AWS cli documentation change
Summary
Updated documentation for DescribeHandshake API with clarified terminology, added TRANSFER_RESPONSIBILITY handshake type, and improved parameter/resource descriptions
Security assessment
The changes emphasize secure exchange of account information through handshakes and clarify security-related retention policies (30-day visibility before deletion). However, there's no evidence of addressing a specific vulnerability. The added TRANSFER_RESPONSIBILITY type and management account details improve documentation of security-related features.
Diff
diff --git a/cli/latest/reference/organizations/describe-handshake.md b/cli/latest/reference/organizations/describe-handshake.md index b5d868f9c..4b43298f0 100644 --- a//cli/latest/reference/organizations/describe-handshake.md +++ b//cli/latest/reference/organizations/describe-handshake.md @@ -15 +15 @@ - * [AWS CLI 2.31.39 Command Reference](../../index.html) » + * [AWS CLI 2.32.3 Command Reference](../../index.html) » @@ -60 +60 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -Retrieves information about a previously requested handshake. The handshake ID comes from the response to the original InviteAccountToOrganization operation that generated the handshake. +Returns details for a handshake. A handshake is the secure exchange of information between two Amazon Web Services accounts: a sender and a recipient. @@ -62 +62 @@ Retrieves information about a previously requested handshake. The handshake ID c -You can access handshakes that are `ACCEPTED` , `DECLINED` , or `CANCELED` for only 30 days after they change to that state. They’re then deleted and no longer accessible. +You can view `ACCEPTED` , `DECLINED` , or `CANCELED` handshakes in API Responses for 30 days before they are deleted. @@ -64 +64 @@ You can access handshakes that are `ACCEPTED` , `DECLINED` , or `CANCELED` for o -This operation can be called from any account in the organization. +You can call this operation from any account in a organization. @@ -99 +99 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/organi -> The unique identifier (ID) of the handshake that you want information about. You can get the ID from the original call to InviteAccountToOrganization , or from a call to ListHandshakesForAccount or ListHandshakesForOrganization . +> ID for the handshake that you want information about. @@ -272 +272 @@ Handshake -> (structure) -> A structure that contains information about the specified handshake. +> A `Handshake` object. Contains details for the handshake. @@ -276 +276 @@ Handshake -> (structure) ->> The unique identifier (ID) of a handshake. The originating account creates the ID when it initiates the handshake. +>> ID for the handshake. @@ -289 +289 @@ Handshake -> (structure) ->> The Amazon Resource Name (ARN) of a handshake. +>> Amazon Resource Name (ARN) for the handshake. @@ -301 +301 @@ Handshake -> (structure) ->> Information about the two accounts that are participating in the handshake. +>> An array of `HandshakeParty` objects. Contains details for participant in a handshake. @@ -305 +305 @@ Handshake -> (structure) ->>> Identifies a participant in a handshake. +>>> Contains details for a participant in a handshake. @@ -309 +309 @@ Handshake -> (structure) ->>>> The unique identifier (ID) for the party. +>>>> ID for the participant: Acccount ID, organization ID, or email address. @@ -323 +323 @@ Handshake -> (structure) ->>>> The type of party. +>>>> The type of ID for the participant. @@ -335 +335 @@ Handshake -> (structure) ->> The current state of the handshake. Use the state to trace the flow of the handshake through the process from its creation to its acceptance. The meaning of each of the valid values is as follows: +>> Current state for the handshake. @@ -337,6 +337,6 @@ Handshake -> (structure) ->> * **REQUESTED** : This handshake was sent to multiple recipients (applicable to only some handshake types) and not all recipients have responded yet. The request stays in this state until all recipients respond. ->> * **OPEN** : This handshake was sent to multiple recipients (applicable to only some policy types) and all recipients have responded, allowing the originator to complete the handshake action. ->> * **CANCELED** : This handshake is no longer active because it was canceled by the originating account. ->> * **ACCEPTED** : This handshake is complete because it has been accepted by the recipient. ->> * **DECLINED** : This handshake is no longer active because it was declined by the recipient account. ->> * **EXPIRED** : This handshake is no longer active because the originator did not receive a response of any kind from the recipient before the expiration time (15 days). +>> * **REQUESTED** : Handshake awaiting a response from the recipient. +>> * **OPEN** : Handshake sent to multiple recipients and all recipients have responded. The sender can now complete the handshake action. +>> * **CANCELED** : Handshake canceled by the sender. +>> * **ACCEPTED** : Handshake accepted by the recipient. +>> * **DECLINED** : Handshake declined by the recipient. +>> * **EXPIRED** : Handshake has expired. @@ -359 +359 @@ Handshake -> (structure) ->> The date and time that the handshake request was made. +>> Timestamp when the handshake request was made. @@ -363 +363 @@ Handshake -> (structure) ->> The date and time that the handshake expires. If the recipient of the handshake request fails to respond before the specified date and time, the handshake becomes inactive and is no longer valid. +>> Timestamp when the handshake expires. @@ -367 +367 @@ Handshake -> (structure) ->> The type of handshake, indicating what action occurs when the recipient accepts the handshake. The following handshake types are supported: +>> The type of handshake: @@ -369,3 +369,4 @@ Handshake -> (structure) ->> * **INVITE** : This type of handshake represents a request to join an organization. It is always sent from the management account to only non-member accounts. ->> * **ENABLE_ALL_FEATURES** : This type of handshake represents a request to enable all features in an organization. It is always sent from the management account to only _invited_ member accounts. Created accounts do not receive this because those accounts were created by the organization’s management account and approval is inferred. ->> * **APPROVE_ALL_FEATURES** : This type of handshake is sent from the Organizations service when all member accounts have approved the `ENABLE_ALL_FEATURES` invitation. It is sent only to the management account and signals the master that it can finalize the process to enable all features. +>> * **INVITE** : Handshake sent to a standalone account requesting that it to join the sender’s organization. +>> * **ENABLE_ALL_FEATURES** : Handshake sent to invited member accounts to enable all features for the organization. +>> * **APPROVE_ALL_FEATURES** : Handshake sent to the management account when all invited member accounts have approved to enable all features. +>> * **TRANSFER_RESPONSIBILITY** : Handshake sent to another organization’s management account requesting that it designate the sender with the specified responsibilities for recipient’s organization. @@ -380,0 +382 @@ Handshake -> (structure) +>> * `TRANSFER_RESPONSIBILITY` @@ -386 +388 @@ Handshake -> (structure) ->> Additional information that is needed to process the handshake. +>> An array of `HandshakeResource` objects. When needed, contains additional details for a handshake. For example, the email address for the sender. @@ -390 +392 @@ Handshake -> (structure) ->>> Contains additional data that is needed to process a handshake. +>>> Contains additional details for a handshake. @@ -394 +396 @@ Handshake -> (structure) ->>>> The information that is passed to the other party in the handshake. The format of the value string must match the requirements of the specified type. +>>>> Additional information for the handshake. The format of the value string must match the requirements of the specified type. @@ -400,6 +402,6 @@ Handshake -> (structure) ->>>> * `ACCOUNT` \- Specifies an Amazon Web Services account ID number. ->>>> * `ORGANIZATION` \- Specifies an organization ID number. ->>>> * `EMAIL` \- Specifies the email address that is associated with the account that receives the handshake. ->>>> * `OWNER_EMAIL` \- Specifies the email address associated with the management account. Included as information about an organization. ->>>> * `OWNER_NAME` \- Specifies the name associated with the management account. Included as information about an organization. ->>>> * `NOTES` \- Additional text provided by the handshake initiator and intended for the recipient to read. +>>>> * **ACCOUNT** : ID for an Amazon Web Services account. +>>>> * **ORGANIZATION** : ID for an organization. +>>>> * **EMAIL** : Email address for the recipient. +>>>> * **OWNER_EMAIL** : Email address for the sender. +>>>> * **OWNER_NAME** : Name of the sender. +>>>> * **NOTES** : Additional text included by the sender for the recipient. @@ -418,0 +421,6 @@ Handshake -> (structure) +>>>> * `RESPONSIBILITY_TRANSFER` +>>>> * `TRANSFER_START_TIMESTAMP` +>>>> * `TRANSFER_TYPE` +>>>> * `MANAGEMENT_ACCOUNT` +>>>> * `MANAGEMENT_EMAIL` +>>>> * `MANAGEMENT_NAME` @@ -424 +432 @@ Handshake -> (structure) ->>>> When needed, contains an additional array of `HandshakeResource` objects. +>>>> An array of `HandshakeResource` objects. When needed, contains additional details for a handshake. For example, the email address for the sender. @@ -428 +436 @@ Handshake -> (structure) ->>>>> Contains additional data that is needed to process a handshake. +>>>>> Contains additional details for a handshake. @@ -432 +440 @@ Handshake -> (structure) ->>>>>> The information that is passed to the other party in the handshake. The format of the value string must match the requirements of the specified type. +>>>>>> Additional information for the handshake. The format of the value string must match the requirements of the specified type. @@ -438,6 +446,6 @@ Handshake -> (structure) ->>>>>> * `ACCOUNT` \- Specifies an Amazon Web Services account ID number. ->>>>>> * `ORGANIZATION` \- Specifies an organization ID number. ->>>>>> * `EMAIL` \- Specifies the email address that is associated with the account that receives the handshake. ->>>>>> * `OWNER_EMAIL` \- Specifies the email address associated with the management account. Included as information about an organization. ->>>>>> * `OWNER_NAME` \- Specifies the name associated with the management account. Included as information about an organization. ->>>>>> * `NOTES` \- Additional text provided by the handshake initiator and intended for the recipient to read. +>>>>>> * **ACCOUNT** : ID for an Amazon Web Services account. +>>>>>> * **ORGANIZATION** : ID for an organization. +>>>>>> * **EMAIL** : Email address for the recipient. +>>>>>> * **OWNER_EMAIL** : Email address for the sender. +>>>>>> * **OWNER_NAME** : Name of the sender. +>>>>>> * **NOTES** : Additional text included by the sender for the recipient. @@ -456,0 +465,6 @@ Handshake -> (structure) +>>>>>> * `RESPONSIBILITY_TRANSFER` +>>>>>> * `TRANSFER_START_TIMESTAMP` +>>>>>> * `TRANSFER_TYPE` +>>>>>> * `MANAGEMENT_ACCOUNT` +>>>>>> * `MANAGEMENT_EMAIL` +>>>>>> * `MANAGEMENT_NAME` @@ -470 +484 @@ Handshake -> (structure) - * [AWS CLI 2.31.39 Command Reference](../../index.html) » + * [AWS CLI 2.32.3 Command Reference](../../index.html) »