AWS fsx documentation change
Summary
Updated documentation to include AWS Secrets Manager integration for storing Active Directory credentials and added clarification about credential exclusivity
Security assessment
The changes promote secure credential storage by integrating with AWS Secrets Manager (a security best practice) and prevent credential conflicts through explicit guidance. While this improves security posture, there's no evidence of addressing a specific existing vulnerability.
Diff
diff --git a/fsx/latest/WindowsGuide/update-self-ad-config.md b/fsx/latest/WindowsGuide/update-self-ad-config.md index dc4826e97..d2245844f 100644 --- a//fsx/latest/WindowsGuide/update-self-ad-config.md +++ b//fsx/latest/WindowsGuide/update-self-ad-config.md @@ -26 +26 @@ For information about troubleshooting possible issues related to self-managed Ac -You can use the AWS Management Console, Amazon FSx API, or AWS CLI to update the service account username and password and the DNS server IP addresses of a file system's self-managed Active Directory configuration. You can track the progress of a self-managed Active Directory configuration update at any time using the AWS Management Console, CLI, and API. For more information, see [Monitoring self-managed Active Directory updates](./monitor-self-ad-update.html). +You can use the AWS Management Console, Amazon FSx API, or AWS CLI to update the service account credentials and the DNS server IP addresses of a file system's self-managed Active Directory configuration. You can track the progress of a self-managed Active Directory configuration update at any time using the AWS Management Console, CLI, and API. For more information, see [Monitoring self-managed Active Directory updates](./monitor-self-ad-update.html). @@ -36 +36 @@ You can use the AWS Management Console, Amazon FSx API, or AWS CLI to update the - 4. Enter the new DNS server IP addresses, or the new service account credentials in the dialog that appears. + 4. Enter the new DNS server IP addresses, or the new service account credentials (username and password) or secret ARN in the dialog that appears. You can use AWS Secrets Manager to store your credentials. For more information, see [Storing Active Directory credentials using AWS Secrets Manager](./self-managed-AD.html#bp-store-ad-creds-using-secret-manager-windows). @@ -54,0 +55,6 @@ You can [monitor the update progress](./monitor-self-ad-update.html) using the A + * `DomainJoinServiceAccountSecret` the AWS Secrets Manager secret containing the username and password for a service account on your Active Directory domain + +###### Note + +You can't provide both username/password and a domain join service account secret to connect to your Active Directory. Provide only one set of credentials. +