AWS cli medium security documentation change
Summary
Updated encryption documentation: Clarified encryption-at-rest behavior, added StorageEncryptionType field, and added Durability/EffectiveDurability fields
Security assessment
The changes explicitly document encryption-at-rest behavior and introduce new security-related fields (StorageEncryptionType, Durability). The clarification that encryption may be enabled even when AtRestEncryptionEnabled=false indicates potential security implications. Added documentation about encryption types (sse-elasticache, sse-kms) enhances security transparency.
Diff
diff --git a/cli/latest/reference/elasticache/test-migration.md b/cli/latest/reference/elasticache/test-migration.md index b78ca7799..ad60a455c 100644 --- a//cli/latest/reference/elasticache/test-migration.md +++ b//cli/latest/reference/elasticache/test-migration.md @@ -15 +15 @@ - * [AWS CLI 2.34.57 Command Reference](../../index.html) » + * [AWS CLI 2.34.61 Command Reference](../../index.html) » @@ -613 +613 @@ ReplicationGroup -> (structure) ->> A flag that enables encryption at-rest when set to `true` . +>> A flag that enables encryption at-rest on the cluster when set to `true` . In some cases, encryption at-rest may be enabled even when this value is false. Use `StorageEncryptionType` to view the effective encryption state of a cluster. @@ -615 +615 @@ ReplicationGroup -> (structure) ->> You cannot modify the value of `AtRestEncryptionEnabled` after the cluster is created. To enable encryption at-rest on a cluster you must set `AtRestEncryptionEnabled` to `true` when you create a cluster. +>> You cannot modify the value of `AtRestEncryptionEnabled` after the cluster is created. @@ -617,3 +617 @@ ReplicationGroup -> (structure) ->>> **Required:** Only available when creating a replication group in an Amazon VPC using Redis OSS version `3.2.6` , `4.x` or later. ->> ->> Default: `false` +>> Default: `true` when using Valkey, `false` when using Redis OSS @@ -629,0 +628,12 @@ ReplicationGroup -> (structure) +> +> StorageEncryptionType -> (string) +> +>> Indicates the type of encryption for data stored at rest in the replication group. The value is `none` if at-rest encryption is not enabled, `sse-elasticache` if an ElastiCache service-managed key is used, or `sse-kms` if a customer-managed KMS key is used. +>> +>> Possible values: +>> +>> * `none` +>> * `sse-elasticache` +>> * `sse-kms` +>> + @@ -794,0 +805,25 @@ ReplicationGroup -> (structure) +> +> Durability -> (string) +> +>> The durability setting of the replication group. For more information, see [Durability](http://docs.aws.amazon.com/AmazonElastiCache/latest/dg/Durability.html) . +>> +>> Possible values: +>> +>> * `default` +>> * `async` +>> * `sync` +>> * `disabled` +>> + +> +> EffectiveDurability -> (string) +> +>> The effective durability of the replication group. When `Durability` is set to `default` , the service resolves the actual durability based on the engine version, cluster mode, and other parameters. This field reflects the resolved value. For more information, see [Configuring Durability](http://docs.aws.amazon.com/AmazonElastiCache/latest/dg/ConfiguringDurability.html) . +>> +>> Possible values: +>> +>> * `async` +>> * `sync` +>> * `disabled` +>> + @@ -806 +841 @@ ReplicationGroup -> (structure) - * [AWS CLI 2.34.57 Command Reference](../../index.html) » + * [AWS CLI 2.34.61 Command Reference](../../index.html) »