AWS cli documentation change
Summary
Updated AWS CLI version from 2.34.32 to 2.34.34 and added support for Apache Kafka clusters as source/target with detailed authentication, encryption, and log delivery configurations
Security assessment
The changes add comprehensive documentation for security features including SASL/SCRAM authentication with SHA256/SHA512 mechanisms, TLS encryption in transit, and root CA certificate configuration for Apache Kafka clusters. These are security feature enhancements rather than fixes for specific vulnerabilities. The documentation now includes detailed security configuration options for client authentication and encryption, which improves security posture but doesn't address a specific security incident.
Diff
diff --git a/cli/latest/reference/kafka/create-replicator.md b/cli/latest/reference/kafka/create-replicator.md index 36c344754..8b05ace14 100644 --- a//cli/latest/reference/kafka/create-replicator.md +++ b//cli/latest/reference/kafka/create-replicator.md @@ -15 +15 @@ - * [AWS CLI 2.34.32 Command Reference](../../index.html) » + * [AWS CLI 2.34.34 Command Reference](../../index.html) » @@ -72,0 +73 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/kafka- + [--log-delivery <value>] @@ -116 +117 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/kafka- ->> AmazonMskCluster -> (structure) [required] +>> AmazonMskCluster -> (structure) @@ -124 +125,13 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/kafka- ->> VpcConfig -> (structure) [required] +>> ApacheKafkaCluster -> (structure) +>> +>>> Details of an Apache Kafka Cluster. +>>> +>>> ApacheKafkaClusterId -> (string) [required] +>>> +>>>> The ID of the Apache Kafka cluster. +>>> +>>> BootstrapBrokerString -> (string) [required] +>>> +>>>> The bootstrap broker string of the Apache Kafka cluster. +>> +>> VpcConfig -> (structure) @@ -138,0 +152,41 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/kafka- +>> +>> ClientAuthentication -> (structure) +>> +>>> Details of the client authentication used by the Apache Kafka cluster. +>>> +>>> SaslScram -> (structure) [required] +>>> +>>>> Details for SASL/SCRAM client authentication. +>>>> +>>>> Mechanism -> (string) [required] +>>>> +>>>>> The SASL/SCRAM authentication mechanism. +>>>>> +>>>>> Possible values: +>>>>> +>>>>> * `SHA256` +>>>>> * `SHA512` +>>>>> + +>>>> +>>>> SecretArn -> (string) [required] +>>>> +>>>>> The Amazon Resource Name (ARN) of the Secrets Manager secret. +>> +>> EncryptionInTransit -> (structure) +>> +>>> Details of encryption in transit to the Apache Kafka cluster. +>>> +>>> EncryptionType -> (string) [required] +>>> +>>>> The type of encryption in transit to the Apache Kafka cluster. +>>>> +>>>> Possible values: +>>>> +>>>> * `TLS` +>>>> + +>>> +>>> RootCaCertificate -> (string) +>>> +>>>> The root CA certificate. @@ -143 +197 @@ Shorthand Syntax: - AmazonMskCluster={MskClusterArn=string},VpcConfig={SecurityGroupIds=[string,string],SubnetIds=[string,string]} ... + AmazonMskCluster={MskClusterArn=string},ApacheKafkaCluster={ApacheKafkaClusterId=string,BootstrapBrokerString=string},VpcConfig={SecurityGroupIds=[string,string],SubnetIds=[string,string]},ClientAuthentication={SaslScram={Mechanism=string,SecretArn=string}},EncryptionInTransit={EncryptionType=string,RootCaCertificate=string} ... @@ -153,0 +208,4 @@ JSON Syntax: + "ApacheKafkaCluster": { + "ApacheKafkaClusterId": "string", + "BootstrapBrokerString": "string" + }, @@ -156,0 +215,10 @@ JSON Syntax: + }, + "ClientAuthentication": { + "SaslScram": { + "Mechanism": "SHA256"|"SHA512", + "SecretArn": "string" + } + }, + "EncryptionInTransit": { + "EncryptionType": "TLS", + "RootCaCertificate": "string" @@ -205,0 +274,11 @@ JSON Syntax: +>>> +>>> ConsumerGroupOffsetSyncMode -> (string) +>>> +>>>> The consumer group offset synchronization mode. With LEGACY, offsets are synchronized when producers write to the source cluster. With ENHANCED, consumer offsets are synchronized regardless of producer location. ENHANCED requires a corresponding replicator that replicates data from the target cluster to the source cluster. +>>>> +>>>> Possible values: +>>>> +>>>> * `LEGACY` +>>>> * `ENHANCED` +>>>> + @@ -207 +286 @@ JSON Syntax: ->> SourceKafkaClusterArn -> (string) [required] +>> SourceKafkaClusterArn -> (string) @@ -210,0 +290,4 @@ JSON Syntax: +>> SourceKafkaClusterId -> (string) +>> +>>> The ID of the source Kafka cluster. +>> @@ -225 +308 @@ JSON Syntax: ->> TargetKafkaClusterArn -> (string) [required] +>> TargetKafkaClusterArn -> (string) @@ -228,0 +312,4 @@ JSON Syntax: +>> TargetKafkaClusterId -> (string) +>> +>>> The ID of the target Kafka cluster. +>> @@ -302 +389 @@ Shorthand Syntax: - ConsumerGroupReplication={ConsumerGroupsToExclude=[string,string],ConsumerGroupsToReplicate=[string,string],DetectAndCopyNewConsumerGroups=boolean,SynchroniseConsumerGroupOffsets=boolean},SourceKafkaClusterArn=string,TargetCompressionType=string,TargetKafkaClusterArn=string,TopicReplication={CopyAccessControlListsForTopics=boolean,CopyTopicConfigurations=boolean,DetectAndCopyNewTopics=boolean,StartingPosition={Type=string},TopicNameConfiguration={Type=string},TopicsToExclude=[string,string],TopicsToReplicate=[string,string]} ... + ConsumerGroupReplication={ConsumerGroupsToExclude=[string,string],ConsumerGroupsToReplicate=[string,string],DetectAndCopyNewConsumerGroups=boolean,SynchroniseConsumerGroupOffsets=boolean,ConsumerGroupOffsetSyncMode=string},SourceKafkaClusterArn=string,SourceKafkaClusterId=string,TargetCompressionType=string,TargetKafkaClusterArn=string,TargetKafkaClusterId=string,TopicReplication={CopyAccessControlListsForTopics=boolean,CopyTopicConfigurations=boolean,DetectAndCopyNewTopics=boolean,StartingPosition={Type=string},TopicNameConfiguration={Type=string},TopicsToExclude=[string,string],TopicsToReplicate=[string,string]} ... @@ -314 +401,2 @@ JSON Syntax: - "SynchroniseConsumerGroupOffsets": true|false + "SynchroniseConsumerGroupOffsets": true|false, + "ConsumerGroupOffsetSyncMode": "LEGACY"|"ENHANCED" @@ -316,0 +405 @@ JSON Syntax: + "SourceKafkaClusterId": "string", @@ -318,0 +408 @@ JSON Syntax: + "TargetKafkaClusterId": "string", @@ -373,0 +464,76 @@ JSON Syntax: +`--log-delivery` (structure) + +> Configuration for delivering replicator logs to customer destinations. +> +> ReplicatorLogDelivery -> (structure) +> +>> Configuration for replicator log delivery. +>> +>> CloudWatchLogs -> (structure) +>> +>>> Configuration for CloudWatch Logs delivery. +>>> +>>> Enabled -> (boolean) [required] +>>> +>>>> Whether log delivery to CloudWatch Logs is enabled. +>>> +>>> LogGroup -> (string) +>>> +>>>> The CloudWatch log group that is the destination for log delivery. +>> +>> Firehose -> (structure) +>> +>>> Configuration for Firehose delivery. +>>> +>>> Enabled -> (boolean) [required] +>>> +>>>> Whether log delivery to Firehose is enabled. +>>> +>>> DeliveryStream -> (string) +>>> +>>>> The Firehose delivery stream that is the destination for log delivery. +>> +>> S3 -> (structure) +>> +>>> Configuration for S3 delivery. +>>> +>>> Enabled -> (boolean) [required] +>>> +>>>> Whether log delivery to S3 is enabled. +>>> +>>> Bucket -> (string) +>>> +>>>> The S3 bucket that is the destination for log delivery. +>>> +>>> Prefix -> (string) +>>> +>>>> The S3 prefix that is the destination for log delivery. + +Shorthand Syntax: + + + ReplicatorLogDelivery={CloudWatchLogs={Enabled=boolean,LogGroup=string},Firehose={Enabled=boolean,DeliveryStream=string},S3={Enabled=boolean,Bucket=string,Prefix=string}} + + +JSON Syntax: + + + { + "ReplicatorLogDelivery": { + "CloudWatchLogs": { + "Enabled": true|false, + "LogGroup": "string" + }, + "Firehose": { + "Enabled": true|false, + "DeliveryStream": "string" + }, + "S3": { + "Enabled": true|false, + "Bucket": "string", + "Prefix": "string" + }