AWS cli documentation change

Service: cli · 2026-03-13 · Documentation low

File: cli/latest/reference/datasync/update-location-fsx-windows.md

Summary

Added two new parameters --cmk-secret-config and --custom-secret-config to support DataSync-managed and customer-managed secrets for accessing storage locations, along with detailed documentation for these parameters.

Security assessment

The change introduces new configuration options for managing secrets (passwords/credentials) used by DataSync to access storage locations. It adds documentation about using Secrets Manager and KMS keys for encryption, which are security features. However, there's no evidence this addresses a specific security vulnerability or incident; it appears to be a feature enhancement for better secret management.

Diff

diff --git a/cli/latest/reference/datasync/update-location-fsx-windows.md b/cli/latest/reference/datasync/update-location-fsx-windows.md
index b99fa8855..6f26654f3 100644
--- a//cli/latest/reference/datasync/update-location-fsx-windows.md
+++ b//cli/latest/reference/datasync/update-location-fsx-windows.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.8 Command Reference](../../index.html) »
@@ -73,0 +74,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/datasy
+    [--cmk-secret-config <value>]
+    [--custom-secret-config <value>]
@@ -157,0 +160,82 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/datasy
+`--cmk-secret-config` (structure)
+
+> Specifies configuration information for a DataSync-managed secret, such as a `Password` or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed KMS key.
+> 
+> SecretArn -> (string)
+>
+>> Specifies the ARN for the DataSync-managed Secrets Manager secret that that is used to access a specific storage location. This property is generated by DataSync and is read-only. DataSync encrypts this secret with the KMS key that you specify for `KmsKeyArn` .
+>> 
+>> Constraints:
+>> 
+>>   * max: `2048`
+>>   * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):secretsmanager:[a-z\-0-9]+:[0-9]{12}:secret:.*|)$`
+>> 
+
+> 
+> KmsKeyArn -> (string)
+>
+>> Specifies the ARN for the customer-managed KMS key that DataSync uses to encrypt the DataSync-managed secret stored for `SecretArn` . DataSync provides this key to Secrets Manager.
+>> 
+>> Constraints:
+>> 
+>>   * max: `2048`
+>>   * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):kms:[a-z\-0-9]+:[0-9]{12}:key/.*|)$`
+>> 
+
+
+Shorthand Syntax:
+    
+    
+    SecretArn=string,KmsKeyArn=string
+    
+
+JSON Syntax:
+    
+    
+    {
+      "SecretArn": "string",
+      "KmsKeyArn": "string"
+    }
+    
+
+`--custom-secret-config` (structure)
+
+> Specifies configuration information for a customer-managed secret, such as a `Password` or set of credentials that DataSync uses to access a specific transfer location, and a customer-managed Identity and Access Management (IAM) role that provides access to the secret.
+> 
+> SecretArn -> (string)
+>
+>> Specifies the ARN for an Secrets Manager secret.
+>> 
+>> Constraints:
+>> 
+>>   * max: `2048`
+>>   * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):secretsmanager:[a-z\-0-9]+:[0-9]{12}:secret:.*|)$`
+>> 
+
+> 
+> SecretAccessRoleArn -> (string)
+>
+>> Specifies the ARN for the Identity and Access Management role that DataSync uses to access the secret specified for `SecretArn` .
+>> 
+>> Constraints:
+>> 
+>>   * max: `2048`
+>>   * pattern: `^(arn:(aws|aws-cn|aws-us-gov|aws-eusc|aws-iso|aws-iso-b):iam::[0-9]{12}:role/[a-zA-Z0-9+=,.@_-]+|)$`
+>> 
+
+
+Shorthand Syntax:
+    
+    
+    SecretArn=string,SecretAccessRoleArn=string
+    
+
+JSON Syntax:
+    
+    
+    {
+      "SecretArn": "string",
+      "SecretAccessRoleArn": "string"
+    }
+    
+
@@ -283 +367 @@ None
-  * [AWS CLI 2.34.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.8 Command Reference](../../index.html) »