AWS solutions documentation change
Summary
Replaced Kubernetes secret creation with managed credentials workflow for basic authentication
Security assessment
Changes credential management to a dedicated workflow command, improving security practices by moving away from direct Kubernetes secret creation. Adds non-interactive setup option but doesn't fix a specific vulnerability.
Diff
diff --git a/solutions/latest/migration-assistant-for-amazon-opensearch-service/pb-es68-console.md b/solutions/latest/migration-assistant-for-amazon-opensearch-service/pb-es68-console.md index 776e10a53..7fa1d8ab0 100644 --- a//solutions/latest/migration-assistant-for-amazon-opensearch-service/pb-es68-console.md +++ b//solutions/latest/migration-assistant-for-amazon-opensearch-service/pb-es68-console.md @@ -23 +23 @@ The day-to-day operator interface is the Workflow CLI, which runs in the Migrati - 4. If the source cluster uses basic authentication, create a Kubernetes secret for its credentials in the `ma` namespace. The target uses SigV4 in this playbook, so it does not need a basic-auth secret: + 4. If the source cluster uses basic authentication, create managed HTTP Basic credentials in the `ma` namespace. The target uses SigV4 in this playbook, so it does not need a basic-auth secret: @@ -25,4 +25 @@ The day-to-day operator interface is the Workflow CLI, which runs in the Migrati - kubectl create secret generic source-credentials \ - --from-literal=username=<SOURCE_USER> \ - --from-literal=password=<SOURCE_PASSWORD> \ - -n ma + workflow configure credentials create source-credentials @@ -30 +27 @@ The day-to-day operator interface is the Workflow CLI, which runs in the Migrati -You reference this secret by name in `authConfig.basic.secretName` in the workflow configuration. +You reference this credential by name in `authConfig.basic.secretName` in the workflow configuration. For non-interactive setup, use `workflow configure credentials create source-credentials --stdin` and pass one `USERNAME:PASSWORD` line on stdin.