AWS cli: Transfer Family update-host-key: add storage-type and KMS key options
Summary
Update-host-key reference now documents changing a host key's storage type (SERVICE_MANAGED vs SECRETS_MANAGER), the KMS key ARN used to encrypt the Secrets Manager secret, the required transfer:ExportHostKey permission, and makes --description optional.
Security assessment
Documents that host key material can be moved to Secrets Manager encrypted with a customer managed KMS key whose key policy must let AWSServiceRoleForTransfer decrypt, and that the privileged permission-only action transfer:ExportHostKey is required to move private host key material. This is encryption/key-protection guidance rather than a fix for a specific vulnerability.
Evidence
+To change a host key’s storage type from `SERVICE_MANAGED` to `SECRETS_MANAGER` , you must have the `transfer:ExportHostKey` permission. `transfer:ExportHostKey` is a permission-only action that has no corresponding API operation.
Diff
diff --git a/cli/latest/reference/transfer/update-host-key.md b/cli/latest/reference/transfer/update-host-key.md index 97deb8a..e15e372 100644 --- a//cli/latest/reference/transfer/update-host-key.md +++ b//cli/latest/reference/transfer/update-host-key.md @@ -15 +15 @@ - * [AWS CLI 2.38.0 Command Reference](../../index.html) » + * [AWS CLI 2.38.1 Command Reference](../../index.html) » @@ -59 +59,3 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -Updates the description for the host key that’s specified by the `ServerId` and `HostKeyId` parameters. +Updates the host key that’s specified by the `ServerId` and `HostKeyId` parameters. You can update the description of the host key, change where the host key is stored by specifying the `StorageType` , and specify the KMS key used to encrypt the host key when it’s stored in Secrets Manager. + +To change a host key’s storage type from `SERVICE_MANAGED` to `SECRETS_MANAGER` , you must have the `transfer:ExportHostKey` permission. `transfer:ExportHostKey` is a permission-only action that has no corresponding API operation. @@ -69 +71,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf - --description <value> + [--description <value>] + [--storage-type <value>] + [--kms-key <value>] @@ -119 +123 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf -`--description` (string) [required] +`--description` (string) @@ -130,0 +135,23 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/transf +`--storage-type` (string) + +> Specifies whether the host key is stored by Transfer Family (`SERVICE_MANAGED` ) or in Secrets Manager (`SECRETS_MANAGER` ). When you specify `SECRETS_MANAGER` , Transfer Family stores the private host key material in an Secrets Manager secret. +> +> Possible values: +> +> * `SERVICE_MANAGED` +> * `SECRETS_MANAGER` +> + + +`--kms-key` (string) + +> The Amazon Resource Name (ARN) of the KMS key used to encrypt the Secrets Manager secret that stores the host key. If you specify a customer managed key, its key policy must allow the `AWSServiceRoleForTransfer` service-linked role to decrypt the secret. If you don’t specify a value, Transfer Family uses the Amazon Web Services managed key for Secrets Manager. +> +> Constraints: +> +> * min: `20` +> * max: `1600` +> * pattern: `arn:\S+` +> + + @@ -278 +305 @@ HostKeyId -> (string) - * [AWS CLI 2.38.0 Command Reference](../../index.html) » + * [AWS CLI 2.38.1 Command Reference](../../index.html) »