AWS cli documentation change
Summary
Added documentation for new parameters --enable-vpc-networking and --enable-internet-access-gateway, and corresponding output fields VPCNetworkingEnabled and InternetAccessGatewayEnabled. The parameters allow restoring an Aurora PostgreSQL cluster without VPC networking and with internet-based connectivity, requiring IAM database authentication.
Security assessment
The change introduces new configuration options that have security implications (internet access without VPC, but with mandatory IAM authentication). However, there is no evidence of a security issue being fixed; it's a new feature. The documentation now includes security requirements (IAM database authentication) for the new configuration.
Diff
diff --git a/cli/latest/reference/rds/restore-db-cluster-from-snapshot.md b/cli/latest/reference/rds/restore-db-cluster-from-snapshot.md index 7255374fe..8f5508a3b 100644 --- a//cli/latest/reference/rds/restore-db-cluster-from-snapshot.md +++ b//cli/latest/reference/rds/restore-db-cluster-from-snapshot.md @@ -15 +15 @@ - * [AWS CLI 2.34.14 Command Reference](../../index.html) » + * [AWS CLI 2.34.16 Command Reference](../../index.html) » @@ -63,0 +64,2 @@ The target DB cluster is created from the source snapshot with a default configu +You can use the `EnableVPCNetworking` and `EnableInternetAccessGateway` parameters together to restore an Aurora PostgreSQL cluster without VPC networking and with internet-based connectivity. These two parameters must always be specified together. Set `EnableVPCNetworking` to `false` to disable the VPC network interface (ENI) for the cluster. `EnableInternetAccessGateway` enables internet-based connectivity through an internet access gateway. IAM database authentication is required and must be enabled using `EnableIAMDatabaseAuthentication` . Once the cluster is restored, you need to modify the DB cluster to update `MasterUserAuthenticationType` to `iam-db-auth` . + @@ -115,0 +118,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rds-20 + [--enable-vpc-networking | --no-enable-vpc-networking] + [--enable-internet-access-gateway | --no-enable-internet-access-gateway] @@ -832,0 +837,16 @@ JSON Syntax: +`--enable-vpc-networking` | `--no-enable-vpc-networking` (boolean) + +> Specifies whether to enable VPC networking for the restored DB cluster. Set this parameter to `false` to create a cluster without the VPC network interface (ENI). +> +> This parameter must be used together with `EnableInternetAccessGateway` . When both parameters are specified, IAM database authentication is required. You must also specify `EnableIAMDatabaseAuthentication` . +> +> Valid for Cluster Type: Aurora PostgreSQL clusters + +`--enable-internet-access-gateway` | `--no-enable-internet-access-gateway` (boolean) + +> Specifies that the restored DB cluster should use internet-based connectivity through an internet access gateway. This allows clients to connect to the cluster over the internet without requiring a VPC. +> +> This parameter must be used together with `EnableVPCNetworking` set to `false` . When both parameters are specified, IAM database authentication is required. You must also specify `EnableIAMDatabaseAuthentication` . +> +> Valid for Cluster Type: Aurora PostgreSQL clusters + @@ -1884,0 +1905,12 @@ DBCluster -> (structure) +> +> VPCNetworkingEnabled -> (boolean) +> +>> Indicates whether the DB cluster uses VPC-based networking. +>> +>> This setting is applicable only for Aurora PostgreSQL clusters created through express configuration. +> +> InternetAccessGatewayEnabled -> (boolean) +> +>> Indicates whether the DB cluster has internet-based connectivity enabled through an internet access gateway. +>> +>> This setting is applicable only for Aurora PostgreSQL clusters created through express configuration. @@ -1896 +1928 @@ DBCluster -> (structure) - * [AWS CLI 2.34.14 Command Reference](../../index.html) » + * [AWS CLI 2.34.16 Command Reference](../../index.html) »