AWS cli: RDS: clarify DB cluster snapshot encryption key types

Service: cli · 2026-10-21 · Documentation medium

File: cli/latest/reference/rds/describe-db-cluster-snapshots.md · Type: encryption

Summary

CLI reference version bump 2.38.2→2.38.3, an added nav link (DescribeDBCapacityReservations), and a rewritten 'Encrypted' field description explaining that a false value can still mean data at rest is encrypted (AWS owned key, StorageEncryptionType=sse-rds) and that StorageEncryptionType should be used to determine protection.

Security assessment

The changed line documents which key type (AWS managed vs customer managed) protects a cluster snapshot and clarifies a previously ambiguous 'Encrypted=false' interpretation, directing readers to StorageEncryptionType to verify at-rest protection. This is encryption guidance, not a fix for a specific vulnerability or incident.

Evidence

>>> Specifies whether the DB cluster snapshot is encrypted with an Amazon Web Services managed key or a customer managed key.

Diff

diff --git a/cli/latest/reference/rds/describe-db-cluster-snapshots.md b/cli/latest/reference/rds/describe-db-cluster-snapshots.md
index 2d48953..4f0926d 100644
--- a//cli/latest/reference/rds/describe-db-cluster-snapshots.md
+++ b//cli/latest/reference/rds/describe-db-cluster-snapshots.md
@@ -15 +15 @@
-  * [AWS CLI 2.38.2 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.3 Command Reference](../../index.html) »
@@ -167,0 +168 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rds-20
+>>   * `DescribeDBCapacityReservations`
@@ -519 +520,3 @@ DBClusterSnapshots -> (list)
->>> Indicates whether the DB cluster snapshot is encrypted.
+>>> Specifies whether the DB cluster snapshot is encrypted with an Amazon Web Services managed key or a customer managed key.
+>>> 
+>>> If the DB cluster snapshot is encrypted with an Amazon Web Services owned key, this value is `false` and `StorageEncryptionType` is `sse-rds` . In that case, the data at rest is still encrypted. To determine how the data at rest is protected, use `StorageEncryptionType` .
@@ -615 +618 @@ DBClusterSnapshots -> (list)
-  * [AWS CLI 2.38.2 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.3 Command Reference](../../index.html) »