/describe-backup-job.md +++ b//cli/latest/reference/backup/describe-backup-job.md @@ -15 +15 @@ - * [AWS CLI 2.31.13 Command Reference](../../index.html) » + * [AWS CLI 2.31.16 Command Reference](../../index.html) » @@ -218,0 +219,22 @@ BackupVaultName -> (string) +RecoveryPointLifecycle -> (structure) + +> Specifies the time period, in days, before a recovery point transitions to cold storage or is deleted. +> +> Backups transitioned to cold storage must be stored in cold storage for a minimum of 90 days. Therefore, on the console, the retention setting must be 90 days greater than the transition to cold after days setting. The transition to cold after days setting can’t be changed after a backup has been transitioned to cold. +> +> Resource types that can transition to cold storage are listed in the [Feature availability by resource](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-feature-availability.html#features-by-resource) table. Backup ignores this expression for other resource types. +> +> To remove the existing lifecycle and retention periods and keep your recovery points indefinitely, specify -1 for `MoveToColdStorageAfterDays` and `DeleteAfterDays` . +> +> MoveToColdStorageAfterDays -> (long) +> +>> The number of days after creation that a recovery point is moved to cold storage. +> +> DeleteAfterDays -> (long) +> +>> The number of days after creation that a recovery point is deleted. This value must be at least 90 days after the number of days specified in `MoveToColdStorageAfterDays` . +> +> OptInToArchiveForSupportedResources -> (boolean) +> +>> If the value is true, your backup plan transitions supported resources to archive (cold) storage tier in accordance with your lifecycle settings. + @@ -222,0 +245,8 @@ BackupVaultArn -> (string) +VaultType -> (string) + +> The type of backup vault where the recovery point is stored. Valid values are `BACKUP_VAULT` for standard backup vaults and `LOGICALLY_AIR_GAPPED_BACKUP_VAULT` for logically air-gapped vaults. + +VaultLockState -> (string) + +> The lock state of the backup vault. For logically air-gapped vaults, this indicates whether the vault is locked in compliance mode. Valid values include `LOCKED` and `UNLOCKED` . + @@ -226,0 +257,8 @@ RecoveryPointArn -> (string) +EncryptionKeyArn -> (string) + +> The Amazon Resource Name (ARN) of the KMS key used to encrypt the backup. This can be a customer-managed key or an Amazon Web Services managed key, depending on the vault configuration. + +IsEncrypted -> (boolean) + +> A boolean value indicating whether the backup is encrypted. All backups in Backup are encrypted, but this field indicates the encryption status for transparency. + @@ -298,0 +337,4 @@ CreatedBy -> (structure) +> BackupPlanName -> (string) +> +>> The name of the backup plan that created this recovery point. This provides human-readable context about which backup plan was responsible for the backup job. +> @@ -305,0 +348,12 @@ CreatedBy -> (structure) +> +> BackupRuleName -> (string) +> +>> The name of the backup rule within the backup plan that created this recovery point. This helps identify which specific rule triggered the backup job. +> +> BackupRuleCron -> (string) +> +>> The cron expression that defines the schedule for the backup rule. This shows the frequency and timing of when backups are automatically triggered. +> +> BackupRuleTimezone -> (string) +> +>> The timezone used for the backup rule schedule. This provides context for when backups are scheduled to run in the specified timezone. @@ -411 +465 @@ MessageCategory -> (string) - * [AWS CLI 2.31.13 Command Reference](../../index.html) » + * [AWS CLI 2.31.16 Command Reference](../../index.html) »