AWS cli documentation change
Summary
Added hard deletion mode option with security warning about eventual consistency
Security assessment
Added documentation about a potential security consideration (eventual consistency) when using hard deletion mode, but doesn't fix a specific vulnerability.
Diff
diff --git a/cli/latest/reference/verifiedpermissions/delete-policy-store-alias.md b/cli/latest/reference/verifiedpermissions/delete-policy-store-alias.md index 7e2a9ab32..1c913d1cc 100644 --- a//cli/latest/reference/verifiedpermissions/delete-policy-store-alias.md +++ b//cli/latest/reference/verifiedpermissions/delete-policy-store-alias.md @@ -15 +15 @@ - * [AWS CLI 2.34.49 Command Reference](../../index.html) » + * [AWS CLI 2.34.52 Command Reference](../../index.html) » @@ -63 +63,7 @@ This operation is idempotent. If you specify a policy store alias that does not -When a policy store alias is deleted, it enters the `PendingDeletion` state. When a policy store alias is in the `PendingDeletion` state, new policy store aliases cannot be created with the same name. If the policy store alias is used in an API that has a `policyStoreId` field, the operation will fail with a `ResourceNotFound` exception. +By default, when a policy store alias is deleted, it enters the `PendingDeletion` state. When a policy store alias is in the `PendingDeletion` state, new policy store aliases cannot be created with the same name. If the policy store alias is used in an API that has a `policyStoreId` field, the operation will fail with a `ResourceNotFound` exception. + +To immediately delete a policy store alias and bypass the `PendingDeletion` state, set the `deletionMode` parameter to `HardDelete` . + +### Warning + +Verified Permissions is eventually consistent. If you hard delete a policy store alias and then immediately recreate it to be associated with a different policy store, requests that reference this alias may continue to be evaluated against the previously associated policy store for a short period of time. @@ -71,0 +78 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/verifi + [--deletion-mode <value>] @@ -112,0 +120,16 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/verifi +`--deletion-mode` (string) + +> Specifies the deletion mode for the policy store alias. The valid values are: +> +> * **SoftDelete** – The policy store alias enters the `PendingDeletion` state. This is the default behavior when no `deletionMode` is specified. +> * **HardDelete** – The policy store alias is immediately deleted, bypassing the `PendingDeletion` state. +> + +> +> Possible values: +> +> * `SoftDelete` +> * `HardDelete` +> + + @@ -238 +261 @@ None - * [AWS CLI 2.34.49 Command Reference](../../index.html) » + * [AWS CLI 2.34.52 Command Reference](../../index.html) »