AWS cli documentation change
Summary
Added DomainJoinServiceAccountSecret parameter for storing Active Directory credentials in Secrets Manager and removed [required] flag from UserName/Password fields
Security assessment
Similar to the companion file change, this update promotes secure credential storage via Secrets Manager integration but doesn't indicate remediation of a specific security flaw. The documentation now emphasizes proper secret management practices through AWS services.
Diff
diff --git a/cli/latest/reference/fsx/create-file-system.md b/cli/latest/reference/fsx/create-file-system.md index 327ee440b..244a46dfc 100644 --- a//cli/latest/reference/fsx/create-file-system.md +++ b//cli/latest/reference/fsx/create-file-system.md @@ -15 +15 @@ - * [AWS CLI 2.31.28 Command Reference](../../index.html) » + * [AWS CLI 2.31.31 Command Reference](../../index.html) » @@ -400 +400 @@ JSON Syntax: ->> UserName -> (string) [required] +>> UserName -> (string) @@ -412 +412 @@ JSON Syntax: ->> Password -> (string) [required] +>> Password -> (string) @@ -443,0 +444,21 @@ JSON Syntax: +>> +>> DomainJoinServiceAccountSecret -> (string) +>> +>>> The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret containing the self-managed Active Directory domain join service account credentials. When provided, Amazon FSx uses the credentials stored in this secret to join the file system to your self-managed Active Directory domain. +>>> +>>> The secret must contain two key-value pairs: +>>> +>>> * `CUSTOMER_MANAGED_ACTIVE_DIRECTORY_USERNAME` \- The username for the service account +>>> * `CUSTOMER_MANAGED_ACTIVE_DIRECTORY_PASSWORD` \- The password for the service account +>>> + +>>> +>>> For more information, see [Using Amazon FSx for Windows with your self-managed Microsoft Active Directory](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-manage-prereqs.html) or [Using Amazon FSx for ONTAP with your self-managed Microsoft Active Directory](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-manage-prereqs.html) . +>>> +>>> Constraints: +>>> +>>> * min: `64` +>>> * max: `1024` +>>> * pattern: `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` +>>> + @@ -657 +678 @@ Shorthand Syntax: - ActiveDirectoryId=string,SelfManagedActiveDirectoryConfiguration={DomainName=string,OrganizationalUnitDistinguishedName=string,FileSystemAdministratorsGroup=string,UserName=string,Password=string,DnsIps=[string,string]},DeploymentType=string,PreferredSubnetId=string,ThroughputCapacity=integer,WeeklyMaintenanceStartTime=string,DailyAutomaticBackupStartTime=string,AutomaticBackupRetentionDays=integer,CopyTagsToBackups=boolean,Aliases=string,string,AuditLogConfiguration={FileAccessAuditLogLevel=string,FileShareAccessAuditLogLevel=string,AuditLogDestination=string},DiskIopsConfiguration={Mode=string,Iops=long} + ActiveDirectoryId=string,SelfManagedActiveDirectoryConfiguration={DomainName=string,OrganizationalUnitDistinguishedName=string,FileSystemAdministratorsGroup=string,UserName=string,Password=string,DnsIps=[string,string],DomainJoinServiceAccountSecret=string},DeploymentType=string,PreferredSubnetId=string,ThroughputCapacity=integer,WeeklyMaintenanceStartTime=string,DailyAutomaticBackupStartTime=string,AutomaticBackupRetentionDays=integer,CopyTagsToBackups=boolean,Aliases=string,string,AuditLogConfiguration={FileAccessAuditLogLevel=string,FileShareAccessAuditLogLevel=string,AuditLogDestination=string},DiskIopsConfiguration={Mode=string,Iops=long} @@ -671 +692,2 @@ JSON Syntax: - "DnsIps": ["string", ...] + "DnsIps": ["string", ...], + "DomainJoinServiceAccountSecret": "string" @@ -2288,0 +2311,12 @@ FileSystem -> (structure) +>>> +>>> DomainJoinServiceAccountSecret -> (string) +>>> +>>>> The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret containing the service account credentials used to join the file system to your self-managed Active Directory domain. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `64` +>>>> * max: `1024` +>>>> * pattern: `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` +>>>> + @@ -3433,0 +3468,12 @@ FileSystem -> (structure) +>>>>>> +>>>>>> DomainJoinServiceAccountSecret -> (string) +>>>>>> +>>>>>>> The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret containing the service account credentials used to join the file system to your self-managed Active Directory domain. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `64` +>>>>>>> * max: `1024` +>>>>>>> * pattern: `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` +>>>>>>> + @@ -6952,0 +6999,12 @@ FileSystem -> (structure) +>>>>>>>>> +>>>>>>>>> DomainJoinServiceAccountSecret -> (string) +>>>>>>>>> +>>>>>>>>>> The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret containing the service account credentials used to join the file system to your self-managed Active Directory domain. +>>>>>>>>>> +>>>>>>>>>> Constraints: +>>>>>>>>>> +>>>>>>>>>> * min: `64` +>>>>>>>>>> * max: `1024` +>>>>>>>>>> * pattern: `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` +>>>>>>>>>> + @@ -10197,0 +10256,12 @@ FileSystem -> (structure) +>>>>>>>>> +>>>>>>>>> DomainJoinServiceAccountSecret -> (string) +>>>>>>>>> +>>>>>>>>>> The Amazon Resource Name (ARN) of the Amazon Web Services Secrets Manager secret containing the service account credentials used to join the file system to your self-managed Active Directory domain. +>>>>>>>>>> +>>>>>>>>>> Constraints: +>>>>>>>>>> +>>>>>>>>>> * min: `64` +>>>>>>>>>> * max: `1024` +>>>>>>>>>> * pattern: `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` +>>>>>>>>>> + @@ -13188 +13258 @@ FileSystem -> (structure) - * [AWS CLI 2.31.28 Command Reference](../../index.html) » + * [AWS CLI 2.31.31 Command Reference](../../index.html) »