AWS cli: RDS: clarify DB cluster encryption key type in describe-db-clusters
Summary
CLI reference version bump 2.38.2→2.38.3, an added nav link (DescribeDBCapacityReservations), and an expanded 'Encrypted' field description noting that AWS owned keys yield Encrypted=false with StorageEncryptionType=sse-rds while data remains encrypted at rest.
Security assessment
The revised line clarifies encryption semantics for the DB cluster 'Encrypted' field and points to StorageEncryptionType as the authoritative indicator of at-rest protection. This improves encryption transparency/auditing guidance but does not remediate a specific weakness.
Evidence
>>> Specifies whether the DB cluster is encrypted with an Amazon Web Services managed key or a customer managed key.
Diff
diff --git a/cli/latest/reference/rds/describe-db-clusters.md b/cli/latest/reference/rds/describe-db-clusters.md index a22943a..51e90be 100644 --- a//cli/latest/reference/rds/describe-db-clusters.md +++ b//cli/latest/reference/rds/describe-db-clusters.md @@ -15 +15 @@ - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) » @@ -140,0 +141 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rds-20 +>> * `DescribeDBCapacityReservations` @@ -706 +707,3 @@ DBClusters -> (list) ->>> Indicates whether the DB cluster is encrypted. +>>> Specifies whether the DB cluster is encrypted with an Amazon Web Services managed key or a customer managed key. +>>> +>>> If the DB cluster is encrypted with an Amazon Web Services owned key, this value is `false` and `StorageEncryptionType` is `sse-rds` . In that case, the data at rest is still encrypted. To determine how the data at rest is protected, use `StorageEncryptionType` . @@ -1372 +1375 @@ DBClusters -> (list) - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) »