AWS AWSCloudFormation documentation change
Summary
Added CmkSecretConfig and CustomSecretConfig properties for secure secrets management in DataSync HDFS locations
Security assessment
Expands documentation to include secure credential storage options (KMS/Secrets Manager). Enhances security practices but does not patch a vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-datasync-locationhdfs.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-datasync-locationhdfs.md index cf5b0a502..7294d924c 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-datasync-locationhdfs.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-datasync-locationhdfs.md @@ -23,0 +24,2 @@ To declare this entity in your CloudFormation template, use the following syntax + "CmkSecretConfig" : [CmkSecretConfig](./aws-properties-datasync-locationhdfs-cmksecretconfig.html), + "CustomSecretConfig" : [CustomSecretConfig](./aws-properties-datasync-locationhdfs-customsecretconfig.html), @@ -46,0 +49,4 @@ To declare this entity in your CloudFormation template, use the following syntax + CmkSecretConfig: + [CmkSecretConfig](./aws-properties-datasync-locationhdfs-cmksecretconfig.html) + CustomSecretConfig: + [CustomSecretConfig](./aws-properties-datasync-locationhdfs-customsecretconfig.html) @@ -106,0 +113,30 @@ _Required_ : No +`CmkSecretConfig` + + +Specifies configuration information for a DataSync-managed secret, such as an authentication token, secret key, password, or Kerberos keytab that DataSync uses to access a specific storage location, with a customer-managed AWS KMS key. + +###### Note + +You can use either `CmkSecretConfig` or `CustomSecretConfig` to provide credentials for a `CreateLocation` request. Do not provide both parameters for the same request. + +_Required_ : No + + _Type_ : [CmkSecretConfig](./aws-properties-datasync-locationhdfs-cmksecretconfig.html) + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + +`CustomSecretConfig` + + +Specifies configuration information for a customer-managed Secrets Manager secret where a storage location credentials is stored in Secrets Manager as plain text (for authentication token, secret key, or password) or as binary (for Kerberos keytab). This configuration includes the secret ARN, and the ARN for an IAM role that provides access to the secret. + +###### Note + +You can use either `CmkSecretConfig` or `CustomSecretConfig` to provide credentials for a `CreateLocation` request. Do not provide both parameters for the same request. + +_Required_ : No + + _Type_ : [CustomSecretConfig](./aws-properties-datasync-locationhdfs-customsecretconfig.html) + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + @@ -276,0 +313,5 @@ For more information about using the `Fn::GetAtt` intrinsic function, see [Fn::G +`CmkSecretConfig.SecretArn` + + +Property description not available. + @@ -295 +336 @@ Tag -NameNode +CmkSecretConfig