AWS cli medium security documentation change
Summary
Added documentation about required URL formats for AS2/VPC_LATTICE connectors, clarified trusted host key formats for VPC_LATTICE connectors, and expanded egress configuration details including VPC Lattice settings.
Security assessment
The change explicitly addresses secure host key validation by specifying that VPC_LATTICE connectors must use key-type key-body format without hostnames to prevent potential MITM attacks. This directly impacts authentication security by enforcing proper key formats.
Diff
diff --git a/cli/latest/reference/transfer/describe-connector.md b/cli/latest/reference/transfer/describe-connector.md index c9d089bae..4ef3d7d1d 100644 --- a//cli/latest/reference/transfer/describe-connector.md +++ b//cli/latest/reference/transfer/describe-connector.md @@ -15 +15 @@ - * [AWS CLI 2.31.13 Command Reference](../../index.html) » + * [AWS CLI 2.31.16 Command Reference](../../index.html) » @@ -234,0 +235,2 @@ Connector -> (structure) +>> When creating AS2 connectors or service-managed SFTP connectors (connectors without egress configuration), you must provide a URL to specify the remote server endpoint. For VPC Lattice type connectors, the URL must be null. +>> @@ -504,0 +507,2 @@ Connector -> (structure) +>>> When creating connectors with egress config (VPC_LATTICE type connectors), since host name is not something we can verify, the only accepted trusted host key format is `key-type key-body` without the host name. For example: `ssh-rsa AAAAB3Nza...<long-string-for-public-key>` +>>> @@ -520 +524 @@ Connector -> (structure) ->>>> `ftp.host.com ssh-rsa AAAAB3Nza...<long-string-for-public-key` +>>>> `ftp.host.com ssh-rsa AAAAB3Nza...<long-string-for-public-key>` @@ -523,0 +528,2 @@ Connector -> (structure) +>>> For VPC Lattice type connectors (VPC_LATTICE), remove the hostname from the key and use only the `key-type key-body` format. In this example, it should be: `ssh-rsa AAAAB3Nza...<long-string-for-public-key>` +>>> @@ -578,0 +585,64 @@ Connector -> (structure) +> +> EgressConfig -> (tagged union structure) +> +>> Current egress configuration of the connector, showing how traffic is routed to the SFTP server. Contains VPC Lattice settings when using VPC_LATTICE egress type. +>> +>> When using the VPC_LATTICE egress type, Transfer Family uses a managed Service Network to simplify the resource sharing process. +>> +>> ### Note +>> +>> This is a Tagged Union structure. Only one of the following top level keys can be set: `VpcLattice`. +>> +>> VpcLattice -> (structure) +>> +>>> VPC_LATTICE configuration details in the response, showing the current Resource Configuration ARN and port settings for VPC-based connectivity. +>>> +>>> ResourceConfigurationArn -> (string) [required] +>>> +>>>> ARN of the VPC_LATTICE Resource Configuration currently used by the connector. This Resource Configuration defines the network path to the SFTP server through the customer’s VPC. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `2048` +>>>> * pattern: `arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:resourceconfiguration/rcfg-[0-9a-z]{17}` +>>>> + +>>> +>>> PortNumber -> (integer) +>>> +>>>> Port number currently configured for SFTP connections through VPC_LATTICE. Shows the port on which the connector attempts to connect to the target SFTP server. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `65535` +>>>> + +> +> EgressType -> (string) [required] +> +>> Type of egress configuration for the connector. SERVICE_MANAGED uses Transfer Family managed NAT gateways, while VPC_LATTICE routes traffic through customer VPCs using VPC Lattice. +>> +>> Possible values: +>> +>> * `SERVICE_MANAGED` +>> * `VPC_LATTICE` +>> + +> +> ErrorMessage -> (string) +> +>> Error message providing details when the connector is in ERRORED status. Contains information to help troubleshoot connector creation or operation failures. +> +> Status -> (string) [required] +> +>> Current status of the connector. PENDING indicates creation/update in progress, ACTIVE means ready for operations, and ERRORED indicates a failure requiring attention. +>> +>> Possible values: +>> +>> * `ACTIVE` +>> * `ERRORED` +>> * `PENDING` +>> + @@ -590 +660 @@ Connector -> (structure) - * [AWS CLI 2.31.13 Command Reference](../../index.html) » + * [AWS CLI 2.31.16 Command Reference](../../index.html) »