AWS cli documentation change
Summary
Added documentation for S3UpdateObjectEncryption operation to change object encryption types (SSE-S3 to SSE-KMS, S3 Bucket Keys) and updated KMSKeyArn constraints (min/max lengths and pattern).
Security assessment
The change documents security features related to updating encryption settings and validating KMS key ARN formats. While it enhances security documentation, there is no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/cli/latest/reference/s3control/describe-job.md b/cli/latest/reference/s3control/describe-job.md index f8cd9d882..5be51a2bb 100644 --- a//cli/latest/reference/s3control/describe-job.md +++ b//cli/latest/reference/s3control/describe-job.md @@ -15 +15 @@ - * [AWS CLI 2.33.8 Command Reference](../../index.html) » + * [AWS CLI 2.33.12 Command Reference](../../index.html) » @@ -1153,0 +1154,28 @@ Job -> (structure) +>> +>> S3UpdateObjectEncryption -> (structure) +>> +>>> Updates the server-side encryption type of an existing encrypted object in a general purpose bucket. You can use the `UpdateObjectEncryption` operation to change encrypted objects from server-side encryption with Amazon S3 managed keys (SSE-S3) to server-side encryption with Key Management Service (KMS) keys (SSE-KMS), or to apply S3 Bucket Keys. You can also use the `UpdateObjectEncryption` operation to change the customer-managed KMS key used to encrypt your data so that you can comply with custom key-rotation standards. +>>> +>>> ObjectEncryption -> (structure) +>>> +>>>> The updated server-side encryption type for this S3 object. The `UpdateObjectEncryption` operation supports the SSE-KMS encryption type. +>>>> +>>>> SSEKMS -> (structure) +>>>> +>>>>> Specifies to update the object encryption type to server-side encryption with Key Management Service (KMS) keys (SSE-KMS). +>>>>> +>>>>> KMSKeyArn -> (string) [required] +>>>>> +>>>>>> Specifies the Amazon Web Services KMS key Amazon Resource Name (ARN) to use for the updated server-side encryption type. Required if `UpdateObjectEncryption` specifies `SSEKMS` . +>>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `20` +>>>>>> * max: `2048` +>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:kms:[a-z0-9-]+:[0-9]{12}:key/[a-zA-Z0-9-]+` +>>>>>> + +>>>>> +>>>>> BucketKeyEnabled -> (boolean) +>>>>> +>>>>>> Specifies whether Amazon S3 should use an S3 Bucket Key for object encryption with server-side encryption using Key Management Service (KMS) keys (SSE-KMS). If this value isn’t specified, it defaults to `false` . Setting this value to `true` causes Amazon S3 to use an S3 Bucket Key for update object encryption with SSE-KMS. @@ -1598,2 +1626,2 @@ Job -> (structure) ->>>>>>>> * min: `1` ->>>>>>>> * max: `2000` +>>>>>>>> * min: `20` +>>>>>>>> * max: `2048` @@ -1618,2 +1646,2 @@ Job -> (structure) ->>>>>>>> * min: `1` ->>>>>>>> * max: `2000` +>>>>>>>> * min: `20` +>>>>>>>> * max: `2048` @@ -1702 +1730 @@ Job -> (structure) - * [AWS CLI 2.33.8 Command Reference](../../index.html) » + * [AWS CLI 2.33.12 Command Reference](../../index.html) »