aws-cdk-lib 2.178.2__py3-none-any.whl → 2.180.0__py3-none-any.whl

aws_cdk/aws_datasync/__init__.py

@@ -5630,7 +5630,7 @@ class CfnLocationSMB(
     metaclass=jsii.JSIIMeta,
     jsii_type="aws-cdk-lib.aws_datasync.CfnLocationSMB",
 ):
-    '''The ``AWS::DataSync::LocationSMB`` resource specifies a Server Message Block (SMB) location.
+    '''The ``AWS::DataSync::LocationSMB`` resource specifies a Server Message Block (SMB) location that AWS DataSync can use as a transfer source or destination.
 
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html
     :cloudformationResource: AWS::DataSync::LocationSMB
@@ -5644,10 +5644,14 @@ class CfnLocationSMB(
         
         cfn_location_sMB = datasync.CfnLocationSMB(self, "MyCfnLocationSMB",
             agent_arns=["agentArns"],
-            user="user",
         
             # the properties below are optional
+            authentication_type="authenticationType",
+            dns_ip_addresses=["dnsIpAddresses"],
             domain="domain",
+            kerberos_keytab="kerberosKeytab",
+            kerberos_krb5_conf="kerberosKrb5Conf",
+            kerberos_principal="kerberosPrincipal",
             mount_options=datasync.CfnLocationSMB.MountOptionsProperty(
                 version="version"
             ),
@@ -5657,7 +5661,8 @@ class CfnLocationSMB(
             tags=[CfnTag(
                 key="key",
                 value="value"
-            )]
+            )],
+            user="user"
         )
     '''
 
@@ -5667,25 +5672,35 @@ class CfnLocationSMB(
         id: builtins.str,
         *,
         agent_arns: typing.Sequence[builtins.str],
-        user: builtins.str,
+        authentication_type: typing.Optional[builtins.str] = None,
+        dns_ip_addresses: typing.Optional[typing.Sequence[builtins.str]] = None,
         domain: typing.Optional[builtins.str] = None,
+        kerberos_keytab: typing.Optional[builtins.str] = None,
+        kerberos_krb5_conf: typing.Optional[builtins.str] = None,
+        kerberos_principal: typing.Optional[builtins.str] = None,
         mount_options: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnLocationSMB.MountOptionsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         password: typing.Optional[builtins.str] = None,
         server_hostname: typing.Optional[builtins.str] = None,
         subdirectory: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+        user: typing.Optional[builtins.str] = None,
     ) -> None:
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param agent_arns: The Amazon Resource Names (ARNs) of agents to use for a Server Message Block (SMB) location.
-        :param user: The user who can mount the share and has the permissions to access files and folders in the SMB share. For information about choosing a user name that ensures sufficient permissions to files, folders, and metadata, see `user <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#SMBuser>`_ .
+        :param agent_arns: Specifies the DataSync agent (or agents) that can connect to your SMB file server. You specify an agent by using its Amazon Resource Name (ARN).
+        :param authentication_type: Specifies the authentication protocol that DataSync uses to connect to your SMB file server. DataSync supports ``NTLM`` (default) and ``KERBEROS`` authentication. For more information, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
+        :param dns_ip_addresses: Specifies the IPv4 addresses for the DNS servers that your SMB file server belongs to. This parameter applies only if ``AuthenticationType`` is set to ``KERBEROS`` . If you have multiple domains in your environment, configuring this parameter makes sure that DataSync connects to the right SMB file server.
         :param domain: Specifies the Windows domain name that your SMB file server belongs to. This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` . If you have multiple domains in your environment, configuring this parameter makes sure that DataSync connects to the right file server.
+        :param kerberos_keytab: Specifies your Kerberos key table (keytab) file, which includes mappings between your Kerberos principal and encryption keys. The file must be base64 encoded. To avoid task execution errors, make sure that the Kerberos principal that you use to create the keytab file matches exactly what you specify for ``KerberosPrincipal`` .
+        :param kerberos_krb5_conf: Specifies a Kerberos configuration file ( ``krb5.conf`` ) that defines your Kerberos realm configuration. The file must be base64 encoded.
+        :param kerberos_principal: Specifies a Kerberos prinicpal, which is an identity in your Kerberos realm that has permission to access the files, folders, and file metadata in your SMB file server. A Kerberos principal might look like ``HOST/kerberosuser@MYDOMAIN.ORG`` . Principal names are case sensitive. Your DataSync task execution will fail if the principal that you specify for this parameter doesn’t exactly match the principal that you use to create the keytab file.
         :param mount_options: Specifies the version of the SMB protocol that DataSync uses to access your SMB file server.
-        :param password: The password of the user who can mount the share and has the permissions to access files and folders in the SMB share.
+        :param password: Specifies the password of the user who can mount your SMB file server and has permission to access the files and folders involved in your transfer. This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` .
         :param server_hostname: Specifies the domain name or IP address of the SMB file server that your DataSync agent will mount. Remember the following when configuring this parameter: - You can't specify an IP version 6 (IPv6) address. - If you're using Kerberos authentication, you must specify a domain name.
-        :param subdirectory: The subdirectory in the SMB file system that is used to read data from the SMB source location or write data to the SMB destination. The SMB path should be a path that's exported by the SMB server, or a subdirectory of that path. The path should be such that it can be mounted by other SMB clients in your network. .. epigraph:: ``Subdirectory`` must be specified with forward slashes. For example, ``/path/to/folder`` . To transfer all the data in the folder you specified, DataSync must have permissions to mount the SMB share, as well as to access all the data in that share. To ensure this, either make sure that the user name and password specified belongs to the user who can mount the share, and who has the appropriate permissions for all of the files and directories that you want DataSync to access, or use credentials of a member of the Backup Operators group to mount the share. Doing either one enables the agent to access the data. For the agent to access directories, you must additionally enable all execute access.
+        :param subdirectory: Specifies the name of the share exported by your SMB file server where DataSync will read or write data. You can include a subdirectory in the share path (for example, ``/path/to/subdirectory`` ). Make sure that other SMB clients in your network can also mount this path. To copy all data in the subdirectory, DataSync must be able to mount the SMB share and access all of its data. For more information, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
         :param tags: Specifies labels that help you categorize, filter, and search for your AWS resources. We recommend creating at least a name tag for your location.
+        :param user: Specifies the user that can mount and access the files, folders, and file metadata in your SMB file server. This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` . For information about choosing a user with the right level of access for your transfer, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__bafa6101408857d4661895c88a8c9839da8768aa52e07d3f2889a4f27c1cab7d)
@@ -5693,13 +5708,18 @@ class CfnLocationSMB(
             check_type(argname="argument id", value=id, expected_type=type_hints["id"])
         props = CfnLocationSMBProps(
             agent_arns=agent_arns,
-            user=user,
+            authentication_type=authentication_type,
+            dns_ip_addresses=dns_ip_addresses,
             domain=domain,
+            kerberos_keytab=kerberos_keytab,
+            kerberos_krb5_conf=kerberos_krb5_conf,
+            kerberos_principal=kerberos_principal,
             mount_options=mount_options,
             password=password,
             server_hostname=server_hostname,
             subdirectory=subdirectory,
             tags=tags,
+            user=user,
         )
 
         jsii.create(self.__class__, self, [scope, id, props])
@@ -5737,7 +5757,7 @@ class CfnLocationSMB(
     @builtins.property
     @jsii.member(jsii_name="attrLocationArn")
     def attr_location_arn(self) -> builtins.str:
-        '''The Amazon Resource Name (ARN) of the specified SMB file system.
+        '''The Amazon Resource Name (ARN) of the specified SMB location.
 
         :cloudformationAttribute: LocationArn
         '''
@@ -5766,7 +5786,7 @@ class CfnLocationSMB(
     @builtins.property
     @jsii.member(jsii_name="agentArns")
     def agent_arns(self) -> typing.List[builtins.str]:
-        '''The Amazon Resource Names (ARNs) of agents to use for a Server Message Block (SMB) location.'''
+        '''Specifies the DataSync agent (or agents) that can connect to your SMB file server.'''
         return typing.cast(typing.List[builtins.str], jsii.get(self, "agentArns"))
 
     @agent_arns.setter
@@ -5777,17 +5797,33 @@ class CfnLocationSMB(
         jsii.set(self, "agentArns", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
-    @jsii.member(jsii_name="user")
-    def user(self) -> builtins.str:
-        '''The user who can mount the share and has the permissions to access files and folders in the SMB share.'''
-        return typing.cast(builtins.str, jsii.get(self, "user"))
+    @jsii.member(jsii_name="authenticationType")
+    def authentication_type(self) -> typing.Optional[builtins.str]:
+        '''Specifies the authentication protocol that DataSync uses to connect to your SMB file server.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "authenticationType"))
 
-    @user.setter
-    def user(self, value: builtins.str) -> None:
+    @authentication_type.setter
+    def authentication_type(self, value: typing.Optional[builtins.str]) -> None:
         if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__9112e8b177e52fbd055f221015988972f906f8c7291b4a1992bb1656cd033faa)
+            type_hints = typing.get_type_hints(_typecheckingstub__35de39b9b573d0d6146fa84be08e6a3a14ff5e9ece5535c93fc8af130af7e7ec)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "user", value) # pyright: ignore[reportArgumentType]
+        jsii.set(self, "authenticationType", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="dnsIpAddresses")
+    def dns_ip_addresses(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''Specifies the IPv4 addresses for the DNS servers that your SMB file server belongs to.'''
+        return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "dnsIpAddresses"))
+
+    @dns_ip_addresses.setter
+    def dns_ip_addresses(
+        self,
+        value: typing.Optional[typing.List[builtins.str]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__dc011a04f6ce95bde8af4cc9451501d73cdf7696b6089617c22a1d8aa112d7be)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "dnsIpAddresses", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="domain")
@@ -5802,6 +5838,45 @@ class CfnLocationSMB(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "domain", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="kerberosKeytab")
+    def kerberos_keytab(self) -> typing.Optional[builtins.str]:
+        '''Specifies your Kerberos key table (keytab) file, which includes mappings between your Kerberos principal and encryption keys.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "kerberosKeytab"))
+
+    @kerberos_keytab.setter
+    def kerberos_keytab(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__74fc190fdc2f31d122e3c45cd869d31a306df6776a8caddf1830167f3214debc)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "kerberosKeytab", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="kerberosKrb5Conf")
+    def kerberos_krb5_conf(self) -> typing.Optional[builtins.str]:
+        '''Specifies a Kerberos configuration file ( ``krb5.conf`` ) that defines your Kerberos realm configuration.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "kerberosKrb5Conf"))
+
+    @kerberos_krb5_conf.setter
+    def kerberos_krb5_conf(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__d1e34017ad54f22c713305b9e5355f32b709250ee9d89bf9ddd5651db6262fe3)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "kerberosKrb5Conf", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="kerberosPrincipal")
+    def kerberos_principal(self) -> typing.Optional[builtins.str]:
+        '''Specifies a Kerberos prinicpal, which is an identity in your Kerberos realm that has permission to access the files, folders, and file metadata in your SMB file server.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "kerberosPrincipal"))
+
+    @kerberos_principal.setter
+    def kerberos_principal(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__71a591aeeba7a3256f1ac811d47472f85fdd97df1cc6aa28a4e2da297f073aa8)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "kerberosPrincipal", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="mountOptions")
     def mount_options(
@@ -5823,7 +5898,7 @@ class CfnLocationSMB(
     @builtins.property
     @jsii.member(jsii_name="password")
     def password(self) -> typing.Optional[builtins.str]:
-        '''The password of the user who can mount the share and has the permissions to access files and folders in the SMB share.'''
+        '''Specifies the password of the user who can mount your SMB file server and has permission to access the files and folders involved in your transfer.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "password"))
 
     @password.setter
@@ -5849,7 +5924,7 @@ class CfnLocationSMB(
     @builtins.property
     @jsii.member(jsii_name="subdirectory")
     def subdirectory(self) -> typing.Optional[builtins.str]:
-        '''The subdirectory in the SMB file system that is used to read data from the SMB source location or write data to the SMB destination.'''
+        '''Specifies the name of the share exported by your SMB file server where DataSync will read or write data.'''
         return typing.cast(typing.Optional[builtins.str], jsii.get(self, "subdirectory"))
 
     @subdirectory.setter
@@ -5872,6 +5947,19 @@ class CfnLocationSMB(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "tagsRaw", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="user")
+    def user(self) -> typing.Optional[builtins.str]:
+        '''Specifies the user that can mount and access the files, folders, and file metadata in your SMB file server.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "user"))
+
+    @user.setter
+    def user(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__9112e8b177e52fbd055f221015988972f906f8c7291b4a1992bb1656cd033faa)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "user", value) # pyright: ignore[reportArgumentType]
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_datasync.CfnLocationSMB.MountOptionsProperty",
         jsii_struct_bases=[],
@@ -5946,13 +6034,18 @@ class CfnLocationSMB(
     jsii_struct_bases=[],
     name_mapping={
         "agent_arns": "agentArns",
-        "user": "user",
+        "authentication_type": "authenticationType",
+        "dns_ip_addresses": "dnsIpAddresses",
         "domain": "domain",
+        "kerberos_keytab": "kerberosKeytab",
+        "kerberos_krb5_conf": "kerberosKrb5Conf",
+        "kerberos_principal": "kerberosPrincipal",
         "mount_options": "mountOptions",
         "password": "password",
         "server_hostname": "serverHostname",
         "subdirectory": "subdirectory",
         "tags": "tags",
+        "user": "user",
     },
 )
 class CfnLocationSMBProps:
@@ -5960,24 +6053,34 @@ class CfnLocationSMBProps:
         self,
         *,
         agent_arns: typing.Sequence[builtins.str],
-        user: builtins.str,
+        authentication_type: typing.Optional[builtins.str] = None,
+        dns_ip_addresses: typing.Optional[typing.Sequence[builtins.str]] = None,
         domain: typing.Optional[builtins.str] = None,
+        kerberos_keytab: typing.Optional[builtins.str] = None,
+        kerberos_krb5_conf: typing.Optional[builtins.str] = None,
+        kerberos_principal: typing.Optional[builtins.str] = None,
         mount_options: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnLocationSMB.MountOptionsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         password: typing.Optional[builtins.str] = None,
         server_hostname: typing.Optional[builtins.str] = None,
         subdirectory: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+        user: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Properties for defining a ``CfnLocationSMB``.
 
-        :param agent_arns: The Amazon Resource Names (ARNs) of agents to use for a Server Message Block (SMB) location.
-        :param user: The user who can mount the share and has the permissions to access files and folders in the SMB share. For information about choosing a user name that ensures sufficient permissions to files, folders, and metadata, see `user <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#SMBuser>`_ .
+        :param agent_arns: Specifies the DataSync agent (or agents) that can connect to your SMB file server. You specify an agent by using its Amazon Resource Name (ARN).
+        :param authentication_type: Specifies the authentication protocol that DataSync uses to connect to your SMB file server. DataSync supports ``NTLM`` (default) and ``KERBEROS`` authentication. For more information, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
+        :param dns_ip_addresses: Specifies the IPv4 addresses for the DNS servers that your SMB file server belongs to. This parameter applies only if ``AuthenticationType`` is set to ``KERBEROS`` . If you have multiple domains in your environment, configuring this parameter makes sure that DataSync connects to the right SMB file server.
         :param domain: Specifies the Windows domain name that your SMB file server belongs to. This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` . If you have multiple domains in your environment, configuring this parameter makes sure that DataSync connects to the right file server.
+        :param kerberos_keytab: Specifies your Kerberos key table (keytab) file, which includes mappings between your Kerberos principal and encryption keys. The file must be base64 encoded. To avoid task execution errors, make sure that the Kerberos principal that you use to create the keytab file matches exactly what you specify for ``KerberosPrincipal`` .
+        :param kerberos_krb5_conf: Specifies a Kerberos configuration file ( ``krb5.conf`` ) that defines your Kerberos realm configuration. The file must be base64 encoded.
+        :param kerberos_principal: Specifies a Kerberos prinicpal, which is an identity in your Kerberos realm that has permission to access the files, folders, and file metadata in your SMB file server. A Kerberos principal might look like ``HOST/kerberosuser@MYDOMAIN.ORG`` . Principal names are case sensitive. Your DataSync task execution will fail if the principal that you specify for this parameter doesn’t exactly match the principal that you use to create the keytab file.
         :param mount_options: Specifies the version of the SMB protocol that DataSync uses to access your SMB file server.
-        :param password: The password of the user who can mount the share and has the permissions to access files and folders in the SMB share.
+        :param password: Specifies the password of the user who can mount your SMB file server and has permission to access the files and folders involved in your transfer. This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` .
         :param server_hostname: Specifies the domain name or IP address of the SMB file server that your DataSync agent will mount. Remember the following when configuring this parameter: - You can't specify an IP version 6 (IPv6) address. - If you're using Kerberos authentication, you must specify a domain name.
-        :param subdirectory: The subdirectory in the SMB file system that is used to read data from the SMB source location or write data to the SMB destination. The SMB path should be a path that's exported by the SMB server, or a subdirectory of that path. The path should be such that it can be mounted by other SMB clients in your network. .. epigraph:: ``Subdirectory`` must be specified with forward slashes. For example, ``/path/to/folder`` . To transfer all the data in the folder you specified, DataSync must have permissions to mount the SMB share, as well as to access all the data in that share. To ensure this, either make sure that the user name and password specified belongs to the user who can mount the share, and who has the appropriate permissions for all of the files and directories that you want DataSync to access, or use credentials of a member of the Backup Operators group to mount the share. Doing either one enables the agent to access the data. For the agent to access directories, you must additionally enable all execute access.
+        :param subdirectory: Specifies the name of the share exported by your SMB file server where DataSync will read or write data. You can include a subdirectory in the share path (for example, ``/path/to/subdirectory`` ). Make sure that other SMB clients in your network can also mount this path. To copy all data in the subdirectory, DataSync must be able to mount the SMB share and access all of its data. For more information, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
         :param tags: Specifies labels that help you categorize, filter, and search for your AWS resources. We recommend creating at least a name tag for your location.
+        :param user: Specifies the user that can mount and access the files, folders, and file metadata in your SMB file server. This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` . For information about choosing a user with the right level of access for your transfer, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html
         :exampleMetadata: fixture=_generated
@@ -5990,10 +6093,14 @@ class CfnLocationSMBProps:
             
             cfn_location_sMBProps = datasync.CfnLocationSMBProps(
                 agent_arns=["agentArns"],
-                user="user",
             
                 # the properties below are optional
+                authentication_type="authenticationType",
+                dns_ip_addresses=["dnsIpAddresses"],
                 domain="domain",
+                kerberos_keytab="kerberosKeytab",
+                kerberos_krb5_conf="kerberosKrb5Conf",
+                kerberos_principal="kerberosPrincipal",
                 mount_options=datasync.CfnLocationSMB.MountOptionsProperty(
                     version="version"
                 ),
@@ -6003,25 +6110,40 @@ class CfnLocationSMBProps:
                 tags=[CfnTag(
                     key="key",
                     value="value"
-                )]
+                )],
+                user="user"
             )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__b20670d7cb18baa1155ccc397df310282442d51b95170ab568e5c0a9cbea5bc8)
             check_type(argname="argument agent_arns", value=agent_arns, expected_type=type_hints["agent_arns"])
-            check_type(argname="argument user", value=user, expected_type=type_hints["user"])
+            check_type(argname="argument authentication_type", value=authentication_type, expected_type=type_hints["authentication_type"])
+            check_type(argname="argument dns_ip_addresses", value=dns_ip_addresses, expected_type=type_hints["dns_ip_addresses"])
             check_type(argname="argument domain", value=domain, expected_type=type_hints["domain"])
+            check_type(argname="argument kerberos_keytab", value=kerberos_keytab, expected_type=type_hints["kerberos_keytab"])
+            check_type(argname="argument kerberos_krb5_conf", value=kerberos_krb5_conf, expected_type=type_hints["kerberos_krb5_conf"])
+            check_type(argname="argument kerberos_principal", value=kerberos_principal, expected_type=type_hints["kerberos_principal"])
             check_type(argname="argument mount_options", value=mount_options, expected_type=type_hints["mount_options"])
             check_type(argname="argument password", value=password, expected_type=type_hints["password"])
             check_type(argname="argument server_hostname", value=server_hostname, expected_type=type_hints["server_hostname"])
             check_type(argname="argument subdirectory", value=subdirectory, expected_type=type_hints["subdirectory"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
+            check_type(argname="argument user", value=user, expected_type=type_hints["user"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "agent_arns": agent_arns,
-            "user": user,
         }
+        if authentication_type is not None:
+            self._values["authentication_type"] = authentication_type
+        if dns_ip_addresses is not None:
+            self._values["dns_ip_addresses"] = dns_ip_addresses
         if domain is not None:
             self._values["domain"] = domain
+        if kerberos_keytab is not None:
+            self._values["kerberos_keytab"] = kerberos_keytab
+        if kerberos_krb5_conf is not None:
+            self._values["kerberos_krb5_conf"] = kerberos_krb5_conf
+        if kerberos_principal is not None:
+            self._values["kerberos_principal"] = kerberos_principal
         if mount_options is not None:
             self._values["mount_options"] = mount_options
         if password is not None:
@@ -6032,10 +6154,14 @@ class CfnLocationSMBProps:
             self._values["subdirectory"] = subdirectory
         if tags is not None:
             self._values["tags"] = tags
+        if user is not None:
+            self._values["user"] = user
 
     @builtins.property
     def agent_arns(self) -> typing.List[builtins.str]:
-        '''The Amazon Resource Names (ARNs) of agents to use for a Server Message Block (SMB) location.
+        '''Specifies the DataSync agent (or agents) that can connect to your SMB file server.
+
+        You specify an agent by using its Amazon Resource Name (ARN).
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-agentarns
         '''
@@ -6044,16 +6170,30 @@ class CfnLocationSMBProps:
         return typing.cast(typing.List[builtins.str], result)
 
     @builtins.property
-    def user(self) -> builtins.str:
-        '''The user who can mount the share and has the permissions to access files and folders in the SMB share.
+    def authentication_type(self) -> typing.Optional[builtins.str]:
+        '''Specifies the authentication protocol that DataSync uses to connect to your SMB file server.
 
-        For information about choosing a user name that ensures sufficient permissions to files, folders, and metadata, see `user <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#SMBuser>`_ .
+        DataSync supports ``NTLM`` (default) and ``KERBEROS`` authentication.
 
-        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-user
+        For more information, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-authenticationtype
         '''
-        result = self._values.get("user")
-        assert result is not None, "Required property 'user' is missing"
-        return typing.cast(builtins.str, result)
+        result = self._values.get("authentication_type")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def dns_ip_addresses(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''Specifies the IPv4 addresses for the DNS servers that your SMB file server belongs to.
+
+        This parameter applies only if ``AuthenticationType`` is set to ``KERBEROS`` .
+
+        If you have multiple domains in your environment, configuring this parameter makes sure that DataSync connects to the right SMB file server.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-dnsipaddresses
+        '''
+        result = self._values.get("dns_ip_addresses")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
 
     @builtins.property
     def domain(self) -> typing.Optional[builtins.str]:
@@ -6068,6 +6208,43 @@ class CfnLocationSMBProps:
         result = self._values.get("domain")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def kerberos_keytab(self) -> typing.Optional[builtins.str]:
+        '''Specifies your Kerberos key table (keytab) file, which includes mappings between your Kerberos principal and encryption keys.
+
+        The file must be base64 encoded.
+
+        To avoid task execution errors, make sure that the Kerberos principal that you use to create the keytab file matches exactly what you specify for ``KerberosPrincipal`` .
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-kerberoskeytab
+        '''
+        result = self._values.get("kerberos_keytab")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def kerberos_krb5_conf(self) -> typing.Optional[builtins.str]:
+        '''Specifies a Kerberos configuration file ( ``krb5.conf`` ) that defines your Kerberos realm configuration.
+
+        The file must be base64 encoded.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-kerberoskrb5conf
+        '''
+        result = self._values.get("kerberos_krb5_conf")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def kerberos_principal(self) -> typing.Optional[builtins.str]:
+        '''Specifies a Kerberos prinicpal, which is an identity in your Kerberos realm that has permission to access the files, folders, and file metadata in your SMB file server.
+
+        A Kerberos principal might look like ``HOST/kerberosuser@MYDOMAIN.ORG`` .
+
+        Principal names are case sensitive. Your DataSync task execution will fail if the principal that you specify for this parameter doesn’t exactly match the principal that you use to create the keytab file.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-kerberosprincipal
+        '''
+        result = self._values.get("kerberos_principal")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def mount_options(
         self,
@@ -6081,7 +6258,9 @@ class CfnLocationSMBProps:
 
     @builtins.property
     def password(self) -> typing.Optional[builtins.str]:
-        '''The password of the user who can mount the share and has the permissions to access files and folders in the SMB share.
+        '''Specifies the password of the user who can mount your SMB file server and has permission to access the files and folders involved in your transfer.
+
+        This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-password
         '''
@@ -6104,14 +6283,11 @@ class CfnLocationSMBProps:
 
     @builtins.property
     def subdirectory(self) -> typing.Optional[builtins.str]:
-        '''The subdirectory in the SMB file system that is used to read data from the SMB source location or write data to the SMB destination.
-
-        The SMB path should be a path that's exported by the SMB server, or a subdirectory of that path. The path should be such that it can be mounted by other SMB clients in your network.
-        .. epigraph::
+        '''Specifies the name of the share exported by your SMB file server where DataSync will read or write data.
 
-           ``Subdirectory`` must be specified with forward slashes. For example, ``/path/to/folder`` .
+        You can include a subdirectory in the share path (for example, ``/path/to/subdirectory`` ). Make sure that other SMB clients in your network can also mount this path.
 
-        To transfer all the data in the folder you specified, DataSync must have permissions to mount the SMB share, as well as to access all the data in that share. To ensure this, either make sure that the user name and password specified belongs to the user who can mount the share, and who has the appropriate permissions for all of the files and directories that you want DataSync to access, or use credentials of a member of the Backup Operators group to mount the share. Doing either one enables the agent to access the data. For the agent to access directories, you must additionally enable all execute access.
+        To copy all data in the subdirectory, DataSync must be able to mount the SMB share and access all of its data. For more information, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-subdirectory
         '''
@@ -6129,6 +6305,19 @@ class CfnLocationSMBProps:
         result = self._values.get("tags")
         return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], result)
 
+    @builtins.property
+    def user(self) -> typing.Optional[builtins.str]:
+        '''Specifies the user that can mount and access the files, folders, and file metadata in your SMB file server.
+
+        This parameter applies only if ``AuthenticationType`` is set to ``NTLM`` .
+
+        For information about choosing a user with the right level of access for your transfer, see `Providing DataSync access to SMB file servers <https://docs.aws.amazon.com/datasync/latest/userguide/create-smb-location.html#configuring-smb-permissions>`_ .
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datasync-locationsmb.html#cfn-datasync-locationsmb-user
+        '''
+        result = self._values.get("user")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -10039,13 +10228,18 @@ def _typecheckingstub__bafa6101408857d4661895c88a8c9839da8768aa52e07d3f2889a4f27
     id: builtins.str,
     *,
     agent_arns: typing.Sequence[builtins.str],
-    user: builtins.str,
+    authentication_type: typing.Optional[builtins.str] = None,
+    dns_ip_addresses: typing.Optional[typing.Sequence[builtins.str]] = None,
     domain: typing.Optional[builtins.str] = None,
+    kerberos_keytab: typing.Optional[builtins.str] = None,
+    kerberos_krb5_conf: typing.Optional[builtins.str] = None,
+    kerberos_principal: typing.Optional[builtins.str] = None,
     mount_options: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnLocationSMB.MountOptionsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     password: typing.Optional[builtins.str] = None,
     server_hostname: typing.Optional[builtins.str] = None,
     subdirectory: typing.Optional[builtins.str] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+    user: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -10068,8 +10262,14 @@ def _typecheckingstub__21ee66e7697fa761c39fe555b5fae211e45dedf33951d3701b7b6389d
     """Type checking stubs"""
     pass
 
-def _typecheckingstub__9112e8b177e52fbd055f221015988972f906f8c7291b4a1992bb1656cd033faa(
-    value: builtins.str,
+def _typecheckingstub__35de39b9b573d0d6146fa84be08e6a3a14ff5e9ece5535c93fc8af130af7e7ec(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__dc011a04f6ce95bde8af4cc9451501d73cdf7696b6089617c22a1d8aa112d7be(
+    value: typing.Optional[typing.List[builtins.str]],
 ) -> None:
     """Type checking stubs"""
     pass
@@ -10080,6 +10280,24 @@ def _typecheckingstub__645408d26d2b2afb233a71045cf02aab2ca6bb9a00176ca0b16d93e1e
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__74fc190fdc2f31d122e3c45cd869d31a306df6776a8caddf1830167f3214debc(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__d1e34017ad54f22c713305b9e5355f32b709250ee9d89bf9ddd5651db6262fe3(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__71a591aeeba7a3256f1ac811d47472f85fdd97df1cc6aa28a4e2da297f073aa8(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__b9983585f73509aeb431e7337689500eb00129c754b73a4ef4022bebcd1bbc1c(
     value: typing.Optional[typing.Union[_IResolvable_da3f097b, CfnLocationSMB.MountOptionsProperty]],
 ) -> None:
@@ -10110,6 +10328,12 @@ def _typecheckingstub__b48314ac3635761aa21132da0f199200c2b741ddeca4e34176ee47fde
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__9112e8b177e52fbd055f221015988972f906f8c7291b4a1992bb1656cd033faa(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__465428a8e33c33a3926562e4b4d3d671db7fc7f2d1ff95443e6224cb280e8c00(
     *,
     version: typing.Optional[builtins.str] = None,
@@ -10120,13 +10344,18 @@ def _typecheckingstub__465428a8e33c33a3926562e4b4d3d671db7fc7f2d1ff95443e6224cb2
 def _typecheckingstub__b20670d7cb18baa1155ccc397df310282442d51b95170ab568e5c0a9cbea5bc8(
     *,
     agent_arns: typing.Sequence[builtins.str],
-    user: builtins.str,
+    authentication_type: typing.Optional[builtins.str] = None,
+    dns_ip_addresses: typing.Optional[typing.Sequence[builtins.str]] = None,
     domain: typing.Optional[builtins.str] = None,
+    kerberos_keytab: typing.Optional[builtins.str] = None,
+    kerberos_krb5_conf: typing.Optional[builtins.str] = None,
+    kerberos_principal: typing.Optional[builtins.str] = None,
     mount_options: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnLocationSMB.MountOptionsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     password: typing.Optional[builtins.str] = None,
     server_hostname: typing.Optional[builtins.str] = None,
     subdirectory: typing.Optional[builtins.str] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+    user: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
     pass