AWS Security ChangesHomeSearch

AWS cli medium security documentation change

Service: cli · 2026-05-01 · Security-related medium

File: cli/latest/reference/account/accept-primary-email-update.md

Summary

1. Updated AWS CLI version reference 2. Modified account ID pattern validation 3. Swapped parameter order and constraints for --otp and --primary-email 4. Relaxed OTP pattern validation

Security assessment

The OTP pattern was changed from strict '^[a-zA-Z0-9]{6}$' to more lenient '[a-zA-Z0-9]{6}', potentially allowing weaker input validation. Account ID pattern was also relaxed from '^\d{12}$' to '\d{12}', which could permit invalid account IDs. These changes weaken input validation specifications.

Diff

diff --git a/cli/latest/reference/account/accept-primary-email-update.md b/cli/latest/reference/account/accept-primary-email-update.md
index 2ad7f5752..36a41ceb6 100644
--- a//cli/latest/reference/account/accept-primary-email-update.md
+++ b//cli/latest/reference/account/accept-primary-email-update.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.38 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.40 Command Reference](../../index.html) »
@@ -68 +67,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/accoun
-    --otp <value>
@@ -69,0 +69 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/accoun
+    --otp <value>
@@ -107 +107 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/accoun
->   * pattern: `^\d{12}$`
+>   * pattern: `\d{12}`
@@ -111 +111 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/accoun
-`--otp` (string) [required]
+`--primary-email` (string) [required]
@@ -113 +113 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/accoun
-> The OTP code sent to the `PrimaryEmail` specified on the `StartPrimaryEmailUpdate` API call.
+> The new primary email address for use with the specified account. This must match the `PrimaryEmail` from the `StartPrimaryEmailUpdate` API call.
@@ -117 +117,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/accoun
->   * pattern: `^[a-zA-Z0-9]{6}$`
+>   * min: `5`
+>   * max: `64`
@@ -121 +122 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/accoun
-`--primary-email` (string) [required]
+`--otp` (string) [required]
@@ -123 +124 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/accoun
-> The new primary email address for use with the specified account. This must match the `PrimaryEmail` from the `StartPrimaryEmailUpdate` API call.
+> The OTP code sent to the `PrimaryEmail` specified on the `StartPrimaryEmailUpdate` API call.
@@ -127,2 +128 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/accoun
->   * min: `5`
->   * max: `64`
+>   * pattern: `[a-zA-Z0-9]{6}`
@@ -266 +266 @@ Status -> (string)
-  * [AWS CLI 2.34.38 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.40 Command Reference](../../index.html) »