AWS m2: Document runtime config keys incl. TLS, credentials, OAuth
Summary
Adds and updates many configuration key entries for AWS Transform for mainframe Runtime, including RabbitMQ SSL/TLS settings (keyStore/trustStore, algorithm TLSv1.2), credential/secret references (AWS accessKey/secretKey, JMS secret ARN, Redis and JanusGraph passwords), the OAuth IdP issuerURI property, and a request-context propagation flag for groovy scripts. Also corrects various defaults and key names.
Security assessment
The diff documents security-relevant configuration: credential/secret ARNs resolved via the AWS secrets listener, RabbitMQ SSL/TLS keystore/truststore and TLSv1.2 algorithm settings, Redis/JanusGraph passwords, and the OAuth issuerURI. It also documents `gapwalk.script.propagateRequestContext`, which propagates HTTP request headers to groovy scripts. These are documentation of security features and hardening options rather than a fix for a specific vulnerability, so it is security documentation with medium impact.
Evidence
+`mq.queues.jmsMQQueueManagers[N].secret` | string | | The credential secret ARN for the queue manager at index N, resolved by the AWS secrets listener. See [AWS Transform for mainframe Runtime secrets](./ba-runtime-config-app-secrets.html). |
Diff
diff --git a/m2/latest/userguide/ba-runtime-key-value.md b/m2/latest/userguide/ba-runtime-key-value.md index 66fdcbcd8..80ad87570 100644 --- a//m2/latest/userguide/ba-runtime-key-value.md +++ b//m2/latest/userguide/ba-runtime-key-value.md @@ -196,0 +197 @@ The following use cases show examples of the applicable keys and values. + #forcedDateMode: HYBRID @@ -428 +429,3 @@ Key | Type | Default value | Description | Release version -`bluesam.maxBluesamDisablingThreadpoolSize` | number | 10 | Specifies maximum threadpool size used to disable bluesam datasets for batch processing. | 4.5.0 +`bluesam.locks.locksCleanupIntervalMillis` | number (long, milliseconds) | -1 | Interval, in milliseconds, at which the in-memory (non-Redis) Blusam locker reclaims released record locks to bound heap growth during long-running processing. A value <= 0 disables the cleanup (default). A positive value below 60000 ms is clamped up to the 60000 ms floor to avoid sustained back-to-back cleanup passes. Requires `bluesam.locks.locksDeadTime` to be set when enabled: startup fails with an `IllegalStateException` if the interval is > 0 while `locksDeadTime` is unset, to prevent the reaper from reaping still-held locks using the 1000 ms fallback age. | 5.274.0 +`bluesam.locks.locksDeadTime` | number (long, milliseconds) | (none, must be set explicitly when the reaper is enabled) | Age threshold, in milliseconds, above which a released lock's tracking entry is considered dead and eligible for reclamation by the reaper. Mandatory when `bluesam.locks.locksCleanupIntervalMillis` > 0. | +`bluesam.maxBlueSamDisablingThreadPoolSize` | number | 10 | Specifies maximum threadpool size used to disable bluesam datasets for batch processing. | 4.5.0 @@ -445 +448 @@ Key | Type | Default value | Description | Release version -`cl.configuration.context.encoding` | string | CP297 | The encoding of CL files. Expects a valid encoding`CP1047`,`IBM930`,`ASCII`,`UTF-8`... Default value is`CP297` | +`cl.configuration.context.encoding` | string | CP1047 | The encoding of CL files. Expects a valid encoding`CP1047`,`IBM930`,`ASCII`,`UTF-8`... Default value is`CP1047` | @@ -464 +467 @@ Key | Type | Default value | Description | Release version -`dateTimeFormat` | string | ISO | The dateTimeFormat describes how to spill database date time timestamp type into data simplifier entities. Allowed values are`ISO` /`EUR` /`EUR` /`USA` /`LOCAL` | +`dateTimeFormat` | string | ISO | The dateTimeFormat describes how to spill database date time timestamp type into data simplifier entities. Allowed values are`ISO` /`EUR` /`JIS` /`USA` /`LOCAL` | @@ -468 +471 @@ Key | Type | Default value | Description | Release version -`defaultKeepExistingFiles` | boolean | false | Specifies whether to set the dataset default previous value. | +`defaultKeepExistingFiles` | boolean | true | Specifies whether to set the dataset default previous value. | @@ -490 +493 @@ Key | Type | Default value | Description | Release version -`gapwalk-application.security.issuerUri` | string | null | The issuer URI of the identity provider (IdP). This option is required when `gapwalk-application.identity` is `oauth`. | +`gapwalk-application.security.issuerURI` | string | null | The issuer URI of the identity provider (IdP). The canonical property is `issuerURI`; Spring relaxed binding also accepts `issuer-uri`. This option is required when `gapwalk-application.identity` is `oauth`. | @@ -492,0 +496 @@ Key | Type | Default value | Description | Release version +`gapwalk.script.propagateRequestContext` | boolean | false | When set to true, propagates the HTTP request context to the groovy script for synchronous execution endpoints. This lets scripts access the original request headers. The default is false. | @@ -524,0 +529,3 @@ Key | Type | Default value | Description | Release version +`jhdb.navigation.procseq.keyset-mode` | string | off | Controls keyset (seek) navigation for procseq secondary-index reads, which avoids the `row_number()` index view. `off` uses the legacy row_index navigation; `validate` runs both and returns the legacy result after comparing them; `enabled` uses the keyset result. Only applied to root segments whose secondary index is built from their own fixed-length fields; otherwise falls back to legacy. | +`jhdb.concatkeysize` | string | | The concatenated key size used by the JHDB RDBMS metadata store. | +`jhdb.lock` | string | single | Selects the JHDB lock mode. Default is `single`. | @@ -527 +534 @@ Key | Type | Default value | Description | Release version -`jics.data.dataJsonInitLocation` | string | | | +`jics.data.dataJsonInitLocation` | string | | Location of a JSON file used to initialize JICS data. Empty by default. | @@ -548 +555,14 @@ Key | Type | Default value | Description | Release version -`jics.queues.sqs.region` | string | eu-west-1 | The AWS Region for Amazon Simple Queue Service, used in JICS. | +`jics.queues.sqs.region` | string | | The AWS Region for Amazon Simple Queue Service, used in JICS. The region is deployment-supplied (no shipped default). | +`jics.queues.rabbitMQHost` | string | | The RabbitMQ host for JICS queues. | +`jics.queues.rabbitMQPort` | number | | The RabbitMQ port for JICS queues. | +`jics.queues.rabbitMQVirtualHost` | string | | The RabbitMQ virtual host for JICS queues. | +`jics.queues.rabbitMQUsername` | string | | The RabbitMQ user name for JICS queues. | +`jics.queues.rabbitMQPassword` | string | | The RabbitMQ password for JICS queues. | +`jics.task-execution.runners[n].type` | string | | The task runner type. Required. `awslambda` is the implemented type. An unknown type throws "Unknown runner type" at resolution. | +`jics.task-execution.runners[n].transactions` | string | | The transactions handled by this task runner. Required. | +`jics.task-execution.runners[n].region` | string | | The AWS Region for the Lambda task runner. Required for the `awslambda` type. | +`jics.task-execution.runners[n].functionName` | string | | The Lambda function name. Required for the `awslambda` type. | +`jics.task-execution.runners[n].accessKey` | string | | The AWS access key for the Lambda task runner. Optional. | +`jics.task-execution.runners[n].secretKey` | string | | The AWS secret key for the Lambda task runner. Optional. | +`jobqueue.schedulers[n].name` | string | default | The scheduler name. The shipped example YAML uses `queue1` / `queue2` as an override. | +`jobqueue.schedulers[n].threadCount` | number | 1 | The number of scheduler threads. The shipped example YAML uses `5` as an override. | @@ -549,0 +570,5 @@ Key | Type | Default value | Description | Release version +`jics.queues.ts.redis.hostname` | string | 127.0.0.1 | The hostname of the JICS TS Queues Redis server. | +`jics.queues.ts.redis.port` | int | 6379 | The port of the JICS TS Queues Redis server. | +`jics.queues.ts.redis.password` | string | redis | The password for the JICS TS Queues Redis server. | +`jics.queues.ts.redis.username` | string | | The username for the JICS TS Queues Redis server. | +`jics.queues.ts.redis.mode` | string | standalone | The connection mode for the JICS TS Queues Redis server. Allowed values are `standalone` and `cluster`. | @@ -550,0 +576,4 @@ Key | Type | Default value | Description | Release version +`jics.queues` | string | gapwalk | Selects the JICS queue implementation. Allowed values are `gapwalk`, `rabbitmq`, and `sqs`. | +`jics.resource-definitions.store-type` | string | jpa | Selects the JICS resource-definitions store. Allowed values are `jpa` and `redis`. | +`jics.disableSyncpoint` | boolean | false | Specifies whether to disable JICS syncpoint handling. | +`jics.enableDeprecatedRawText` | boolean | false | Specifies whether to enable the deprecated raw-text handling in JICS. | @@ -560 +589,2 @@ Key | Type | Default value | Description | Release version -`jics.xa.agent.timeout` | number | | | +`jics.xa.agent.timeout` | number | | The XA agent timeout, in milliseconds. Empty by default (no timeout applied when unset). | +`jcl.systemout.mapping` | Map | | Maps SYSTEMOUT DD names to file paths. | @@ -561,0 +592 @@ Key | Type | Default value | Description | Release version +`jildb.encoding` | string | | The encoding used by the Jildb backend. | @@ -569 +600 @@ Key | Type | Default value | Description | Release version -`lockTimeout` | number | 500 | The lock timeout, in milliseconds. | +`lockTimeout` | number | 100 | The Blu4IV record lock timeout, in milliseconds. | @@ -576,0 +608,2 @@ Key | Type | Default value | Description | Release version +`mq.queues.jmsMQQueueManagers[N].jmsMQStandbyList` | string[] | | The list of standby IBM MQ connections for the queue manager at index N. | +`mq.queues.jmsMQQueueManagers[N].secret` | string | | The credential secret ARN for the queue manager at index N, resolved by the AWS secrets listener. See [AWS Transform for mainframe Runtime secrets](./ba-runtime-config-app-secrets.html). | @@ -577,0 +611,24 @@ Key | Type | Default value | Description | Release version +`dataqueue.queues.rabbitMQHost` | string | | The RabbitMQ host for data queues. | +`dataqueue.queues.rabbitMQPort` | number | | The RabbitMQ port for data queues. | +`dataqueue.queues.rabbitMQVirtualHost` | string | | The RabbitMQ virtual host for data queues. | +`dataqueue.queues.rabbitMQUsername` | string | | The RabbitMQ user name for data queues. | +`dataqueue.queues.rabbitMQPassword` | string | | The RabbitMQ password for data queues. | +`dataqueue.queues.rabbitMQSslEnabled` | boolean | false | Specifies whether SSL/TLS is enabled for the data queue RabbitMQ connection. | +`dataqueue.queues.rabbitMQSsl.keyStorePath` | string | | The key store path for the data queue RabbitMQ SSL connection. | +`dataqueue.queues.rabbitMQSsl.keyStoreType` | string | | The key store type for the data queue RabbitMQ SSL connection. | +`dataqueue.queues.rabbitMQSsl.keyStorePassword` | string | | The key store password for the data queue RabbitMQ SSL connection. | +`dataqueue.queues.rabbitMQSsl.trustStorePath` | string | | The trust store path for the data queue RabbitMQ SSL connection. | +`dataqueue.queues.rabbitMQSsl.trustStorePassword` | string | | The trust store password for the data queue RabbitMQ SSL connection. | +`dataqueue.queues.rabbitMQSsl.algorithm` | string | TLSv1.2 | The SSL algorithm for the data queue RabbitMQ connection. | +`dataqueue.queues.rabbitMQRestApi` | string | | The RabbitMQ management REST API endpoint for data queues. | +`dataqueue.queues.rabbitMQChannelCacheSize` | number | 25 | The RabbitMQ channel cache size for data queues. | +`dataqueue.queues.rabbitMQChannelCheckoutTimeout` | number | 0 | The channel checkout timeout, in milliseconds, for data queues. `0` means no timeout. | +`blu4ivmq.queues.rabbitMQHost` | string | | The RabbitMQ host for Blu4iv MQ queues. | +`blu4ivmq.queues.rabbitMQPort` | number | | The RabbitMQ port for Blu4iv MQ queues. | +`blu4ivmq.queues.rabbitMQVirtualHost` | string | | The RabbitMQ virtual host for Blu4iv MQ queues. | +`blu4ivmq.queues.rabbitMQUsername` | string | | The RabbitMQ user name for Blu4iv MQ queues. | +`blu4ivmq.queues.rabbitMQPassword` | string | | The RabbitMQ password for Blu4iv MQ queues. | +`blu4ivmq.queues.rabbitMQSslEnabled` | boolean | false | Specifies whether SSL/TLS is enabled for the Blu4iv MQ RabbitMQ connection. | +`blu4ivmq.queues.rabbitMQSsl.keyStorePath` | string | | The key store path for the Blu4iv MQ RabbitMQ SSL connection. | +`blu4ivmq.queues.rabbitMQSsl.trustStorePath` | string | | The trust store path for the Blu4iv MQ RabbitMQ SSL connection. | +`blu4ivmq.queues.rabbitMQSsl.algorithm` | string | TLSv1.2 | The SSL algorithm for the Blu4iv MQ RabbitMQ connection. | @@ -594 +651 @@ Key | Type | Default value | Description | Release version -`mq.queues.sqs.region` | string | eu-west-3 | The AWS Region for the AWS SQS MQ service. | +`mq.queues.sqs.region` | string | | The AWS Region for the AWS SQS MQ service. The region is deployment-supplied (no shipped default). | @@ -599,0 +657,3 @@ Key | Type | Default value | Description | Release version +`qtemp.allow-session` | boolean | false | Specifies whether to allow session-scoped QTEMP. | +`system.time.format` | string | ISO | The system time format. | +`query.useRowComparison` | boolean | true | Specifies whether to build WHERE conditions using row comparison. | @@ -604 +664,12 @@ Key | Type | Default value | Description | Release version -`reportOutputPath` | string | `/reports` | The report output path. | +`reportOutputPath` | string | `/reports` | (Deprecated) The report output path. Retained for backward compatibility; use `report.output.path.template` instead. When `report.output.path.template` is empty, this value is used as `reportOutputPath/{PROGID}`. | +`report.output.path.template` | string | `reports/{PROGID}` | The template for the report output path. Replaces the deprecated `reportOutputPath`. | +`report.output.name.template` | string | `{PRINTERNAME}_{DATE}{TIME}` | The template for the report output file name. | +`report.output.name.override.template` | string | `{PRINTERNAME}-{USRDTA}-{DATE}{TIME}` | The override template for the report output file name. | +`report.output.time.format` | string | `HHmmss` | The time format used in report output name templates. | +`report.output.date.format` | string | `yyyyMMdd` | The date format used in report output name templates. | +`report.output.jobName.default` | string | `Interactive` | The default job name used in report output name templates. | +`report.output.jobNumber.default` | string | `000000` | The default job number used in report output name templates. | +`reportOutputPath.username.enabled` | boolean | false | Specifies whether to include a per-user subfolder in the report output path. | +`report.overflow-handling-enabled` | boolean | false | Specifies whether report overflow handling is enabled. | +`reportFormat` | string | `PDF` | The output format for generated reports. | +`reportName.timestamp.format` | string | | The timestamp format used in the report name. | @@ -623 +694 @@ Key | Type | Default value | Description | Release version -`stopExecutionWhenProgNotFound` | boolean | true | Specifies whether to stop running if a program isn't found. If set to`true`, interrupts the run if a program is not found. | +`stopExecutionWhenProgNotFound` | boolean | false | Specifies whether to stop running if a program isn't found. If set to`true`, interrupts the run if a program is not found. The shipped `application-main.yml` sets this to `false`; the code `@Value` fallback is `true` when no yml value is present. | @@ -626 +697,5 @@ Key | Type | Default value | Description | Release version -`system.qdecfmt` | string | | | +`system.qdecfmt` | string | | The decimal format (QDECFMT) system value. Empty by default. | +`gapwalk.zos.sysplexName` | string | | The z/OS sysplex name exposed to the runtime. Empty by default. | +`gapwalk.zos.systemName` | string | | The z/OS system name exposed to the runtime. Empty by default. | +`interactive-job.persist` | boolean | false | Specifies whether interactive job state is persisted. | +`interactive-job.subsystem` | string | QINTER | The subsystem name used for interactive jobs. | @@ -628,3 +703,3 @@ Key | Type | Default value | Description | Release version -`taskExecutor.corePoolSize` | number | 5 | When a transaction in a terminal is initiated via a groovy script, a new thread is created. Use this parameter to setup the core pool size. | -`taskExecutor.maxPoolSize` | number | 10 | When a transaction in a terminal is initiated via a groovy script, a new thread is created. Use this parameter to setup the max pool size (max number of parallel threads). | -`taskExecutor.queueCapacity` | number | 50 | When a transaction in a terminal is initiated via a groovy script, a new thread is created. Use this parameter to setup the queue size. (= maximum number of pending transactions when`taskExecutor.maxPoolSize` is reached) | +`taskExecutor.corePoolSize` | number | 5 | When a transaction in a terminal is initiated via a groovy script, a new thread is created. Use this parameter to setup the core pool size. **Note:** the `gapwalk-gs21.war` web application applies different defaults for the `taskExecutor.*` properties (`corePoolSize` 200, `maxPoolSize` 500, `queueCapacity` 10). | +`taskExecutor.maxPoolSize` | number | 200 | When a transaction in a terminal is initiated via a groovy script, a new thread is created. Use this parameter to setup the max pool size (max number of parallel threads). | +`taskExecutor.queueCapacity` | number | 0 | When a transaction in a terminal is initiated via a groovy script, a new thread is created. Use this parameter to setup the queue size. (= maximum number of pending transactions when`taskExecutor.maxPoolSize` is reached) | @@ -671,0 +747,3 @@ Key | Type | Default value | Description | Release version +`unload.DFSIGDCB` | boolean | false | Specifies whether to apply DFSIGDCB handling in the unload utility. | +`adastrip.batchSize` | number | 1000 | The batch size used by the ADASTRIP utility. | +`spliceLimitMemoryUsage` | boolean | true | Specifies whether to limit memory usage during splice processing. This is a top-level key (no prefix). | @@ -698 +775,0 @@ Key | Type | Default value | Description -`commands-off` | string | | List of commands to turn off, separated by comma. Allowed values are`PGM_BASIC`,`RCVMSG`,`SNDRCVF`,`CHGVAR`,`QCLRDTAQ`,`RTVJOBA`,`ADDLFM`,`ADDPFM`,`RCVF`,`OVRDBF`,`DLTOVR`,`CPYF`,`SNDDTAQ`. Useful when you want to disable or overwrite an existing program. `PGM_BASIC` is a specific AWS Transform for mainframe Runtime program designed for debugging purposes. @@ -701,0 +779,5 @@ Key | Type | Default value | Description +`clcommand.sndpgmmsg.abortOnEmptyCallTree` | boolean | true | Specifies whether to abort `SNDPGMMSG` when the call tree is empty. +`clcommand.catchMonMsgException` | boolean | false | Specifies whether `MONMSG` catches exceptions. +`clcommand.sort.function` | string | | The sort function name used by CL commands. +`clcommand.sort.function.specific.column` | boolean | false | Specifies whether the CL command sort function targets a specific column. +`clcommand.cpyf.outputIsAFile` | boolean | | Specifies whether the `CPYF` output target is a file. @@ -721,0 +804,5 @@ Key | Type | Default value | Description +`jhdb.janus.storageBackend` | string | | The JanusGraph storage backend used by JHDB. No code default. Note: the shipped example YAML sets `janus.storageBackend` (top-level, not `jhdb.janus`), which does not bind; the canonical prefix is `jhdb.janus`. +`jhdb.janus.storageHostname` | string | | The JanusGraph storage hostname. No code default. +`jhdb.janus.storageUserName` | string | | The JanusGraph storage user name. No code default. +`jhdb.janus.storagePassword` | string | | The JanusGraph storage password. No code default. +`jhdb.janus.storageDirectory` | string | | The JanusGraph storage directory. No code default. Note: the shipped `berkeleyje` example is set under a top-level `janus.*` prefix and is not wired to `@ConfigurationProperties(prefix="jhdb")`. @@ -748 +835 @@ Key | Type | Default value | Description | Release version -`blu4iv.dao.cache.initMaxResults` | number | 10000 | The size of the cache. | 4.8.0 +`blu4iv.dao.cache.maxResults` | number | 10000 | The size of the cache. | 4.8.0 @@ -750,0 +838 @@ Key | Type | Default value | Description | Release version +`blu4iv.dao.sort.function.specific.column` | boolean | false | Specifies whether the sort function targets a specific column for the blu4iv database. | @@ -754,0 +843,2 @@ Key | Type | Default value | Description | Release version +`blu4iv.lock` | string | gapwalk | Selects the Blu4iv lock manager implementation. Default is `gapwalk`. When set to `redis`, configure the `blu4iv.lock.redis.*` properties and `blu4iv.lock.timeout`. | +`blu4iv.screen.table.maxRowsPerRequest` | number | 9999 | The maximum number of rows returned per request for Blu4iv screen tables. | @@ -769 +859 @@ The in-memory cache feature enables users to cache read-only data within memory, - initMaxResults: 100000 + maxResults: 100000