AWS cli documentation change
Summary
Updated AWS CLI version reference from 2.34.5 to 2.34.8. Added documentation for three new secret configuration structures: ManagedSecretConfig, CmkSecretConfig, and CustomSecretConfig, which describe how DataSync can manage secrets for storage location credentials using AWS Secrets Manager with different encryption and access options.
Security assessment
The change adds documentation for new secret management configurations that enhance security by enabling credential storage in AWS Secrets Manager with encryption (using AWS-managed or customer-managed KMS keys) and IAM role-based access. This promotes better security practices for handling sensitive credentials. There is no indication that this change fixes a specific security vulnerability; it appears to be a documentation update for new security-related features.
Diff
diff --git a/cli/latest/reference/datasync/describe-location-fsx-windows.md b/cli/latest/reference/datasync/describe-location-fsx-windows.md index 9c3fb4d87..a5e026762 100644 --- a//cli/latest/reference/datasync/describe-location-fsx-windows.md +++ b//cli/latest/reference/datasync/describe-location-fsx-windows.md @@ -15 +15 @@ - * [AWS CLI 2.34.5 Command Reference](../../index.html) » + * [AWS CLI 2.34.8 Command Reference](../../index.html) » @@ -286,0 +287,67 @@ Domain -> (string) +ManagedSecretConfig -> (structure) + +> Describes configuration information for a DataSync-managed secret, such as a `Password` that DataSync uses to access a specific storage location. DataSync uses the default Amazon Web Services-managed KMS key to encrypt this secret in Secrets Manager. +> +> SecretArn -> (string) +> +>> Specifies the ARN for an Secrets Manager secret. +>> +>> Constraints: +>> +>> * max: `2048` +>> * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):secretsmanager:[a-z\-0-9]+:[0-9]{12}:secret:.*|)$` +>> + + +CmkSecretConfig -> (structure) + +> Describes configuration information for a DataSync-managed secret, such as a `Password` that DataSync uses to access a specific storage location, with a customer-managed KMS key. +> +> SecretArn -> (string) +> +>> Specifies the ARN for the DataSync-managed Secrets Manager secret that that is used to access a specific storage location. This property is generated by DataSync and is read-only. DataSync encrypts this secret with the KMS key that you specify for `KmsKeyArn` . +>> +>> Constraints: +>> +>> * max: `2048` +>> * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):secretsmanager:[a-z\-0-9]+:[0-9]{12}:secret:.*|)$` +>> + +> +> KmsKeyArn -> (string) +> +>> Specifies the ARN for the customer-managed KMS key that DataSync uses to encrypt the DataSync-managed secret stored for `SecretArn` . DataSync provides this key to Secrets Manager. +>> +>> Constraints: +>> +>> * max: `2048` +>> * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):kms:[a-z\-0-9]+:[0-9]{12}:key/.*|)$` +>> + + +CustomSecretConfig -> (structure) + +> Describes configuration information for a customer-managed secret, such as a `Password` that DataSync uses to access a specific storage location, with a customer-managed Identity and Access Management (IAM) role that provides access to the secret. +> +> SecretArn -> (string) +> +>> Specifies the ARN for an Secrets Manager secret. +>> +>> Constraints: +>> +>> * max: `2048` +>> * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):secretsmanager:[a-z\-0-9]+:[0-9]{12}:secret:.*|)$` +>> + +> +> SecretAccessRoleArn -> (string) +> +>> Specifies the ARN for the Identity and Access Management role that DataSync uses to access the secret specified for `SecretArn` . +>> +>> Constraints: +>> +>> * max: `2048` +>> * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):iam::[0-9]{12}:role/[a-zA-Z0-9+=,.@_-]+|)$` +>> + + @@ -297 +364 @@ Domain -> (string) - * [AWS CLI 2.34.5 Command Reference](../../index.html) » + * [AWS CLI 2.34.8 Command Reference](../../index.html) »