AWS AWSCloudFormation high security documentation change
Summary
Added DomainJoinServiceAccountSecret property for storing Active Directory credentials in AWS Secrets Manager
Security assessment
Identical to the filesystem change, this adds secure credential management using Secrets Manager with specific key requirements, mitigating credential exposure risks in storage virtual machines.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-fsx-storagevirtualmachine-selfmanagedactivedirectoryconfiguration.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-fsx-storagevirtualmachine-selfmanagedactivedirectoryconfiguration.md index 45b4cd883..ae1e28785 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-fsx-storagevirtualmachine-selfmanagedactivedirectoryconfiguration.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-fsx-storagevirtualmachine-selfmanagedactivedirectoryconfiguration.md @@ -19,0 +20 @@ To declare this entity in your CloudFormation template, use the following syntax + "DomainJoinServiceAccountSecret" : String, @@ -32,0 +34 @@ To declare this entity in your CloudFormation template, use the following syntax + DomainJoinServiceAccountSecret: String @@ -56,0 +59,28 @@ _Required_ : No +`DomainJoinServiceAccountSecret` + + +The Amazon Resource Name (ARN) of the AWS Secrets Manager secret containing the self-managed Active Directory domain join service account credentials. When provided, Amazon FSx uses the credentials stored in this secret to join the file system to your self-managed Active Directory domain. + +The secret must contain two key-value pairs: + + * `CUSTOMER_MANAGED_ACTIVE_DIRECTORY_USERNAME` \- The username for the service account + + * `CUSTOMER_MANAGED_ACTIVE_DIRECTORY_PASSWORD` \- The password for the service account + + + + +For more information, see [ Using Amazon FSx for Windows with your self-managed Microsoft Active Directory](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-manage-prereqs.html) or [ Using Amazon FSx for ONTAP with your self-managed Microsoft Active Directory](https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/self-manage-prereqs.html). + +_Required_ : No + + _Type_ : String + + _Pattern_ : `^arn:[^:]{1,63}:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+-[a-zA-Z0-9]{6}$` + +_Minimum_ : `64` + + _Maximum_ : `1024` + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) +