AWS datasync documentation change

Service: datasync · 2026-03-19 · Documentation low

File: datasync/latest/userguide/API_DescribeLocationHdfs.md

Summary

Added documentation for Kerberos secret management configurations including CmkSecretConfig/CustomSecretConfig/ManagedSecretConfig

Security assessment

Expands documentation about encryption and access control for Kerberos credentials using KMS and IAM roles. Adds security feature documentation without evidence of vulnerability remediation.

Diff

diff --git a/datasync/latest/userguide/API_DescribeLocationHdfs.md b/datasync/latest/userguide/API_DescribeLocationHdfs.md
index d9ffe2eaf..1a3d8e127 100644
--- a//datasync/latest/userguide/API_DescribeLocationHdfs.md
+++ b//datasync/latest/userguide/API_DescribeLocationHdfs.md
@@ -43,0 +44,4 @@ Required: Yes
+       "CmkSecretConfig": { 
+          "[KmsKeyArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-KmsKeyArn)": "**_string_** ",
+          "[SecretArn](./API_CmkSecretConfig.html#DataSync-Type-CmkSecretConfig-SecretArn)": "**_string_** "
+       },
@@ -44,0 +49,4 @@ Required: Yes
+       "CustomSecretConfig": { 
+          "[SecretAccessRoleArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretAccessRoleArn)": "**_string_** ",
+          "[SecretArn](./API_CustomSecretConfig.html#DataSync-Type-CustomSecretConfig-SecretArn)": "**_string_** "
+       },
@@ -48,0 +57,3 @@ Required: Yes
+       "ManagedSecretConfig": { 
+          "[SecretArn](./API_ManagedSecretConfig.html#DataSync-Type-ManagedSecretConfig-SecretArn)": "**_string_** "
+       },
@@ -99,0 +111,7 @@ Valid Range: Minimum value of 1048576. Maximum value of 1073741824.
+**CmkSecretConfig **
+    
+
+Describes configuration information for a DataSync-managed secret, such as a `KerberosKeytab` that DataSync uses to access a specific storage location, with a customer-managed AWS KMS key.
+
+Type: [CmkSecretConfig](./API_CmkSecretConfig.html) object
+
@@ -106,0 +125,7 @@ Type: Timestamp
+**CustomSecretConfig **
+    
+
+Describes configuration information for a customer-managed secret, such as a `KerberosKeytab` that DataSync uses to access a specific storage location, with a customer-managed AWS Identity and Access Management (IAM) role that provides access to the secret.
+
+Type: [CustomSecretConfig](./API_CustomSecretConfig.html) object
+
@@ -150,0 +176,7 @@ Pattern: `^(efs|nfs|s3|smb|hdfs|fsx[a-z0-9-]+)://[a-zA-Z0-9.:/\-]+$`
+**ManagedSecretConfig **
+    
+
+Describes configuration information for a DataSync-managed secret, such as a `KerberosKeytab` that DataSync uses to access a specific storage location. DataSync uses the default AWS-managed KMS key to encrypt this secret in AWS Secrets Manager.
+
+Type: [ManagedSecretConfig](./API_ManagedSecretConfig.html) object
+