AWS cli documentation change

Service: cli · 2026-03-13 · Documentation medium

File: cli/latest/reference/datasync/create-location-hdfs.md

Summary

Added documentation for --cmk-secret-config and --custom-secret-config parameters, detailing KMS key usage for secret management and credential configuration options

Security assessment

The changes introduce new parameters for managing secrets with KMS encryption and IAM roles, enhancing security documentation. However, there's no evidence of addressing a specific vulnerability - this expands security best practices for credential management.

Diff

diff --git a/cli/latest/reference/datasync/create-location-hdfs.md b/cli/latest/reference/datasync/create-location-hdfs.md
index b74fd7fa6..c12856c93 100644
--- a//cli/latest/reference/datasync/create-location-hdfs.md
+++ b//cli/latest/reference/datasync/create-location-hdfs.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.8 Command Reference](../../index.html) »
@@ -81,0 +82,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/datasy
+    [--cmk-secret-config <value>]
+    [--custom-secret-config <value>]
@@ -405,0 +408,94 @@ JSON Syntax:
+`--cmk-secret-config` (structure)
+
+> Specifies configuration information for a DataSync-managed secret, which includes the Kerberos keytab that DataSync uses to access a specific Hadoop Distributed File System (HDFS) storage location, with a customer-managed KMS key.
+> 
+> When you include this parameter as part of a `CreateLocationHdfs` request, you provide only the KMS key ARN. DataSync uses this KMS key together with the `KerberosKeytab` you specify for to create a DataSync-managed secret to store the location access credentials.
+> 
+> Make sure that DataSync has permission to access the KMS key that you specify. For more information, see [Using a service-managed secret encrypted with a custom KMS key](https://docs.aws.amazon.com/datasync/latest/userguide/location-credentials.html#service-secret-custom-key) .
+> 
+> ### Note
+> 
+> You can use either `CmkSecretConfig` (with `KerberosKeytab` ) or `CustomSecretConfig` (without `KerberosKeytab` ) to provide credentials for a `CreateLocationHdfs` request. Do not provide both parameters for the same request.
+> 
+> SecretArn -> (string)
+>
+>> Specifies the ARN for the DataSync-managed Secrets Manager secret that that is used to access a specific storage location. This property is generated by DataSync and is read-only. DataSync encrypts this secret with the KMS key that you specify for `KmsKeyArn` .
+>> 
+>> Constraints:
+>> 
+>>   * max: `2048`
+>>   * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):secretsmanager:[a-z\-0-9]+:[0-9]{12}:secret:.*|)$`
+>> 
+
+> 
+> KmsKeyArn -> (string)
+>
+>> Specifies the ARN for the customer-managed KMS key that DataSync uses to encrypt the DataSync-managed secret stored for `SecretArn` . DataSync provides this key to Secrets Manager.
+>> 
+>> Constraints:
+>> 
+>>   * max: `2048`
+>>   * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):kms:[a-z\-0-9]+:[0-9]{12}:key/.*|)$`
+>> 
+
+
+Shorthand Syntax:
+    
+    
+    SecretArn=string,KmsKeyArn=string
+    
+
+JSON Syntax:
+    
+    
+    {
+      "SecretArn": "string",
+      "KmsKeyArn": "string"
+    }
+    
+
+`--custom-secret-config` (structure)
+
+> Specifies configuration information for a customer-managed Secrets Manager secret where the Kerberos keytab for the HDFS storage location is stored in binary, in Secrets Manager. This configuration includes the secret ARN, and the ARN for an IAM role that provides access to the secret. For more information, see [Using a secret that you manage](https://docs.aws.amazon.com/datasync/latest/userguide/location-credentials.html#custom-secret-custom-key) .
+> 
+> ### Note
+> 
+> You can use either `CmkSecretConfig` (with `KerberosKeytab` ) or `CustomSecretConfig` (without `KerberosKeytab` ) to provide credentials for a `CreateLocationHdfs` request. Do not provide both parameters for the same request.
+> 
+> SecretArn -> (string)
+>
+>> Specifies the ARN for an Secrets Manager secret.
+>> 
+>> Constraints:
+>> 
+>>   * max: `2048`
+>>   * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):secretsmanager:[a-z\-0-9]+:[0-9]{12}:secret:.*|)$`
+>> 
+
+> 
+> SecretAccessRoleArn -> (string)
+>
+>> Specifies the ARN for the Identity and Access Management role that DataSync uses to access the secret specified for `SecretArn` .
+>> 
+>> Constraints:
+>> 
+>>   * max: `2048`
+>>   * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):iam::[0-9]{12}:role/[a-zA-Z0-9+=,.@_-]+|)$`
+>> 
+
+
+Shorthand Syntax:
+    
+    
+    SecretArn=string,SecretAccessRoleArn=string
+    
+
+JSON Syntax:
+    
+    
+    {
+      "SecretArn": "string",
+      "SecretAccessRoleArn": "string"
+    }
+    
+
@@ -540 +636 @@ LocationArn -> (string)
-  * [AWS CLI 2.34.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.8 Command Reference](../../index.html) »