AWS Security ChangesHomeSearch

AWS cli medium security documentation change

Service: cli · 2025-10-16 · Security-related medium

File: cli/latest/reference/transfer/describe-connector.md

Summary

Added documentation about required URL formats for AS2/VPC_LATTICE connectors, clarified trusted host key formats for VPC_LATTICE connectors, and expanded egress configuration details including VPC Lattice settings.

Security assessment

The change explicitly addresses secure host key validation by specifying that VPC_LATTICE connectors must use key-type key-body format without hostnames to prevent potential MITM attacks. This directly impacts authentication security by enforcing proper key formats.

Diff

diff --git a/cli/latest/reference/transfer/describe-connector.md b/cli/latest/reference/transfer/describe-connector.md
index c9d089bae..4ef3d7d1d 100644
--- a//cli/latest/reference/transfer/describe-connector.md
+++ b//cli/latest/reference/transfer/describe-connector.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »
@@ -234,0 +235,2 @@ Connector -> (structure)
+>> When creating AS2 connectors or service-managed SFTP connectors (connectors without egress configuration), you must provide a URL to specify the remote server endpoint. For VPC Lattice type connectors, the URL must be null.
+>> 
@@ -504,0 +507,2 @@ Connector -> (structure)
+>>> When creating connectors with egress config (VPC_LATTICE type connectors), since host name is not something we can verify, the only accepted trusted host key format is `key-type key-body` without the host name. For example: `ssh-rsa AAAAB3Nza...<long-string-for-public-key>`
+>>> 
@@ -520 +524 @@ Connector -> (structure)
->>>> `ftp.host.com ssh-rsa AAAAB3Nza...<long-string-for-public-key`
+>>>> `ftp.host.com ssh-rsa AAAAB3Nza...<long-string-for-public-key>`
@@ -523,0 +528,2 @@ Connector -> (structure)
+>>> For VPC Lattice type connectors (VPC_LATTICE), remove the hostname from the key and use only the `key-type key-body` format. In this example, it should be: `ssh-rsa AAAAB3Nza...<long-string-for-public-key>`
+>>> 
@@ -578,0 +585,64 @@ Connector -> (structure)
+> 
+> EgressConfig -> (tagged union structure)
+>
+>> Current egress configuration of the connector, showing how traffic is routed to the SFTP server. Contains VPC Lattice settings when using VPC_LATTICE egress type.
+>> 
+>> When using the VPC_LATTICE egress type, Transfer Family uses a managed Service Network to simplify the resource sharing process.
+>> 
+>> ### Note
+>> 
+>> This is a Tagged Union structure. Only one of the following top level keys can be set: `VpcLattice`.
+>> 
+>> VpcLattice -> (structure)
+>>
+>>> VPC_LATTICE configuration details in the response, showing the current Resource Configuration ARN and port settings for VPC-based connectivity.
+>>> 
+>>> ResourceConfigurationArn -> (string) [required]
+>>>
+>>>> ARN of the VPC_LATTICE Resource Configuration currently used by the connector. This Resource Configuration defines the network path to the SFTP server through the customer’s VPC.
+>>>> 
+>>>> Constraints:
+>>>> 
+>>>>   * min: `1`
+>>>>   * max: `2048`
+>>>>   * pattern: `arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:resourceconfiguration/rcfg-[0-9a-z]{17}`
+>>>> 
+
+>>> 
+>>> PortNumber -> (integer)
+>>>
+>>>> Port number currently configured for SFTP connections through VPC_LATTICE. Shows the port on which the connector attempts to connect to the target SFTP server.
+>>>> 
+>>>> Constraints:
+>>>> 
+>>>>   * min: `1`
+>>>>   * max: `65535`
+>>>> 
+
+> 
+> EgressType -> (string) [required]
+>
+>> Type of egress configuration for the connector. SERVICE_MANAGED uses Transfer Family managed NAT gateways, while VPC_LATTICE routes traffic through customer VPCs using VPC Lattice.
+>> 
+>> Possible values:
+>> 
+>>   * `SERVICE_MANAGED`
+>>   * `VPC_LATTICE`
+>> 
+
+> 
+> ErrorMessage -> (string)
+>
+>> Error message providing details when the connector is in ERRORED status. Contains information to help troubleshoot connector creation or operation failures.
+> 
+> Status -> (string) [required]
+>
+>> Current status of the connector. PENDING indicates creation/update in progress, ACTIVE means ready for operations, and ERRORED indicates a failure requiring attention.
+>> 
+>> Possible values:
+>> 
+>>   * `ACTIVE`
+>>   * `ERRORED`
+>>   * `PENDING`
+>> 
+
@@ -590 +660 @@ Connector -> (structure)
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »