AWS cli: Transfer Family import-host-key: add --storage-type and --kms-key
Summary
Added --storage-type (SERVICE_MANAGED | SECRETS_MANAGER) and --kms-key options to the import-host-key CLI reference, including guidance that a customer managed KMS key policy must allow the AWSServiceRoleForTransfer service-linked role to decrypt the secret, with the AWS managed key used by default.
Security assessment
Introduces customer-controlled KMS encryption for the Secrets Manager secret holding SFTP private host key material, explicitly requiring an IAM key policy grant to the Transfer service-linked role; this is encryption/credential-protection guidance, not a documented CVE or incident fix.
Evidence
+> The Amazon Resource Name (ARN) of the KMS key used to encrypt the Secrets Manager secret that stores the host key. If you specify a customer managed key, its key policy must allow the `AWSServiceRoleForTransfer` service-linked role to decrypt the secret. If you don’t specify a value, Transfer Family uses the Amazon Web Services managed key for Secrets Manager.
Diff
diff --git a/cli/latest/reference/transfer/import-host-key.md b/cli/latest/reference/transfer/import-host-key.md index 494d080..5c1d382 100644 --- a//cli/latest/reference/transfer/import-host-key.md +++ b//cli/latest/reference/transfer/import-host-key.md @@ -15 +15 @@ - * [AWS CLI 2.38.0 Command Reference](../../index.html) » + * [AWS CLI 2.38.1 Command Reference](../../index.html) » @@ -70,0 +71,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf + [--storage-type <value>] + [--kms-key <value>] @@ -187,0 +190,23 @@ JSON Syntax: +`--storage-type` (string) + +> Specifies whether the host key is stored by Transfer Family (`SERVICE_MANAGED` ) or in Secrets Manager (`SECRETS_MANAGER` ). When you specify `SECRETS_MANAGER` , Transfer Family stores the private host key material in an Secrets Manager secret. +> +> Possible values: +> +> * `SERVICE_MANAGED` +> * `SECRETS_MANAGER` +> + + +`--kms-key` (string) + +> The Amazon Resource Name (ARN) of the KMS key used to encrypt the Secrets Manager secret that stores the host key. If you specify a customer managed key, its key policy must allow the `AWSServiceRoleForTransfer` service-linked role to decrypt the secret. If you don’t specify a value, Transfer Family uses the Amazon Web Services managed key for Secrets Manager. +> +> Constraints: +> +> * min: `20` +> * max: `1600` +> * pattern: `arn:\S+` +> + + @@ -335 +360 @@ HostKeyId -> (string) - * [AWS CLI 2.38.0 Command Reference](../../index.html) » + * [AWS CLI 2.38.1 Command Reference](../../index.html) »