AWS cli medium security documentation change

Service: cli · 2025-10-16 · Security-related medium

File: cli/latest/reference/transfer/update-connector.md

Summary

Added egress configuration options for VPC_LATTICE connectors and updated trusted host key format requirements

Security assessment

The change enforces proper SSH key formatting for VPC_LATTICE connectors by removing hostnames from trusted host keys, reducing risk of man-in-middle attacks. Explicit guidance about key verification in network configurations addresses authentication security.

Diff

diff --git a/cli/latest/reference/transfer/update-connector.md b/cli/latest/reference/transfer/update-connector.md
index 4edb16c44..2f466bc90 100644
--- a//cli/latest/reference/transfer/update-connector.md
+++ b//cli/latest/reference/transfer/update-connector.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »
@@ -73,0 +74 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf
+    [--egress-config <value>]
@@ -113,0 +115,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf
+> When creating AS2 connectors or service-managed SFTP connectors (connectors without egress configuration), you must provide a URL to specify the remote server endpoint. For VPC Lattice type connectors, the URL must be null.
+> 
@@ -369,0 +373,2 @@ JSON Syntax:
+>> When creating connectors with egress config (VPC_LATTICE type connectors), since host name is not something we can verify, the only accepted trusted host key format is `key-type key-body` without the host name. For example: `ssh-rsa AAAAB3Nza...<long-string-for-public-key>`
+>> 
@@ -385 +390 @@ JSON Syntax:
->>> `ftp.host.com ssh-rsa AAAAB3Nza...<long-string-for-public-key`
+>>> `ftp.host.com ssh-rsa AAAAB3Nza...<long-string-for-public-key>`
@@ -388,0 +394,2 @@ JSON Syntax:
+>> For VPC Lattice type connectors (VPC_LATTICE), remove the hostname from the key and use only the `key-type key-body` format. In this example, it should be: `ssh-rsa AAAAB3Nza...<long-string-for-public-key>`
+>> 
@@ -448,0 +456,52 @@ JSON Syntax:
+`--egress-config` (tagged union structure)
+
+> Updates the egress configuration for the connector, allowing you to modify how traffic is routed from the connector to the SFTP server. Changes to VPC configuration may require connector restart.
+> 
+> ### Note
+> 
+> This is a Tagged Union structure. Only one of the following top level keys can be set: `VpcLattice`.
+> 
+> VpcLattice -> (structure)
+>
+>> VPC_LATTICE configuration updates for the connector. Use this to modify the Resource Configuration ARN or port number for VPC-based connectivity.
+>> 
+>> ResourceConfigurationArn -> (string)
+>>
+>>> Updated ARN of the VPC_LATTICE Resource Configuration. Use this to change the target SFTP server location or modify the network path through the customer’s VPC infrastructure.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `1`
+>>>   * max: `2048`
+>>>   * pattern: `arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:resourceconfiguration/rcfg-[0-9a-z]{17}`
+>>> 
+
+>> 
+>> PortNumber -> (integer)
+>>
+>>> Updated port number for SFTP connections through VPC_LATTICE. Change this if the target SFTP server port has been modified or if connecting to a different server endpoint.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `1`
+>>>   * max: `65535`
+>>> 
+
+
+Shorthand Syntax:
+    
+    
+    VpcLattice={ResourceConfigurationArn=string,PortNumber=integer}
+    
+
+JSON Syntax:
+    
+    
+    {
+      "VpcLattice": {
+        "ResourceConfigurationArn": "string",
+        "PortNumber": integer
+      }
+    }
+    
+
@@ -570 +629 @@ ConnectorId -> (string)
-  * [AWS CLI 2.31.13 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.16 Command Reference](../../index.html) »