AWS cli: Clarify DB cluster snapshot encryption key type docs
Summary
Updated the Encrypted field description for DBClusterSnapshot to explain AWS managed vs customer managed keys and note that data at rest is still encrypted when using an AWS owned key (StorageEncryptionType sse-rds). Also bumped AWS CLI version reference to 2.38.3.
Security assessment
The change documents encryption semantics for RDS cluster snapshots, clarifying that Encrypted=false with StorageEncryptionType sse-rds still means data at rest is encrypted. This is security best-practice documentation, not a fix for a specific vulnerability.
Evidence
>> Specifies whether the DB cluster snapshot is encrypted with an Amazon Web Services managed key or a customer managed key.
Diff
diff --git a/cli/latest/reference/rds/copy-db-cluster-snapshot.md b/cli/latest/reference/rds/copy-db-cluster-snapshot.md index 1a2a954..b996971 100644 --- a//cli/latest/reference/rds/copy-db-cluster-snapshot.md +++ b//cli/latest/reference/rds/copy-db-cluster-snapshot.md @@ -15 +15 @@ - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) » @@ -470 +470,3 @@ DBClusterSnapshot -> (structure) ->> Indicates whether the DB cluster snapshot is encrypted. +>> Specifies whether the DB cluster snapshot is encrypted with an Amazon Web Services managed key or a customer managed key. +>> +>> If the DB cluster snapshot is encrypted with an Amazon Web Services owned key, this value is `false` and `StorageEncryptionType` is `sse-rds` . In that case, the data at rest is still encrypted. To determine how the data at rest is protected, use `StorageEncryptionType` . @@ -566 +568 @@ DBClusterSnapshot -> (structure) - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) »