AWS cli medium security documentation change
Summary
Updated AWS CLI version reference from 2.33.29 to 2.34.0. Added new --cli-error-format parameter options. Expanded documentation for region switching parameters, added RDS promote replica and cross-region replica configurations with security-related fields like crossAccountRole and externalId.
Security assessment
Added security documentation for cross-account roles (pattern-restricted ARNs) and externalID (described as 'secret key') in RDS configuration blocks. These are security controls for cross-account access and credential management, indicating added security features for disaster recovery workflows.
Diff
diff --git a/cli/latest/reference/arc-region-switch/get-plan.md b/cli/latest/reference/arc-region-switch/get-plan.md index 670a6eec2..db423a236 100644 --- a//cli/latest/reference/arc-region-switch/get-plan.md +++ b//cli/latest/reference/arc-region-switch/get-plan.md @@ -15 +15 @@ - * [AWS CLI 2.33.29 Command Reference](../../index.html) » + * [AWS CLI 2.34.0 Command Reference](../../index.html) » @@ -87,0 +88 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/arc-re + [--cli-error-format <value>] @@ -132,0 +134 @@ The formatting style for command output. + * off @@ -198,0 +201,13 @@ Disable automatically prompt for CLI input parameters. +`--cli-error-format` (string) + +The formatting style for error output. By default, errors are displayed in enhanced format. + + * legacy + * json + * yaml + * text + * table + * enhanced + + + @@ -249 +264 @@ plan -> (structure) ->>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`. +>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`, `rdsPromoteReadReplicaConfig`, `rdsCreateCrossRegionReadReplicaConfig`. @@ -304 +319 @@ plan -> (structure) ->>>>>>>> The Amazon Web Services Region for the function to run in. +>>>>>>>> The Amazon Web Services Region for the function to run in. For recovery workflows use `activatingRegion` or `deactivatingRegion` . For post-recovery workflows, use `activeRegion` (the Region with customer traffic) or `inactiveRegion` (the Region with no customer traffic). @@ -309,0 +325,2 @@ plan -> (structure) +>>>>>>>> * `activeRegion` +>>>>>>>> * `inactiveRegion` @@ -586 +603 @@ plan -> (structure) ->>>>>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`. +>>>>>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `customActionLambdaConfig`, `ec2AsgCapacityIncreaseConfig`, `executionApprovalConfig`, `arcRoutingControlConfig`, `globalAuroraConfig`, `parallelConfig`, `regionSwitchPlanConfig`, `ecsCapacityIncreaseConfig`, `eksResourceScalingConfig`, `route53HealthCheckConfig`, `documentDbConfig`, `rdsPromoteReadReplicaConfig`, `rdsCreateCrossRegionReadReplicaConfig`. @@ -641 +658 @@ plan -> (structure) ->>>>>>>>>>>> The Amazon Web Services Region for the function to run in. +>>>>>>>>>>>> The Amazon Web Services Region for the function to run in. For recovery workflows use `activatingRegion` or `deactivatingRegion` . For post-recovery workflows, use `activeRegion` (the Region with customer traffic) or `inactiveRegion` (the Region with no customer traffic). @@ -646,0 +664,2 @@ plan -> (structure) +>>>>>>>>>>>> * `activeRegion` +>>>>>>>>>>>> * `inactiveRegion` @@ -1319,0 +1339,96 @@ plan -> (structure) +>>>>>>>>>> +>>>>>>>>>> rdsPromoteReadReplicaConfig -> (structure) +>>>>>>>>>> +>>>>>>>>>>> An Amazon RDS promote read replica execution block. +>>>>>>>>>>> +>>>>>>>>>>> timeoutMinutes -> (integer) +>>>>>>>>>>> +>>>>>>>>>>>> The timeout value specified for the configuration. +>>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * min: `1` +>>>>>>>>>>>> + +>>>>>>>>>>> +>>>>>>>>>>> crossAccountRole -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> The cross-account role for the configuration. +>>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>>>>>>> + +>>>>>>>>>>> +>>>>>>>>>>> externalId -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> The external ID (secret key) for the configuration. +>>>>>>>>>>> +>>>>>>>>>>> dbInstanceArnMap -> (map) [required] +>>>>>>>>>>> +>>>>>>>>>>>> A map of database instance ARNs for each Region in the plan. +>>>>>>>>>>>> +>>>>>>>>>>>> key -> (string) +>>>>>>>>>>>> +>>>>>>>>>>>>> Constraints: +>>>>>>>>>>>>> +>>>>>>>>>>>>> * pattern: `[a-z]{2}-[a-z-]+-\d+` +>>>>>>>>>>>>> + +>>>>>>>>>>>> +>>>>>>>>>>>> value -> (string) +>>>>>>>>>>>> +>>>>>>>>>>>>> Constraints: +>>>>>>>>>>>>> +>>>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z-]*:rds:[a-z0-9-]+:\d{12}:db:[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*` +>>>>>>>>>>>>> + +>>>>>>>>>> +>>>>>>>>>> rdsCreateCrossRegionReadReplicaConfig -> (structure) +>>>>>>>>>> +>>>>>>>>>>> An Amazon RDS create cross-Region replica execution block. +>>>>>>>>>>> +>>>>>>>>>>> timeoutMinutes -> (integer) +>>>>>>>>>>> +>>>>>>>>>>>> The timeout value specified for the configuration. +>>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * min: `1` +>>>>>>>>>>>> + +>>>>>>>>>>> +>>>>>>>>>>> crossAccountRole -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> The cross-account role for the configuration. +>>>>>>>>>>>> +>>>>>>>>>>>> Constraints: +>>>>>>>>>>>> +>>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>>>>>>> + +>>>>>>>>>>> +>>>>>>>>>>> externalId -> (string) +>>>>>>>>>>> +>>>>>>>>>>>> The external ID (secret key) for the configuration. +>>>>>>>>>>> +>>>>>>>>>>> dbInstanceArnMap -> (map) [required] +>>>>>>>>>>> +>>>>>>>>>>>> A map of database instance ARNs for each Region in the plan. +>>>>>>>>>>>> +>>>>>>>>>>>> key -> (string) +>>>>>>>>>>>> +>>>>>>>>>>>>> Constraints: +>>>>>>>>>>>>> +>>>>>>>>>>>>> * pattern: `[a-z]{2}-[a-z-]+-\d+` +>>>>>>>>>>>>> + +>>>>>>>>>>>> +>>>>>>>>>>>> value -> (string) +>>>>>>>>>>>> +>>>>>>>>>>>>> Constraints: +>>>>>>>>>>>>> +>>>>>>>>>>>>> * pattern: `arn:aws[a-zA-Z-]*:rds:[a-z0-9-]+:\d{12}:db:[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*` +>>>>>>>>>>>>> + @@ -1337,0 +1453,2 @@ plan -> (structure) +>>>>>>>>>> * `RdsPromoteReadReplica` +>>>>>>>>>> * `RdsCreateCrossRegionReplica` @@ -1759,0 +1877,96 @@ plan -> (structure) +>>>>>> +>>>>>> rdsPromoteReadReplicaConfig -> (structure) +>>>>>> +>>>>>>> An Amazon RDS promote read replica execution block. +>>>>>>> +>>>>>>> timeoutMinutes -> (integer) +>>>>>>> +>>>>>>>> The timeout value specified for the configuration. +>>>>>>>> +>>>>>>>> Constraints: +>>>>>>>> +>>>>>>>> * min: `1` +>>>>>>>> + +>>>>>>> +>>>>>>> crossAccountRole -> (string) +>>>>>>> +>>>>>>>> The cross-account role for the configuration. +>>>>>>>> +>>>>>>>> Constraints: +>>>>>>>> +>>>>>>>> * pattern: `arn:aws[a-zA-Z0-9-]*:iam::[0-9]{12}:role/.+` +>>>>>>>> + +>>>>>>> +>>>>>>> externalId -> (string) +>>>>>>> +>>>>>>>> The external ID (secret key) for the configuration. +>>>>>>> +>>>>>>> dbInstanceArnMap -> (map) [required] +>>>>>>> +>>>>>>>> A map of database instance ARNs for each Region in the plan. +>>>>>>>> +>>>>>>>> key -> (string) +>>>>>>>> +>>>>>>>>> Constraints: +>>>>>>>>> +>>>>>>>>> * pattern: `[a-z]{2}-[a-z-]+-\d+` +>>>>>>>>> + +>>>>>>>> +>>>>>>>> value -> (string) +>>>>>>>> +>>>>>>>>> Constraints: +>>>>>>>>> +>>>>>>>>> * pattern: `arn:aws[a-zA-Z-]*:rds:[a-z0-9-]+:\d{12}:db:[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*` +>>>>>>>>> + +>>>>>> +>>>>>> rdsCreateCrossRegionReadReplicaConfig -> (structure) +>>>>>> +>>>>>>> An Amazon RDS create cross-Region replica execution block. +>>>>>>> +>>>>>>> timeoutMinutes -> (integer) +>>>>>>> +>>>>>>>> The timeout value specified for the configuration.