AWS cli medium security documentation change
Summary
Updated AWS CLI reference version from 2.35.5 to 2.35.8. Added new fields for KMS encryption of filter criteria, metrics configuration, logging configuration, and scaling configuration. Updated constraints and patterns for multiple parameters including UUID, ARNs, and filter patterns. Restructured documentation sections.
Security assessment
Added KMSKeyArn field explicitly for encrypting Lambda filter criteria using customer-managed keys. Documented FilterCriteriaError structure for handling KMS-related encryption/decryption errors. These changes directly address data-at-rest security concerns through encryption capabilities.
Diff
diff --git a/cli/latest/reference/lambda/get-event-source-mapping.md b/cli/latest/reference/lambda/get-event-source-mapping.md index ef0b6071a..ddd71d52a 100644 --- a//cli/latest/reference/lambda/get-event-source-mapping.md +++ b//cli/latest/reference/lambda/get-event-source-mapping.md @@ -15 +15 @@ - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) » @@ -96,0 +97,7 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda +> +> Constraints: +> +> * min: `36` +> * max: `36` +> + @@ -246,0 +254,7 @@ UUID -> (string) +> +> Constraints: +> +> * min: `36` +> * max: `36` +> + @@ -311 +325,3 @@ EventSourceArn -> (string) -> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:([a-z]{2}(-gov)?-[a-z]+-\d{1})?:(\d{12})?:(.*)` +> * min: `0` +> * max: `10000` +> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` @@ -337 +353 @@ FilterCriteria -> (structure) ->>>> * pattern: `.*` +>>>> * pattern: `[\s\S]*` @@ -340,0 +357,104 @@ FilterCriteria -> (structure) +FilterCriteriaError -> (structure) + +> An object that contains details about an error related to filter criteria encryption. +> +> ErrorCode -> (string) +> +>> The KMS exception that resulted from filter criteria encryption or decryption. +>> +>> Constraints: +>> +>> * min: `10` +>> * max: `50` +>> * pattern: `[A-Za-z]+Exception` +>> + +> +> Message -> (string) +> +>> The error message. +>> +>> Constraints: +>> +>> * min: `10` +>> * max: `2048` +>> * pattern: `.*` +>> + + +KMSKeyArn -> (string) + +> The ARN of the Key Management Service (KMS) customer managed key that Lambda uses to encrypt your function’s [filter criteria](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-basics) . +> +> Constraints: +> +> * min: `0` +> * max: `10000` +> * pattern: `(arn:(aws[a-zA-Z-]*)?:[a-z0-9-.]+:.*)|()` +> + + +MetricsConfig -> (structure) + +> The metrics configuration for your event source. For more information, see [Event source mapping metrics](https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html#event-source-mapping-metrics) . +> +> Metrics -> (list) +> +>> The metrics you want your event source mapping to produce, including `EventCount` , `ErrorCount` , `KafkaMetrics` . +>> +>> * `EventCount` to receive metrics related to the number of events processed by your event source mapping. +>> * `ErrorCount` (Amazon MSK and self-managed Apache Kafka) to receive metrics related to the number of errors in your event source mapping processing. +>> * `KafkaMetrics` (Amazon MSK and self-managed Apache Kafka) to receive metrics related to the Kafka consumers from your event source mapping. +>> + +>> +>> For more information about these metrics, see [Event source mapping metrics](https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html#event-source-mapping-metrics) . +>> +>> Constraints: +>> +>> * min: `0` +>> * max: `3` +>> + +>> +>> (string) +>> +>>> Possible values: +>>> +>>> * `EventCount` +>>> * `ErrorCount` +>>> * `KafkaMetrics` +>>> + + +LoggingConfig -> (structure) + +> (Amazon MSK, and self-managed Apache Kafka only) The logging configuration for your event source. For more information, see [Event source mapping logging](https://docs.aws.amazon.com/lambda/latest/dg/esm-logging.html) . +> +> SystemLogLevel -> (string) +> +>> The log level you want your event source mapping to use. Lambda event poller only sends system logs at the selected level of detail and lower, where `DEBUG` is the highest level and `WARN` is the lowest. For more information about these metrics, see [Event source mapping logging](https://docs.aws.amazon.com/lambda/latest/dg/esm-logging.html) . +>> +>> Possible values: +>> +>> * `DEBUG` +>> * `INFO` +>> * `WARN` +>> + + +ScalingConfig -> (structure) + +> (Amazon SQS only) The scaling configuration for the event source. For more information, see [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency) . +> +> MaximumConcurrency -> (integer) +> +>> Limits the number of concurrent instances that the Amazon SQS event source can invoke. +>> +>> Constraints: +>> +>> * min: `2` +>> * max: `1000` +>> + + @@ -349 +469 @@ FunctionArn -> (string) -> * pattern: `arn:(aws[a-zA-Z-]*)?:lambda:[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:\d{12}:function:[a-zA-Z0-9-_]+(:(\$LATEST|[a-zA-Z0-9-_]+))?` +> * pattern: `arn:(aws[a-zA-Z-]*)?:lambda:(eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:\d{12}:function:[a-zA-Z0-9-_]+(:(\$LATEST|[a-zA-Z0-9-_]+))?` @@ -389 +509 @@ DestinationConfig -> (structure) ->>> * pattern: `$|kafka://([^.]([a-zA-Z0-9\-_.]{0,248}))|arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` +>>> * pattern: `$|kafka://([^.]([a-zA-Z0-9\-_.]{0,248}))|arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` @@ -413 +533 @@ DestinationConfig -> (structure) ->>> * pattern: `$|kafka://([^.]([a-zA-Z0-9\-_.]{0,248}))|arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` +>>> * pattern: `$|kafka://([^.]([a-zA-Z0-9\-_.]{0,248}))|arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` @@ -466 +586 @@ SourceAccessConfigurations -> (list) -> * max: `22` +> * max: `23` @@ -700 +820,3 @@ AmazonManagedKafkaEventSourceConfig -> (structure) ->>>>> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:([a-z]{2}(-gov)?-[a-z]+-\d{1})?:(\d{12})?:(.*)` +>>>>> * min: `0` +>>>>> * max: `10000` +>>>>> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` @@ -806 +928,3 @@ SelfManagedKafkaEventSourceConfig -> (structure) ->>>>> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:([a-z]{2}(-gov)?-[a-z]+-\d{1})?:(\d{12})?:(.*)` +>>>>> * min: `0` +>>>>> * max: `10000` +>>>>> * pattern: `arn:(aws[a-zA-Z0-9-]*):([a-zA-Z0-9\-])+:((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1})?:(\d{12})?:(.*)` @@ -829,15 +952,0 @@ SelfManagedKafkaEventSourceConfig -> (structure) -ScalingConfig -> (structure) - -> (Amazon SQS only) The scaling configuration for the event source. For more information, see [Configuring maximum concurrency for Amazon SQS event sources](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html#events-sqs-max-concurrency) . -> -> MaximumConcurrency -> (integer) -> ->> Limits the number of concurrent instances that the Amazon SQS event source can invoke. ->> ->> Constraints: ->> ->> * min: `2` ->> * max: `1000` ->> - - @@ -883,38 +991,0 @@ DocumentDBEventSourceConfig -> (structure) -KMSKeyArn -> (string) - -> The ARN of the Key Management Service (KMS) customer managed key that Lambda uses to encrypt your function’s [filter criteria](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-basics) . -> -> Constraints: -> -> * pattern: `(arn:(aws[a-zA-Z-]*)?:[a-z0-9-.]+:.*)|()` -> - - -FilterCriteriaError -> (structure) - -> An object that contains details about an error related to filter criteria encryption. -> -> ErrorCode -> (string) -> ->> The KMS exception that resulted from filter criteria encryption or decryption. ->> ->> Constraints: ->> ->> * min: `10` ->> * max: `50` ->> * pattern: `[A-Za-z]+Exception` ->> -