AWS cli documentation change
Summary
Added documentation for MonitoringConfiguration (including CloudWatch, managed, and S3 logging configurations with KMS encryption) and EngineConfiguration settings for Spark workloads. Updated CLI version reference from 2.31.39 to 2.32.3.
Security assessment
The changes add documentation for encrypting logs using KMS keys in both managed logging and S3 logging configurations, which are security features. However, there is no evidence this addresses an existing security vulnerability - rather it documents existing security controls.
Diff
diff --git a/cli/latest/reference/athena/create-work-group.md b/cli/latest/reference/athena/create-work-group.md index 5660ee424..716b892ac 100644 --- a//cli/latest/reference/athena/create-work-group.md +++ b//cli/latest/reference/athena/create-work-group.md @@ -15 +15 @@ - * [AWS CLI 2.31.39 Command Reference](../../index.html) » + * [AWS CLI 2.32.3 Command Reference](../../index.html) » @@ -194 +194 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/athena ->> If set to “true”, the settings for the workgroup override client-side settings. If set to “false”, client-side settings are used. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html) . +>> If set to “true”, the settings for the workgroup override client-side settings. If set to “false”, client-side settings are used. This property is not required for Apache Spark enabled workgroups. For more information, see [Workgroup Settings Override Client-Side Settings](https://docs.aws.amazon.com/athena/latest/ug/workgroups-settings-override.html) . @@ -261,0 +262,219 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/athena +> +> MonitoringConfiguration -> (structure) +> +>> Contains the configuration settings for managed log persistence, delivering logs to Amazon S3 buckets, Amazon CloudWatch log groups etc. +>> +>> CloudWatchLoggingConfiguration -> (structure) +>> +>>> Configuration settings for delivering logs to Amazon CloudWatch log groups. +>>> +>>> Enabled -> (boolean) [required] +>>> +>>>> Enables CloudWatch logging. +>>> +>>> LogGroup -> (string) +>>> +>>>> The name of the log group in Amazon CloudWatch Logs where you want to publish your logs. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `512` +>>>> * pattern: `^[a-zA-Z0-9._/-]+$` +>>>> + +>>> +>>> LogStreamNamePrefix -> (string) +>>> +>>>> Prefix for the CloudWatch log stream name. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `512` +>>>> * pattern: `^[^:*]*$` +>>>> + +>>> +>>> LogTypes -> (map) +>>> +>>>> The types of logs that you want to publish to CloudWatch. +>>>> +>>>> key -> (string) +>>>> +>>>> value -> (list) +>>>> +>>>>> (string) +>> +>> ManagedLoggingConfiguration -> (structure) +>> +>>> Configuration settings for managed log persistence. +>>> +>>> Enabled -> (boolean) [required] +>>> +>>>> Enables mamanged log persistence. +>>> +>>> KmsKey -> (string) +>>> +>>>> The KMS key ARN to encrypt the logs stored in managed log persistence. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `2048` +>>>> * pattern: `^arn:aws[a-z\-]*:kms:([a-z0-9\-]+):\d{12}:key/?[a-zA-Z_0-9+=,.@\-_/]+$|^arn:aws[a-z\-]*:kms:([a-z0-9\-]+):\d{12}:alias/?[a-zA-Z_0-9+=,.@\-_/]+$|^alias/[a-zA-Z0-9/_-]+$|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}` +>>>> + +>> +>> S3LoggingConfiguration -> (structure) +>> +>>> Configuration settings for delivering logs to Amazon S3 buckets. +>>> +>>> Enabled -> (boolean) [required] +>>> +>>>> Enables S3 log delivery. +>>> +>>> KmsKey -> (string) +>>> +>>>> The KMS key ARN to encrypt the logs published to the given Amazon S3 destination. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `2048` +>>>> * pattern: `^arn:aws[a-z\-]*:kms:([a-z0-9\-]+):\d{12}:key/?[a-zA-Z_0-9+=,.@\-_/]+$|^arn:aws[a-z\-]*:kms:([a-z0-9\-]+):\d{12}:alias/?[a-zA-Z_0-9+=,.@\-_/]+$|^alias/[a-zA-Z0-9/_-]+$|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}` +>>>> + +>>> +>>> LogLocation -> (string) +>>> +>>>> The Amazon S3 destination URI for log publishing. +>>>> +>>>> Constraints: +>>>> +>>>> * max: `1024` +>>>> * pattern: `^s3://[a-z0-9][a-z0-9\-]*[a-z0-9](/.*)?$` +>>>> + +> +> EngineConfiguration -> (structure) +> +>> Contains data processing unit (DPU) configuration settings and parameter mappings for a notebook engine. +>> +>> CoordinatorDpuSize -> (integer) +>> +>>> The number of DPUs to use for the coordinator. A coordinator is a special executor that orchestrates processing work and manages other executors in a notebook session. The default is 1. +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `1` +>>> + +>> +>> MaxConcurrentDpus -> (integer) +>> +>>> The maximum number of DPUs that can run concurrently. +>>> +>>> Constraints: +>>> +>>> * min: `2` +>>> * max: `5000` +>>> + +>> +>> DefaultExecutorDpuSize -> (integer) +>> +>>> The default number of DPUs to use for executors. An executor is the smallest unit of compute that a notebook session can request from Athena. The default is 1. +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `1` +>>> + +>> +>> AdditionalConfigs -> (map) +>> +>>> Contains additional notebook engine `MAP<string, string>` parameter mappings in the form of key-value pairs. To specify an Athena notebook that the Jupyter server will download and serve, specify a value for the StartSessionRequest$NotebookVersion field, and then add a key named `NotebookId` to `AdditionalConfigs` that has the value of the Athena notebook ID. +>>> +>>> key -> (string) +>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `255` +>>>> * pattern: `[\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF\t]*` +>>>> + +>>> +>>> value -> (string) +>>> +>>>> Constraints: +>>>> +>>>> * max: `51200` +>>>> + +>> +>> SparkProperties -> (map) +>> +>>> Specifies custom jar files and Spark properties for use cases like cluster encryption, table formats, and general Spark tuning. +>>> +>>> key -> (string) +>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `255` +>>>> * pattern: `[\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF\t]*` +>>>> + +>>> +>>> value -> (string) +>>> +>>>> Constraints: +>>>> +>>>> * max: `51200` +>>>> + +>> +>> Classifications -> (list) +>> +>>> The configuration classifications that can be specified for the engine. +>>> +>>> (structure) +>>> +>>>> A classification refers to a set of specific configurations. +>>>> +>>>> Name -> (string) +>>>>