AWS res documentation change

Service: res · 2026-06-22 · Documentation medium

File: res/archive/release-minus-4/ug/active-directory-sync.md

Summary

Added documentation for common SSSD configuration parameters (enumerate, ldap_id_mapping) and fixed CloudWatch log path syntax

Security assessment

The change adds explanations for security-relevant SSSD settings (caching behavior and ID mapping) but does not address a specific vulnerability. It enhances documentation of existing security features without evidence of patching a weakness.

Diff

diff --git a/res/archive/release-minus-4/ug/active-directory-sync.md b/res/archive/release-minus-4/ug/active-directory-sync.md
index 3bc744cdf..f5da9ee92 100644
--- a//res/archive/release-minus-4/ug/active-directory-sync.md
+++ b//res/archive/release-minus-4/ug/active-directory-sync.md
@@ -15 +15 @@ All the CFN parameters related to Active Directory (AD) are optional during inst
-![Form with optional Active Directory configuration fields including domain name, LDAP settings, organizational units, and service account credentials.](/images/res/archive/release-minus-4/ug/images/active-directory-details.png)
+![Active directory optional details](/images/res/archive/release-minus-4/ug/images/active-directory-details.png)
@@ -30 +30 @@ After the initial installation, administrators can view or edit the AD configura
-![Active Directory Domain configuration page showing domain settings, LDAP connection details, and organizational units.](/images/res/archive/release-minus-4/ug/images/res-active-directory-domain.png)
+![Active directory domain configuration settings details](/images/res/archive/release-minus-4/ug/images/res-active-directory-domain.png)
@@ -32 +32 @@ After the initial installation, administrators can view or edit the AD configura
-![Active Directory Synchronization dialog with fields for directory name, LDAP settings, and organizational units.](/images/res/archive/release-minus-4/ug/images/active-directory-synchronization.png)
+![Active directory synchronization pop-out](/images/res/archive/release-minus-4/ug/images/active-directory-synchronization.png)
@@ -45 +45 @@ Administrators can filter the users or groups to sync using the **Users Filter**
-Administrators can provide a dictionary of key-value pairs containing SSSD parameters and values to write to the `[domain_type/DOMAIN_NAME]` section of the SSSD config file on cluster instances. RES applies the SSSD updates automatically– it restarts the SSSD service on cluster instances and triggers the AD sync process. For a full description of the SSSD configuration file, see the Linux man pages for `SSSD`.
+Administrators can provide a dictionary of key-value pairs containing SSSD parameters and values to write to the `[domain_type/DOMAIN_NAME]` section of the SSSD config file on cluster instances. RES applies the SSSD updates automatically– it restarts the SSSD service on cluster instances and triggers the AD sync process.
@@ -47 +47,12 @@ Administrators can provide a dictionary of key-value pairs containing SSSD param
-![Additional SSSD Configuration form with ldap_id_mapping and join_active_directory keys set to true, and Add Parameter button.](/images/res/archive/release-minus-4/ug/images/res-additional-sssd-config1.png)
+Some common custom SSSD settings are:
+
+  * `enumerate` \- Set to 'true' to cache all user and group entries from the directory service. Disabling this could add a short delay to users' first login.
+
+  * `ldap_id_mapping` \- Set to 'true' to map LDAP/AD user and group IDs to local UIDs and GIDs on the Linux system. Enabling this can improve compatibility with existing POSIX scripts and applications.
+
+
+
+
+For a full description of the SSSD configuration file, see the Linux man pages for `SSSD`.
+
+![Additional SSSD configurations](/images/res/archive/release-minus-4/ug/images/res-additional-sssd-config1.png)
@@ -60 +71 @@ The following example enables debug level for SSSD logs:
-![Configuration form showing three key-value pairs: ldap_id_mapping set to true, join_active_directory set to true, and debug_level set to 0xFFF0.](/images/res/archive/release-minus-4/ug/images/res-additional-sssd-config2.png)
+![Additional SSSD configurations showing new key and value pair entered](/images/res/archive/release-minus-4/ug/images/res-additional-sssd-config2.png)
@@ -66 +77 @@ Navigate to the **Identity management** page, and choose the **Start AD Synchron
-![Active Directory Domain configuration settings including domain name, LDAP base, service account credentials, and organizational unit specifications.](/images/res/archive/release-minus-4/ug/images/res-ad-directory-sync1.png)
+![Active Directory domain configurations](/images/res/archive/release-minus-4/ug/images/res-ad-directory-sync1.png)
@@ -70 +81 @@ To stop an ongoing AD sync, select the **Stop AD Synchronization** button in the
-![Active Directory Domain configuration page showing domain settings and Stop AD Synchronization button.](/images/res/archive/release-minus-4/ug/images/res-ad-directory-sync2.png)
+![Active Directory domain configurations page showing option to stop synchronization](/images/res/archive/release-minus-4/ug/images/res-ad-directory-sync2.png)
@@ -74 +85 @@ You can also check the AD sync status and the latest sync time in the **Active D
-![Active Directory Domain configuration page showing domain settings and sync status.](/images/res/archive/release-minus-4/ug/images/res-ad-directory-sync3.png)
+![Active Directory domain configurations page showing latest synchronization time](/images/res/archive/release-minus-4/ug/images/res-ad-directory-sync3.png)
@@ -94 +105 @@ The Active Directory synchronization process has been moved from the Cluster Man
-  5. Observe the logs of the running AD Sync task under **CloudWatch** → **Log Groups** → ``<environment-name>`/ad-sync`. You'll see logs from each of the running ECS tasks. Select the most recent to view the logs.
+  5. Observe the logs of the running AD Sync task under **CloudWatch** → **Log Groups** → `/`<environment-name>`/ad-sync`. You'll see logs from each of the running ECS tasks. Select the most recent to view the logs.