AWS cli medium security documentation change
Summary
Added new options --kms-key-arn, --metrics-config, --logging-config, and --scaling-config with detailed documentation. Updated ARN patterns to support new regions, added constraints (min/max) for multiple fields, and expanded output parameters.
Security assessment
The --kms-key-arn option explicitly adds encryption for filter criteria using customer-managed KMS keys, addressing data-at-rest security. The --logging-config option enables debug logging for security monitoring. New FilterCriteriaError output helps diagnose encryption issues.
Diff
diff --git a/cli/latest/reference/lambda/create-event-source-mapping.md b/cli/latest/reference/lambda/create-event-source-mapping.md index fa75dba0c..917673f80 100644 --- a//cli/latest/reference/lambda/create-event-source-mapping.md +++ b//cli/latest/reference/lambda/create-event-source-mapping.md @@ -15 +15 @@ - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) » @@ -111,0 +112,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda + [--kms-key-arn <value>] + [--metrics-config <value>] + [--logging-config <value>] + [--scaling-config <value>] @@ -129 +132,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda - [--scaling-config <value>] @@ -131,3 +133,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda - [--kms-key-arn <value>] - [--metrics-config <value>] - [--logging-config <value>] @@ -175 +175,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda -> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:([a-z]{2}(-gov)?-[a-z]+-\d{1})?:(\d{12})?:(.*)` +> * min: `0` +> * max: `10000` +> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` @@ -198 +200 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda -> * pattern: `(arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:)?(\d{12}:)?(function:)?([a-zA-Z0-9-_\.]+)(:(\$LATEST(\.PUBLISHED)?|[a-zA-Z0-9-_]+))?` +> * pattern: `(arn:(aws[a-zA-Z-]*)?:lambda:)?((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:)?(\d{12}:)?(function:)?([a-zA-Z0-9-_\.]+)(:(\$LATEST(\.PUBLISHED)?|[a-zA-Z0-9-_]+))?` @@ -249 +251 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda ->>>> * pattern: `.*` +>>>> * pattern: `[\s\S]*` @@ -271,0 +274,118 @@ JSON Syntax: +`--kms-key-arn` (string) + +> The ARN of the Key Management Service (KMS) customer managed key that Lambda uses to encrypt your function’s [filter criteria](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-basics) . By default, Lambda does not encrypt your filter criteria object. Specify this property to encrypt data using your own customer managed key. +> +> Constraints: +> +> * min: `0` +> * max: `10000` +> * pattern: `(arn:(aws[a-zA-Z-]*)?:[a-z0-9-.]+:.*)|()` +> + + +`--metrics-config` (structure) + +> The metrics configuration for your event source. For more information, see [Event source mapping metrics](https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html#event-source-mapping-metrics) . +> +> Metrics -> (list) +> +>> The metrics you want your event source mapping to produce, including `EventCount` , `ErrorCount` , `KafkaMetrics` . +>> +>> * `EventCount` to receive metrics related to the number of events processed by your event source mapping. +>> * `ErrorCount` (Amazon MSK and self-managed Apache Kafka) to receive metrics related to the number of errors in your event source mapping processing. +>> * `KafkaMetrics` (Amazon MSK and self-managed Apache Kafka) to receive metrics related to the Kafka consumers from your event source mapping. +>> + +>> +>> For more information about these metrics, see [Event source mapping metrics](https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html#event-source-mapping-metrics) . +>> +>> Constraints: +>> +>> * min: `0` +>> * max: `3` +>> + +>> +>> (string) +>> +>>> Possible values: +>>> +>>> * `EventCount` +>>> * `ErrorCount` +>>> * `KafkaMetrics` +>>> + + +Shorthand Syntax: + + + Metrics=string,string + + +JSON Syntax: + + + { + "Metrics": ["EventCount"|"ErrorCount"|"KafkaMetrics", ...] + } + + +`--logging-config` (structure) + +> (Amazon MSK, and self-managed Apache Kafka only) The logging configuration for your event source. For more information, see [Event source mapping logging](https://docs.aws.amazon.com/lambda/latest/dg/esm-logging.html) . +> +> SystemLogLevel -> (string) +> +>> The log level you want your event source mapping to use. Lambda event poller only sends system logs at the selected level of detail and lower, where `DEBUG` is the highest level and `WARN` is the lowest. For more information about these metrics, see [Event source mapping logging](https://docs.aws.amazon.com/lambda/latest/dg/esm-logging.html) . +>> +>> Possible values: +>> +>> * `DEBUG` +>> * `INFO` +>> * `WARN` +>> + + +Shorthand Syntax: + + + SystemLogLevel=string + + +JSON Syntax: + + + { + "SystemLogLevel": "DEBUG"|"INFO"|"WARN" + } + + +`--scaling-config` (structure) + +> (Amazon SQS only) The scaling configuration for the event source. For more information, see [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency) . +> +> MaximumConcurrency -> (integer) +> +>> Limits the number of concurrent instances that the Amazon SQS event source can invoke. +>> +>> Constraints: +>> +>> * min: `2` +>> * max: `1000` +>> + + +Shorthand Syntax: + + + MaximumConcurrency=integer + + +JSON Syntax: + + + { + "MaximumConcurrency": integer + } + + @@ -334 +454 @@ JSON Syntax: ->>> * pattern: `$|kafka://([^.]([a-zA-Z0-9\-_.]{0,248}))|arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` +>>> * pattern: `$|kafka://([^.]([a-zA-Z0-9\-_.]{0,248}))|arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` @@ -358 +478 @@ JSON Syntax: ->>> * pattern: `$|kafka://([^.]([a-zA-Z0-9\-_.]{0,248}))|arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` +>>> * pattern: `$|kafka://([^.]([a-zA-Z0-9\-_.]{0,248}))|arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` @@ -411,0 +532,8 @@ JSON Syntax: +> +>> Constraints: +>> +>> * min: `1` +>> * max: `128` +>> * pattern: `([\p{L}\p{Z}\p{N}_.:/=+\-@]*)` +>> + @@ -413,0 +542,8 @@ JSON Syntax: +> +>> Constraints: +>> +>> * min: `0` +>> * max: `256` +>> * pattern: `([\p{L}\p{Z}\p{N}_.:/=+\-@]*)` +>> + @@ -500 +636 @@ Syntax: -> * max: `22` +> * max: `23` @@ -732 +868,3 @@ Syntax: ->>>>> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:([a-z]{2}(-gov)?-[a-z]+-\d{1})?:(\d{12})?:(.*)` +>>>>> * min: `0` +>>>>> * max: `10000` +>>>>> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` @@ -863 +1001,3 @@ JSON Syntax: ->>>>> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:([a-z]{2}(-gov)?-[a-z]+-\d{1})?:(\d{12})?:(.*)` +>>>>> * min: `0` +>>>>> * max: `10000` +>>>>> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` @@ -911,29 +1050,0 @@ JSON Syntax: -`--scaling-config` (structure) - -> (Amazon SQS only) The scaling configuration for the event source. For more information, see [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency) . -> -> MaximumConcurrency -> (integer) -> ->> Limits the number of concurrent instances that the Amazon SQS event source can invoke. ->> ->> Constraints: ->> ->> * min: `2` ->> * max: `1000` ->> -