AWS cli medium security documentation change

Service: cli · 2025-11-10 · Security-related medium

File: cli/latest/reference/vpc-lattice/create-resource-configuration.md

Summary

Added documentation for new domain verification parameters (custom-domain-name, group-domain, domain-verification-identifier) and corresponding output fields with validation constraints

Security assessment

The changes introduce domain verification requirements (domain-verification-identifier pattern validation) and explicit documentation about proving domain ownership. This addresses potential security concerns around domain hijacking/spoofing by requiring verification identifiers matching specific patterns (dv- prefixed values) and ARN formats. The constraints help prevent misconfigurations that could lead to unauthorized domain associations.

Diff

diff --git a/cli/latest/reference/vpc-lattice/create-resource-configuration.md b/cli/latest/reference/vpc-lattice/create-resource-configuration.md
index 341dc159f..2844541f0 100644
--- a//cli/latest/reference/vpc-lattice/create-resource-configuration.md
+++ b//cli/latest/reference/vpc-lattice/create-resource-configuration.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.31 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.32 Command Reference](../../index.html) »
@@ -75,0 +76,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la
+    [--custom-domain-name <value>]
+    [--group-domain <value>]
+    [--domain-verification-identifier <value>]
@@ -286,0 +290,34 @@ JSON Syntax:
+`--custom-domain-name` (string)
+
+> A custom domain name for your resource configuration. Additionally, provide a DomainVerificationID to prove your ownership of a domain.
+> 
+> Constraints:
+> 
+>   * min: `3`
+>   * max: `255`
+> 
+
+
+`--group-domain` (string)
+
+> (GROUP) The group domain for a group resource configuration. Any domains that you create for the child resource are subdomains of the group domain. Child resources inherit the verification status of the domain.
+> 
+> Constraints:
+> 
+>   * min: `3`
+>   * max: `255`
+> 
+
+
+`--domain-verification-identifier` (string)
+
+> The domain verification ID of your verified custom domain name. If you don’t provide an ID, you must configure the DNS settings yourself.
+> 
+> Constraints:
+> 
+>   * min: `20`
+>   * max: `2048`
+>   * pattern: `((dv-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:domainverification/dv-[a-fA-F0-9]{17}))`
+> 
+
+
@@ -696,0 +734,46 @@ failureReason -> (string)
+customDomainName -> (string)
+
+> The custom domain name for your resource configuration.
+> 
+> Constraints:
+> 
+>   * min: `3`
+>   * max: `255`
+> 
+
+
+domainVerificationId -> (string)
+
+> The domain name verification ID.
+> 
+> Constraints:
+> 
+>   * min: `20`
+>   * max: `20`
+>   * pattern: `dv-[a-fA-F0-9]{17}`
+> 
+
+
+groupDomain -> (string)
+
+> (GROUP) The group domain for a group resource configuration. Any domains that you create for the child resource are subdomains of the group domain. Child resources inherit the verification status of the domain.
+> 
+> Constraints:
+> 
+>   * min: `3`
+>   * max: `255`
+> 
+
+
+domainVerificationArn -> (string)
+
+> The verification ID ARN
+> 
+> Constraints:
+> 
+>   * min: `20`
+>   * max: `2048`
+>   * pattern: `arn:[a-z0-9f\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:domainverification/dv-[a-fA-F0-9]{17}`
+> 
+
+
@@ -707 +790 @@ failureReason -> (string)
-  * [AWS CLI 2.31.31 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.32 Command Reference](../../index.html) »