AWS datasync documentation change
Summary
Added CmkSecretConfig and CustomSecretConfig parameters to allow storing FSx Windows location credentials in AWS Secrets Manager with customer-managed KMS keys or custom secrets, and changed Password field from required to optional.
Security assessment
This change introduces new secure credential management options (KMS-encrypted secrets and customer-managed secrets) but does not indicate a specific security vulnerability being fixed. It enhances security by providing more secure ways to handle credentials, but there's no evidence of a security incident being addressed.
Diff
diff --git a/datasync/latest/userguide/API_CreateLocationFsxWindows.md b/datasync/latest/userguide/API_CreateLocationFsxWindows.md index f18abae8b..3ac8ccfb5 100644 --- a//datasync/latest/userguide/API_CreateLocationFsxWindows.md +++ b//datasync/latest/userguide/API_CreateLocationFsxWindows.md @@ -16,0 +17,8 @@ Before you begin, make sure that you understand how DataSync [accesses FSx for W + "CmkSecretConfig": { + "[KmsKeyArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-KmsKeyArn)": "string", + "[SecretArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-SecretArn)": "string" + }, + "CustomSecretConfig": { + "[SecretAccessRoleArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretAccessRoleArn)": "string", + "[SecretArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretArn)": "string" + }, @@ -36,0 +45,30 @@ The request accepts the following data in JSON format. +**CmkSecretConfig ** + + +Specifies configuration information for a DataSync-managed secret, which includes the password that DataSync uses to access a specific FSx Windows storage location, with a customer-managed AWS KMS key. + +When you include this parameter as part of a `CreateLocationFsxWindows` request, you provide only the KMS key ARN. DataSync uses this KMS key together with the `Password` you specify for to create a DataSync-managed secret to store the location access credentials. + +Make sure that DataSync has permission to access the KMS key that you specify. For more information, see [ Using a service-managed secret encrypted with a custom AWS KMS key](https://docs.aws.amazon.com/datasync/latest/userguide/location-credentials.html#service-secret-custom-key). + +###### Note + +You can use either `CmkSecretConfig` (with `Password`) or `CustomSecretConfig` (without `Password`) to provide credentials for a `CreateLocationFsxWindows` request. Do not provide both parameters for the same request. + +Type: [CmkSecretConfig](./API_CmkSecretConfig.html) object + +Required: No + +**CustomSecretConfig ** + + +Specifies configuration information for a customer-managed Secrets Manager secret where the password for an FSx for Windows File Server storage location is stored in plain text, in Secrets Manager. This configuration includes the secret ARN, and the ARN for an IAM role that provides access to the secret. For more information, see [ Using a secret that you manage](https://docs.aws.amazon.com/datasync/latest/userguide/location-credentials.html#custom-secret-custom-key). + +###### Note + +You can use either `CmkSecretConfig` (with `Password`) or `CustomSecretConfig` (without `Password`) to provide credentials for a `CreateLocationFsxWindows` request. Do not provide both parameters for the same request. + +Type: [CustomSecretConfig](./API_CustomSecretConfig.html) object + +Required: No + @@ -76 +114 @@ Pattern: `^.{0,104}$` -Required: Yes +Required: No