AWS cli: RDS: clarify encryption field in promote-read-replica-db-cluster

Service: cli · 2026-10-21 · Documentation medium

File: cli/latest/reference/rds/promote-read-replica-db-cluster.md · Type: encryption

Summary

CLI reference version bump 2.38.2→2.38.3 and a rewritten DBCluster 'Encrypted' description explaining AWS owned vs customer managed key encryption and reference to StorageEncryptionType.

Security assessment

The modified line documents encryption key provenance for the DB cluster returned by this command, helping users verify at-rest protection post-promotion. It is descriptive encryption guidance rather than a security fix.

Evidence

>>> Specifies whether the DB cluster is encrypted with an Amazon Web Services managed key or a customer managed key.

Diff

diff --git a/cli/latest/reference/rds/promote-read-replica-db-cluster.md b/cli/latest/reference/rds/promote-read-replica-db-cluster.md
index 10ebb9a..87540dd 100644
--- a//cli/latest/reference/rds/promote-read-replica-db-cluster.md
+++ b//cli/latest/reference/rds/promote-read-replica-db-cluster.md
@@ -15 +15 @@
-  * [AWS CLI 2.38.2 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.3 Command Reference](../../index.html) »
@@ -479 +479,3 @@ DBCluster -> (structure)
->> Indicates whether the DB cluster is encrypted.
+>> Specifies whether the DB cluster is encrypted with an Amazon Web Services managed key or a customer managed key.
+>> 
+>> If the DB cluster is encrypted with an Amazon Web Services owned key, this value is `false` and `StorageEncryptionType` is `sse-rds` . In that case, the data at rest is still encrypted. To determine how the data at rest is protected, use `StorageEncryptionType` .
@@ -1145 +1147 @@ DBCluster -> (structure)
-  * [AWS CLI 2.38.2 Command Reference](../../index.html) »
+  * [AWS CLI 2.38.3 Command Reference](../../index.html) »