AWS cli medium security documentation change

Service: cli · 2025-10-16 · Security-related medium

File: cli/latest/reference/transfer/create-connector.md

Summary

Added egress configuration support for VPC_LATTICE connectors and updated trusted host key requirements. Made --url optional when using egress config.

Security assessment

The change introduces security-related configuration requirements for VPC_LATTICE connectors, specifically enforcing proper host key formatting without hostnames to prevent potential man-in-the-middle attacks. The egress config enables private network routing which enhances security posture by avoiding public internet exposure.

Diff

diff --git a/cli/latest/reference/transfer/create-connector.md b/cli/latest/reference/transfer/create-connector.md
index 074e7f77a..58921f50f 100644
--- a//cli/latest/reference/transfer/create-connector.md
+++ b//cli/latest/reference/transfer/create-connector.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »
@@ -71 +71 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf
-    --url <value>
+    [--url <value>]
@@ -77,0 +78 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf
+    [--egress-config <value>]
@@ -102 +103 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf
-`--url` (string) [required]
+`--url` (string)
@@ -105,0 +107,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf
+> When creating AS2 connectors or service-managed SFTP connectors (connectors without egress configuration), you must provide a URL to specify the remote server endpoint. For VPC Lattice type connectors, the URL must be null.
+> 
@@ -416,0 +420,2 @@ JSON Syntax:
+>> When creating connectors with egress config (VPC_LATTICE type connectors), since host name is not something we can verify, the only accepted trusted host key format is `key-type key-body` without the host name. For example: `ssh-rsa AAAAB3Nza...<long-string-for-public-key>`
+>> 
@@ -432 +437 @@ JSON Syntax:
->>> `ftp.host.com ssh-rsa AAAAB3Nza...<long-string-for-public-key`
+>>> `ftp.host.com ssh-rsa AAAAB3Nza...<long-string-for-public-key>`
@@ -435,0 +441,2 @@ JSON Syntax:
+>> For VPC Lattice type connectors (VPC_LATTICE), remove the hostname from the key and use only the `key-type key-body` format. In this example, it should be: `ssh-rsa AAAAB3Nza...<long-string-for-public-key>`
+>> 
@@ -495,0 +503,52 @@ JSON Syntax:
+`--egress-config` (tagged union structure)
+
+> Specifies the egress configuration for the connector, which determines how traffic is routed from the connector to the SFTP server. When set to VPC, enables routing through customer VPCs using VPC_LATTICE for private connectivity.
+> 
+> ### Note
+> 
+> This is a Tagged Union structure. Only one of the following top level keys can be set: `VpcLattice`.
+> 
+> VpcLattice -> (structure)
+>
+>> VPC_LATTICE configuration for routing connector traffic through customer VPCs. Enables private connectivity to SFTP servers without requiring public internet access or complex network configurations.
+>> 
+>> ResourceConfigurationArn -> (string) [required]
+>>
+>>> ARN of the VPC_LATTICE Resource Configuration that defines the target SFTP server location. Must point to a valid Resource Configuration in the customer’s VPC with appropriate network connectivity to the SFTP server.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `1`
+>>>   * max: `2048`
+>>>   * pattern: `arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:resourceconfiguration/rcfg-[0-9a-z]{17}`
+>>> 
+
+>> 
+>> PortNumber -> (integer)
+>>
+>>> Port number for connecting to the SFTP server through VPC_LATTICE. Defaults to 22 if not specified. Must match the port on which the target SFTP server is listening.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `1`
+>>>   * max: `65535`
+>>> 
+
+
+Shorthand Syntax:
+    
+    
+    VpcLattice={ResourceConfigurationArn=string,PortNumber=integer}
+    
+
+JSON Syntax:
+    
+    
+    {
+      "VpcLattice": {
+        "ResourceConfigurationArn": "string",
+        "PortNumber": integer
+      }
+    }
+    
+
@@ -617 +676 @@ ConnectorId -> (string)
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »