AWS neptune medium security documentation change

Service: neptune · 2026-04-10 · Security-related medium

File: neptune/latest/userguide/opencypher-query-hints-qpc-hint.md

Summary

Added AWS CLI, SDK, awscurl, and secure curl examples for query plan cache hints, replacing insecure curl examples with proper authentication and endpoint configuration

Security assessment

The change removes the '-k' flag from curl examples and replaces generic endpoint placeholders with proper endpoint URLs. This addresses the same security weakness as the first file by preventing SSL verification bypass. The addition of AWS authentication methods (CLI, SDK, awscurl) promotes secure access patterns instead of potentially insecure direct curl calls without proper authentication.

Diff

diff --git a/neptune/latest/userguide/opencypher-query-hints-qpc-hint.md b/neptune/latest/userguide/opencypher-query-hints-qpc-hint.md
index e50553514..bbe65ec09 100644
--- a//neptune/latest/userguide/opencypher-query-hints-qpc-hint.md
+++ b//neptune/latest/userguide/opencypher-query-hints-qpc-hint.md
@@ -8,0 +9,39 @@ Query plan cache behavior can be overridden on a per-query (parameterized or not
+AWS CLI
+    
+
+Forcing plan to be cached or reused:
+    
+    
+    aws neptunedata execute-open-cypher-query \
+      --endpoint-url https://your-neptune-endpoint:port \
+      --open-cypher-query "Using QUERY:PLANCACHE \"enabled\" MATCH(n) RETURN n LIMIT 1"
+
+With parameters:
+    
+    
+    aws neptunedata execute-open-cypher-query \
+      --endpoint-url https://your-neptune-endpoint:port \
+      --open-cypher-query "Using QUERY:PLANCACHE \"enabled\" RETURN \$arg" \
+      --parameters '{"arg": 123}'
+
+Forcing plan to be neither cached nor reused:
+    
+    
+    aws neptunedata execute-open-cypher-query \
+      --endpoint-url https://your-neptune-endpoint:port \
+      --open-cypher-query "Using QUERY:PLANCACHE \"disabled\" MATCH(n) RETURN n LIMIT 1"
+
+For more information, see [execute-open-cypher-query](https://docs.aws.amazon.com/cli/latest/reference/neptunedata/execute-open-cypher-query.html) in the AWS CLI Command Reference.
+
+SDK
+    
+    
+    
+    import boto3
+    from botocore.config import Config
+    
+    client = boto3.client(
+        'neptunedata',
+        endpoint_url='https://your-neptune-endpoint:port',
+        config=Config(read_timeout=None, retries={'total_max_attempts': 1})
+    )
@@ -11 +50,18 @@ Query plan cache behavior can be overridden on a per-query (parameterized or not
-    % curl -k https://<endpoint>:<port>/opencypher \
+    response = client.execute_open_cypher_query(
+        openCypherQuery='Using QUERY:PLANCACHE "enabled" MATCH(n) RETURN n LIMIT 1'
+    )
+    
+    print(response['results'])
+
+For AWS SDK examples in other languages, see [AWS SDK](./access-graph-opencypher-sdk.html).
+
+awscurl
+    
+
+Forcing plan to be cached or reused:
+    
+    
+    awscurl https://your-neptune-endpoint:port/openCypher \
+      --region us-east-1 \
+      --service neptune-db \
+      -X POST \
@@ -14 +70,17 @@ Query plan cache behavior can be overridden on a per-query (parameterized or not
-    % curl -k https://<endpoint>:<port>/opencypher \
+###### Note
+
+This example assumes that your AWS credentials are configured in your environment. Replace `us-east-1` with the Region of your Neptune cluster.
+
+curl
+    
+
+Forcing plan to be cached or reused:
+    
+    
+    curl https://your-neptune-endpoint:port/openCypher \
+      -d "query=Using QUERY:PLANCACHE \"enabled\" MATCH(n) RETURN n LIMIT 1"
+
+With parameters:
+    
+    
+    curl https://your-neptune-endpoint:port/openCypher \
@@ -18,2 +90,4 @@ Query plan cache behavior can be overridden on a per-query (parameterized or not
-    # Forcing plan to be neither cached nor reused
-    % curl -k https://<endpoint>:<port>/opencypher \
+Forcing plan to be neither cached nor reused:
+    
+    
+    curl https://your-neptune-endpoint:port/openCypher \