AWS AWSCloudFormation high security documentation change
Summary
Added DomainJoinServiceAccountSecret property for storing Active Directory credentials in AWS Secrets Manager
Security assessment
The change introduces secure credential management using Secrets Manager with specific key requirements (username/password). This directly addresses credential exposure risks by enforcing secure storage practices.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-fsx-filesystem-selfmanagedactivedirectoryconfiguration.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-fsx-filesystem-selfmanagedactivedirectoryconfiguration.md index f90ff7fbc..a3e37bb72 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-fsx-filesystem-selfmanagedactivedirectoryconfiguration.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-fsx-filesystem-selfmanagedactivedirectoryconfiguration.md @@ -19,0 +20 @@ To declare this entity in your CloudFormation template, use the following syntax + "DomainJoinServiceAccountSecret" : String, @@ -32,0 +34 @@ To declare this entity in your CloudFormation template, use the following syntax + DomainJoinServiceAccountSecret: String @@ -56,0 +59,28 @@ _Required_ : Conditional +`DomainJoinServiceAccountSecret` + + +The Amazon Resource Name (ARN) of the AWS Secrets Manager secret containing the self-managed Active Directory domain join service account credentials. When provided, Amazon FSx uses the credentials stored in this secret to join the file system to your self-managed Active Directory domain. + +The secret must contain two key-value pairs: + + * `CUSTOMER_MANAGED_ACTIVE_DIRECTORY_USERNAME` \- The username for the service account + + * `CUSTOMER_MANAGED_ACTIVE_DIRECTORY_PASSWORD` \- The password for the service account + + + + +For more information, see [ Using Amazon FSx for Windows with your self-managed Microsoft Active Directory](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-manage-prereqs.html) or [ Using Amazon FSx for ONTAP with your self-managed Microsoft Active Directory](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-manage-prereqs.html). + +_Required_ : No + + _Type_ : String + + _Pattern_ : `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` + +_Minimum_ : `64` + + _Maximum_ : `1024` + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) +