AWS cli documentation change

Service: cli · 2026-03-22 · Documentation medium

File: cli/latest/reference/opensearch/update-direct-query-data-source.md

Summary

Added Prometheus as a supported data source type for direct queries, updated CLI version references, and modified --open-search-arns parameter documentation

Security assessment

The change adds documentation for Prometheus data source configuration requiring IAM role permissions (RoleArn with strict pattern constraints). While this relates to security configuration (IAM roles), there is no evidence of addressing a specific security vulnerability.

Diff

diff --git a/cli/latest/reference/opensearch/update-direct-query-data-source.md b/cli/latest/reference/opensearch/update-direct-query-data-source.md
index 038dd3936..13540e421 100644
--- a//cli/latest/reference/opensearch/update-direct-query-data-source.md
+++ b//cli/latest/reference/opensearch/update-direct-query-data-source.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.12 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.14 Command Reference](../../index.html) »
@@ -70 +70 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/opense
-    --open-search-arns <value>
+    [--open-search-arns <value>]
@@ -115 +115 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/opense
-> This is a Tagged Union structure. Only one of the following top level keys can be set: `CloudWatchLog`, `SecurityLake`.
+> This is a Tagged Union structure. Only one of the following top level keys can be set: `CloudWatchLog`, `SecurityLake`, `Prometheus`.
@@ -147,0 +148,26 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/opense
+> 
+> Prometheus -> (structure)
+>
+>> Specifies Prometheus as a type of data source for direct queries.
+>> 
+>> RoleArn -> (string) [required]
+>>
+>>> The unique identifier of the IAM role that grants OpenSearch Service permission to access the specified data source.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `32`
+>>>   * max: `200`
+>>>   * pattern: `^arn:aws[a-zA-Z-]*:iam::\d{12}:role(\/service-role)?\/[A-Za-z0-9+=,.@\-_]{1,64}$`
+>>> 
+
+>> 
+>> WorkspaceArn -> (string) [required]
+>>
+>>> The unique identifier of the Amazon Managed Prometheus Workspace that is associated with the specified data source.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * pattern: `^arn:aws[a-zA-Z-]*:aps:[a-z0-9-]+:[0-9]{12}:workspace\/ws-[a-z0-9-]*$`
+>>> 
+
@@ -152 +178 @@ Shorthand Syntax:
-    CloudWatchLog={RoleArn=string},SecurityLake={RoleArn=string}
+    CloudWatchLog={RoleArn=string},SecurityLake={RoleArn=string},Prometheus={RoleArn=string,WorkspaceArn=string}
@@ -163,0 +190,4 @@ JSON Syntax:
+      },
+      "Prometheus": {
+        "RoleArn": "string",
+        "WorkspaceArn": "string"
@@ -179 +209 @@ JSON Syntax:
-`--open-search-arns` (list) [required]
+`--open-search-arns` (list)
@@ -181 +211 @@ JSON Syntax:
-> A list of Amazon Resource Names (ARNs) for the OpenSearch collections that are associated with the direct query data source.
+> An optional list of Amazon Resource Names (ARNs) for the OpenSearch collections that are associated with the direct query data source. This field is required for CloudWatchLogs and SecurityLake datasource types.
@@ -340 +370 @@ DataSourceArn -> (string)
-  * [AWS CLI 2.34.12 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.14 Command Reference](../../index.html) »