AWS cli: RDS: clarify encryption field in failover-db-cluster output
Summary
CLI reference version bump 2.38.2→2.38.3 and a rewritten DBCluster 'Encrypted' description explaining AWS owned vs customer managed key encryption and the StorageEncryptionType indicator.
Security assessment
The added sentence explains that an unencrypted-looking value may still correspond to encrypted at-rest data under an AWS owned key, and tells operators how to verify protection via StorageEncryptionType. Documentation-only encryption clarification; no vulnerability addressed.
Evidence
>>> If the DB cluster is encrypted with an Amazon Web Services owned key, this value is `false` and `StorageEncryptionType` is `sse-rds` . In that case, the data at rest is still encrypted. To determine how the data at rest is protected, use `StorageEncryptionType` .
Diff
diff --git a/cli/latest/reference/rds/failover-db-cluster.md b/cli/latest/reference/rds/failover-db-cluster.md index 1dd9df0..d6d405e 100644 --- a//cli/latest/reference/rds/failover-db-cluster.md +++ b//cli/latest/reference/rds/failover-db-cluster.md @@ -15 +15 @@ - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) » @@ -508 +508,3 @@ DBCluster -> (structure) ->> Indicates whether the DB cluster is encrypted. +>> Specifies whether the DB cluster is encrypted with an Amazon Web Services managed key or a customer managed key. +>> +>> If the DB cluster is encrypted with an Amazon Web Services owned key, this value is `false` and `StorageEncryptionType` is `sse-rds` . In that case, the data at rest is still encrypted. To determine how the data at rest is protected, use `StorageEncryptionType` . @@ -1174 +1176 @@ DBCluster -> (structure) - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) »