AWS cli: Clarify RDS DB cluster encryption key type in CLI docs
Summary
Expanded the DBCluster Encrypted field documentation to explain AWS managed/customer managed keys and that AWS owned key encryption still protects data at rest; also bumped CLI version.
Security assessment
Documents encryption-at-rest semantics and reduces misinterpretation of Encrypted=false when an AWS owned key is used; no specific vulnerability or incident is referenced.
Evidence
+>> Specifies whether the DB cluster is encrypted with an Amazon Web Services managed key or a customer managed key.
Diff
diff --git a/cli/latest/reference/rds/start-db-cluster.md b/cli/latest/reference/rds/start-db-cluster.md index 8f0248e..a4bc886 100644 --- a//cli/latest/reference/rds/start-db-cluster.md +++ b//cli/latest/reference/rds/start-db-cluster.md @@ -15 +15 @@ - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) » @@ -477 +477,3 @@ DBCluster -> (structure) ->> Indicates whether the DB cluster is encrypted. +>> Specifies whether the DB cluster is encrypted with an Amazon Web Services managed key or a customer managed key. +>> +>> If the DB cluster is encrypted with an Amazon Web Services owned key, this value is `false` and `StorageEncryptionType` is `sse-rds` . In that case, the data at rest is still encrypted. To determine how the data at rest is protected, use `StorageEncryptionType` . @@ -1143 +1145 @@ DBCluster -> (structure) - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) »