AWS cli documentation change
Summary
Added DomainJoinServiceAccountSecret parameter for storing Active Directory credentials in Secrets Manager and removed [required] flag from UserName/Password fields
Security assessment
The change introduces documentation for using Secrets Manager to securely store domain join credentials rather than passing them directly in configuration. While this improves security practices, there's no evidence of addressing an existing vulnerability. The ARN pattern constraints and secret management guidance demonstrate security feature documentation.
Diff
diff --git a/cli/latest/reference/fsx/create-file-system-from-backup.md b/cli/latest/reference/fsx/create-file-system-from-backup.md index 648615981..46036c714 100644 --- a//cli/latest/reference/fsx/create-file-system-from-backup.md +++ b//cli/latest/reference/fsx/create-file-system-from-backup.md @@ -15 +15 @@ - * [AWS CLI 2.31.28 Command Reference](../../index.html) » + * [AWS CLI 2.31.31 Command Reference](../../index.html) » @@ -318 +318 @@ JSON Syntax: ->> UserName -> (string) [required] +>> UserName -> (string) @@ -330 +330 @@ JSON Syntax: ->> Password -> (string) [required] +>> Password -> (string) @@ -361,0 +362,21 @@ JSON Syntax: +>> +>> DomainJoinServiceAccountSecret -> (string) +>> +>>> The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret containing the self-managed Active Directory domain join service account credentials. When provided, Amazon FSx uses the credentials stored in this secret to join the file system to your self-managed Active Directory domain. +>>> +>>> The secret must contain two key-value pairs: +>>> +>>> * `CUSTOMER_MANAGED_ACTIVE_DIRECTORY_USERNAME` \- The username for the service account +>>> * `CUSTOMER_MANAGED_ACTIVE_DIRECTORY_PASSWORD` \- The password for the service account +>>> + +>>> +>>> For more information, see [Using Amazon FSx for Windows with your self-managed Microsoft Active Directory](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-manage-prereqs.html) or [Using Amazon FSx for ONTAP with your self-managed Microsoft Active Directory](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-manage-prereqs.html) . +>>> +>>> Constraints: +>>> +>>> * min: `64` +>>> * max: `1024` +>>> * pattern: `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` +>>> + @@ -575 +596 @@ Shorthand Syntax: - ActiveDirectoryId=string,SelfManagedActiveDirectoryConfiguration={DomainName=string,OrganizationalUnitDistinguishedName=string,FileSystemAdministratorsGroup=string,UserName=string,Password=string,DnsIps=[string,string]},DeploymentType=string,PreferredSubnetId=string,ThroughputCapacity=integer,WeeklyMaintenanceStartTime=string,DailyAutomaticBackupStartTime=string,AutomaticBackupRetentionDays=integer,CopyTagsToBackups=boolean,Aliases=string,string,AuditLogConfiguration={FileAccessAuditLogLevel=string,FileShareAccessAuditLogLevel=string,AuditLogDestination=string},DiskIopsConfiguration={Mode=string,Iops=long} + ActiveDirectoryId=string,SelfManagedActiveDirectoryConfiguration={DomainName=string,OrganizationalUnitDistinguishedName=string,FileSystemAdministratorsGroup=string,UserName=string,Password=string,DnsIps=[string,string],DomainJoinServiceAccountSecret=string},DeploymentType=string,PreferredSubnetId=string,ThroughputCapacity=integer,WeeklyMaintenanceStartTime=string,DailyAutomaticBackupStartTime=string,AutomaticBackupRetentionDays=integer,CopyTagsToBackups=boolean,Aliases=string,string,AuditLogConfiguration={FileAccessAuditLogLevel=string,FileShareAccessAuditLogLevel=string,AuditLogDestination=string},DiskIopsConfiguration={Mode=string,Iops=long} @@ -589 +610,2 @@ JSON Syntax: - "DnsIps": ["string", ...] + "DnsIps": ["string", ...], + "DomainJoinServiceAccountSecret": "string" @@ -1994,0 +2017,12 @@ FileSystem -> (structure) +>>> +>>> DomainJoinServiceAccountSecret -> (string) +>>> +>>>> The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret containing the service account credentials used to join the file system to your self-managed Active Directory domain. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `64` +>>>> * max: `1024` +>>>> * pattern: `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` +>>>> + @@ -3139,0 +3174,12 @@ FileSystem -> (structure) +>>>>>> +>>>>>> DomainJoinServiceAccountSecret -> (string) +>>>>>> +>>>>>>> The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret containing the service account credentials used to join the file system to your self-managed Active Directory domain. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `64` +>>>>>>> * max: `1024` +>>>>>>> * pattern: `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` +>>>>>>> + @@ -6658,0 +6705,12 @@ FileSystem -> (structure) +>>>>>>>>> +>>>>>>>>> DomainJoinServiceAccountSecret -> (string) +>>>>>>>>> +>>>>>>>>>> The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret containing the service account credentials used to join the file system to your self-managed Active Directory domain. +>>>>>>>>>> +>>>>>>>>>> Constraints: +>>>>>>>>>> +>>>>>>>>>> * min: `64` +>>>>>>>>>> * max: `1024` +>>>>>>>>>> * pattern: `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` +>>>>>>>>>> + @@ -9903,0 +9962,12 @@ FileSystem -> (structure) +>>>>>>>>> +>>>>>>>>> DomainJoinServiceAccountSecret -> (string) +>>>>>>>>> +>>>>>>>>>> The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret containing the service account credentials used to join the file system to your self-managed Active Directory domain. +>>>>>>>>>> +>>>>>>>>>> Constraints: +>>>>>>>>>> +>>>>>>>>>> * min: `64` +>>>>>>>>>> * max: `1024` +>>>>>>>>>> * pattern: `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` +>>>>>>>>>> + @@ -12894 +12964 @@ FileSystem -> (structure) - * [AWS CLI 2.31.28 Command Reference](../../index.html) » + * [AWS CLI 2.31.31 Command Reference](../../index.html) »