AWS AWSCloudFormation medium security documentation change
Summary
Updated documentation for RouterSettings properties: clarified usage for MEDIACONNECT_ROUTER inputs, added requirements for Destinations and EncryptionType, and specified conditional requirement for SecretArn based on encryption type.
Security assessment
The changes explicitly document encryption options (AUTOMATIC vs SECRETS_MANAGER) and clarify that SecretArn must be provided when using customer-managed keys via Secrets Manager. This addresses secure key management practices by distinguishing between service-managed and customer-managed encryption keys, which is a critical security control.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-medialive-input-routersettings.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-medialive-input-routersettings.md index 3fdda3f1e..af9279dac 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-medialive-input-routersettings.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-medialive-input-routersettings.md @@ -11 +11,3 @@ This is the new _CloudFormation Template Reference Guide_. Please update your bo -The `RouterSettings` property type specifies Property description not available. for an [AWS::MediaLive::Input](./aws-resource-medialive-input.html). +Settings that apply only if the input is a MEDIACONNECT_ROUTER type of input. + +The parent of this entity is Input. @@ -41 +43 @@ To declare this entity in your CloudFormation template, use the following syntax -Property description not available. +The destinations for the input from MediaConnect Router. Specify one destination for a single-pipeline input, or two destinations for a standard (redundant) input. This property is required. @@ -52 +54 @@ _Required_ : No -Property description not available. +The type of encryption for the MediaConnect router input. Specify `AUTOMATIC` to use a service-managed encryption key, or `SECRETS_MANAGER` to supply your own AES-256 encryption key via AWS Secrets Manager. This property is required. @@ -63 +65 @@ _Required_ : No -Property description not available. +The ARN of the secret in AWS Secrets Manager that is used to encrypt the MediaConnect router input. This property is required when `EncryptionType` is `SECRETS_MANAGER`, and must not be specified when `EncryptionType` is `AUTOMATIC`. @@ -65 +67 @@ Property description not available. -_Required_ : No +_Required_ : Conditional