AWS datasync documentation change
Summary
Updated SMB protocol configuration parameters, added new secret management configurations (CmkSecretConfig, CustomSecretConfig, ManagedSecretConfig), modified user/password fields, and added validation pattern constraints.
Security assessment
The changes introduce documentation for managed/customer-managed secret configurations using KMS and Secrets Manager, which are security features. The password pattern was tightened to restrict certain characters (e.g., quotes, brackets), improving input validation but without explicit mention of a specific vulnerability being patched.
Diff
diff --git a/datasync/latest/userguide/API_FsxProtocolSmb.md b/datasync/latest/userguide/API_FsxProtocolSmb.md index b53a53949..bc3a3f39a 100644 --- a//datasync/latest/userguide/API_FsxProtocolSmb.md +++ b//datasync/latest/userguide/API_FsxProtocolSmb.md @@ -13 +13 @@ Specifies the Server Message Block (SMB) protocol configuration that AWS DataSyn -**Password** +**User** @@ -16 +16,3 @@ Specifies the Server Message Block (SMB) protocol configuration that AWS DataSyn -Specifies the password of a user who has permission to access your SVM. +Specifies a user that can mount and access the files, folders, and metadata in your SVM. + +For information about choosing a user with the right level of access for your transfer, see [Using the SMB protocol](https://docs.aws.amazon.com/datasync/latest/userguide/create-ontap-location.html#create-ontap-location-smb). @@ -22 +24 @@ Length Constraints: Maximum length of 104. -Pattern: `^.{0,104}$` +Pattern: `^[^\x22\x5B\x5D/\\:;|=,+*?\x3C\x3E]{1,104}$` @@ -26 +28 @@ Required: Yes -**User** +**CmkSecretConfig** @@ -29 +31 @@ Required: Yes -Specifies a user that can mount and access the files, folders, and metadata in your SVM. +Specifies configuration information for a DataSync-managed secret, which includes the password that DataSync uses to access a specific FSx for ONTAP storage location (using SMB), with a customer-managed AWS KMS key. @@ -31 +33 @@ Specifies a user that can mount and access the files, folders, and metadata in y -For information about choosing a user with the right level of access for your transfer, see [Using the SMB protocol](https://docs.aws.amazon.com/datasync/latest/userguide/create-ontap-location.html#create-ontap-location-smb). +When you include this parameter as part of a `CreateLocationFsxOntap` request, you provide only the KMS key ARN. DataSync uses this KMS key together with the `Password` you specify for to create a DataSync-managed secret to store the location access credentials. @@ -33 +35 @@ For information about choosing a user with the right level of access for your tr -Type: String +Make sure that DataSync has permission to access the KMS key that you specify. For more information, see [ Using a service-managed secret encrypted with a custom AWS KMS key](https://docs.aws.amazon.com/datasync/latest/userguide/location-credentials.html#service-secret-custom-key). @@ -35 +37 @@ Type: String -Length Constraints: Maximum length of 104. +###### Note @@ -37 +39 @@ Length Constraints: Maximum length of 104. -Pattern: `^[^\x22\x5B\x5D/\\:;|=,+*?\x3C\x3E]{1,104}$` +You can use either `CmkSecretConfig` (with `Password`) or `CustomSecretConfig` (without `Password`) to provide credentials for a `CreateLocationFsxOntap` request. Do not provide both parameters for the same request. @@ -39 +41,16 @@ Pattern: `^[^\x22\x5B\x5D/\\:;|=,+*?\x3C\x3E]{1,104}$` -Required: Yes +Type: [CmkSecretConfig](./API_CmkSecretConfig.html) object + +Required: No + +**CustomSecretConfig** + + +Specifies configuration information for a customer-managed Secrets Manager secret where the password for an FSx for ONTAP storage location (using SMB) is stored in plain text, in Secrets Manager. This configuration includes the secret ARN, and the ARN for an IAM role that provides access to the secret. For more information, see [ Using a secret that you manage](https://docs.aws.amazon.com/datasync/latest/userguide/location-credentials.html#custom-secret-custom-key). + +###### Note + +You can use either `CmkSecretConfig` (with `Password`) or `CustomSecretConfig` (without `Password`) to provide credentials for a `CreateLocationFsxOntap` request. Do not provide both parameters for the same request. + +Type: [CustomSecretConfig](./API_CustomSecretConfig.html) object + +Required: No @@ -57,0 +75,13 @@ Required: No +**ManagedSecretConfig** + + +Describes configuration information for a DataSync-managed secret, such as a `Password` that DataSync uses to access a specific storage location. DataSync uses the default AWS-managed KMS key to encrypt this secret in AWS Secrets Manager. + +###### Note + +Do not provide this for a `CreateLocation` request. `ManagedSecretConfig` is a ReadOnly property and is only be populated in the `DescribeLocation` response. + +Type: [ManagedSecretConfig](./API_ManagedSecretConfig.html) object + +Required: No + @@ -66,0 +97,13 @@ Required: No +**Password** + + +Specifies the password of a user who has permission to access your SVM. + +Type: String + +Length Constraints: Maximum length of 104. + +Pattern: `^.{0,104}$` + +Required: No +