AWS cli medium security documentation change
Summary
Updated CLI version reference, modified trust anchor ID pattern, restructured trust anchor documentation with added field constraints, clarified source types, and reorganized notification settings documentation.
Security assessment
The change to the trustAnchorId pattern from strict UUID matching (`[a-f0-9]{8}-...`) to a more permissive pattern (`.*[a-f0-9]{8}-...`) could indicate a security-relevant adjustment to validation logic. The restructured documentation adds explicit details about certificate handling (PEM-encoded data, ACM PCA integration) and notification configuration, which improves transparency about security features. However, there's no explicit mention of a CVE or security advisory.
Diff
diff --git a/cli/latest/reference/rolesanywhere/enable-trust-anchor.md b/cli/latest/reference/rolesanywhere/enable-trust-anchor.md index 4d0a84ac8..21801b7fd 100644 --- a//cli/latest/reference/rolesanywhere/enable-trust-anchor.md +++ b//cli/latest/reference/rolesanywhere/enable-trust-anchor.md @@ -15 +15 @@ - * [AWS CLI 2.32.11 Command Reference](../../index.html) » + * [AWS CLI 2.32.13 Command Reference](../../index.html) » @@ -102 +102 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> * pattern: `[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}` +> * pattern: `.*[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}.*` @@ -209 +209 @@ trustAnchor -> (structure) -> createdAt -> (timestamp) +> trustAnchorId -> (string) @@ -211 +211,9 @@ trustAnchor -> (structure) ->> The ISO-8601 timestamp when the trust anchor was created. +>> The unique identifier of the trust anchor. +>> +>> Constraints: +>> +>> * min: `36` +>> * max: `36` +>> * pattern: `.*[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}.*` +>> + @@ -213 +221 @@ trustAnchor -> (structure) -> enabled -> (boolean) +> trustAnchorArn -> (string) @@ -215 +223 @@ trustAnchor -> (structure) ->> Indicates whether the trust anchor is enabled. +>> The ARN of the trust anchor. @@ -225 +233 @@ trustAnchor -> (structure) ->> * pattern: `^[ a-zA-Z0-9-_]*$` +>> * pattern: `[ a-zA-Z0-9-_]*` @@ -229 +237 @@ trustAnchor -> (structure) -> notificationSettings -> (list) +> source -> (structure) @@ -231,3 +239 @@ trustAnchor -> (structure) ->> A list of notification settings to be associated to the trust anchor. ->> ->> Constraints: +>> The trust anchor type and its related certificate data. @@ -235,2 +241 @@ trustAnchor -> (structure) ->> * min: `0` ->> * max: `50` +>> sourceType -> (string) @@ -237,0 +243,8 @@ trustAnchor -> (structure) +>>> The type of the trust anchor. +>>> +>>> Possible values: +>>> +>>> * `AWS_ACM_PCA` +>>> * `CERTIFICATE_BUNDLE` +>>> * `SELF_SIGNED_REPOSITORY` +>>> @@ -240 +253 @@ trustAnchor -> (structure) ->> (structure) +>> sourceData -> (tagged union structure) @@ -242,3 +255 @@ trustAnchor -> (structure) ->>> The state of a notification setting. ->>> ->>> A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify. +>>> The data field of the trust anchor depending on its type. @@ -246 +257 @@ trustAnchor -> (structure) ->>> channel -> (string) +>>> ### Note @@ -248,11 +259 @@ trustAnchor -> (structure) ->>>> The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event. ->>>> ->>>> ### Note ->>>> ->>>> In the absence of a specific channel, IAM Roles Anywhere applies this setting to ‘ALL’ channels. ->>>> ->>>> Possible values: ->>>> ->>>> * `ALL` ->>>> - +>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `x509CertificateData`, `acmPcaArn`. @@ -260 +261 @@ trustAnchor -> (structure) ->>> configuredBy -> (string) +>>> x509CertificateData -> (string) @@ -262 +263 @@ trustAnchor -> (structure) ->>>> The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is `rolesanywhere.amazonaws.com` , and for customized notifications settings, it is the respective account ID. +>>>> The PEM-encoded data for the certificate anchor. Included for trust anchors of type `CERTIFICATE_BUNDLE` . @@ -267 +268 @@ trustAnchor -> (structure) ->>>> * max: `200` +>>>> * max: `16000` @@ -269,0 +271,33 @@ trustAnchor -> (structure) +>>> +>>> acmPcaArn -> (string) +>>> +>>>> The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type `AWS_ACM_PCA` . +> +> enabled -> (boolean) +> +>> Indicates whether the trust anchor is enabled. +> +> createdAt -> (timestamp) +> +>> The ISO-8601 timestamp when the trust anchor was created. +> +> updatedAt -> (timestamp) +> +>> The ISO-8601 timestamp when the trust anchor was last updated. +> +> notificationSettings -> (list) +> +>> A list of notification settings to be associated to the trust anchor. +>> +>> Constraints: +>> +>> * min: `0` +>> * max: `50` +>> + +>> +>> (structure) +>> +>>> The state of a notification setting. +>>> +>>> A notification setting includes information such as event name, threshold, status of the notification setting, and the channel to notify. @@ -296,10 +329,0 @@ trustAnchor -> (structure) -> -> source -> (structure) -> ->> The trust anchor type and its related certificate data. ->> ->> sourceData -> (tagged union structure) ->> ->>> The data field of the trust anchor depending on its type. ->>> ->>> ### Note @@ -307,3 +331 @@ trustAnchor -> (structure) ->>> This is a Tagged Union structure. Only one of the following top level keys can be set: `acmPcaArn`, `x509CertificateData`. ->>> ->>> acmPcaArn -> (string) +>>> channel -> (string) @@ -311 +333,11 @@ trustAnchor -> (structure) ->>>> The root certificate of the Private Certificate Authority specified by this ARN is used in trust validation for temporary credential requests. Included for trust anchors of type `AWS_ACM_PCA` . +>>>> The specified channel of notification. IAM Roles Anywhere uses CloudWatch metrics, EventBridge, and Health Dashboard to notify for an event. +>>>> +>>>> ### Note +>>>> +>>>> In the absence of a specific channel, IAM Roles Anywhere applies this setting to ‘ALL’ channels. +>>>> +>>>> Possible values: +>>>> +>>>> * `ALL` +>>>> + @@ -313 +345 @@ trustAnchor -> (structure) ->>> x509CertificateData -> (string) +>>> configuredBy -> (string) @@ -315 +347 @@ trustAnchor -> (structure) ->>>> The PEM-encoded data for the certificate anchor. Included for trust anchors of type `CERTIFICATE_BUNDLE` . +>>>> The principal that configured the notification setting. For default settings configured by IAM Roles Anywhere, the value is `rolesanywhere.amazonaws.com` , and for customized notifications settings, it is the respective account ID. @@ -320 +352 @@ trustAnchor -> (structure) ->>>> * max: `8000` +>>>> * max: `200` @@ -323,32 +354,0 @@ trustAnchor -> (structure) ->> ->> sourceType -> (string) ->> ->>> The type of the trust anchor. ->>> ->>> Possible values: ->>> ->>> * `AWS_ACM_PCA` ->>> * `CERTIFICATE_BUNDLE` ->>> * `SELF_SIGNED_REPOSITORY` ->>> - -> -> trustAnchorArn -> (string) -> ->> The ARN of the trust anchor. -> -> trustAnchorId -> (string) -> ->> The unique identifier of the trust anchor. ->> ->> Constraints: ->> ->> * min: `36` ->> * max: `36` ->> * pattern: `[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}` ->> - -> -> updatedAt -> (timestamp) -> ->> The ISO-8601 timestamp when the trust anchor was last updated. @@ -366 +366 @@ trustAnchor -> (structure) - * [AWS CLI 2.32.11 Command Reference](../../index.html) » + * [AWS CLI 2.32.13 Command Reference](../../index.html) »