AWS cli: Clarify DB cluster snapshot encryption key type docs
Summary
Updated the Encrypted field description for DBClusterSnapshot to explain AWS managed vs customer managed keys and note that data at rest is still encrypted when using an AWS owned key (StorageEncryptionType sse-rds). Also bumped AWS CLI version reference to 2.38.3.
Security assessment
Documents encryption key-type semantics for RDS cluster snapshots, clarifying that data at rest remains encrypted even when Encrypted reports false. Security-relevant documentation, not a specific vulnerability fix.
Evidence
>> Specifies whether the DB cluster snapshot is encrypted with an Amazon Web Services managed key or a customer managed key.
Diff
diff --git a/cli/latest/reference/rds/create-db-cluster-snapshot.md b/cli/latest/reference/rds/create-db-cluster-snapshot.md index b6610d8..1829eb9 100644 --- a//cli/latest/reference/rds/create-db-cluster-snapshot.md +++ b//cli/latest/reference/rds/create-db-cluster-snapshot.md @@ -15 +15 @@ - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) » @@ -407 +407,3 @@ DBClusterSnapshot -> (structure) ->> Indicates whether the DB cluster snapshot is encrypted. +>> Specifies whether the DB cluster snapshot is encrypted with an Amazon Web Services managed key or a customer managed key. +>> +>> If the DB cluster snapshot is encrypted with an Amazon Web Services owned key, this value is `false` and `StorageEncryptionType` is `sse-rds` . In that case, the data at rest is still encrypted. To determine how the data at rest is protected, use `StorageEncryptionType` . @@ -503 +505 @@ DBClusterSnapshot -> (structure) - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) »