AWS lambda high security documentation change
Summary
Added detailed documentation about SSL/TLS requirements for Amazon RDS connections, including specific implementation examples for different programming languages and deployment methods (zip vs container images). Removed some tip sections and reorganized content.
Security assessment
The change explicitly adds documentation about SSL/TLS security requirements for database connections, including certificate handling and secure connection configurations for multiple programming languages. This directly relates to security best practices for secure database communications.
Diff
diff --git a/lambda/latest/dg/services-rds.md index 050523960..26977bf87 100644 --- a/lambda/latest/dg/services-rds.md +++ b/lambda/latest/dg/services-rds.md @@ -12,0 +13,2 @@ We recommend using Amazon RDS Proxy for Lambda functions that make frequent shor +###### Tip + @@ -28,4 +29,0 @@ After you've connected your function to a database, you can create a proxy by ch -###### Tip - -For many serverless use cases, Amazon DynamoDB can be a better option than Amazon RDS. If you're not sure which database service is best for your particular use case, see [Select a database service for your Lambda-based applications](./ddb-rds-database-decision.html). - @@ -52 +52,0 @@ You need the Amazon RDS Proxy permissions only if you configure an Amazon RDS Pr -###### Example permission policy @@ -124,0 +125 @@ You need the Amazon RDS Proxy permissions only if you configure an Amazon RDS Pr +Amazon RDS charges an hourly rate for proxies based on the database instance size, see [RDS Proxy pricing](https://aws.amazon.com/rds/proxy/pricing/) for details. For more information on proxy connections in general, see [Using Amazon RDS Proxy](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html) in the Amazon RDS User Guide. @@ -125,0 +127 @@ You need the Amazon RDS Proxy permissions only if you configure an Amazon RDS Pr +### SSL/TLS requirements for Amazon RDS connections @@ -126,0 +129 @@ You need the Amazon RDS Proxy permissions only if you configure an Amazon RDS Pr +To make secure SSL/TLS connections to an Amazon RDS database instance, your Lambda function must verify the database server's identity using a trusted certificate. Lambda handles these certificates differently depending on your deployment package type: @@ -127,0 +131 @@ You need the Amazon RDS Proxy permissions only if you configure an Amazon RDS Pr + * [.zip file archives](./configuration-function-zip.html): Lambda's managed runtimes include both Certificate Authority (CA) certificates and the certificates required for connections to Amazon RDS database instances. It might take up to 4 weeks for Amazon RDS certificates for new AWS Regions to be added to the Lambda managed runtimes. @@ -129 +133,52 @@ You need the Amazon RDS Proxy permissions only if you configure an Amazon RDS Pr -Amazon RDS charges an hourly rate for proxies based on the database instance size, see [RDS Proxy pricing](https://aws.amazon.com/rds/proxy/pricing/) for details. For more information on proxy connections in general, see [Using Amazon RDS Proxy](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html) in the Amazon RDS User Guide. + * [Container images](./images-create.html): AWS base images include only CA certificates. If your function connects to an Amazon RDS database instance, you must include the appropriate certificates in your container image. In your Dockerfile, download the [certificate bundle that corresponds with the AWS Region where you host your database.](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesDownload) Example: + + RUN curl https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem -o /us-east-1-bundle.pem + + + + +This command downloads the Amazon RDS certificate bundle and saves it at the absolute path `/us-east-1-bundle.pem` in your container's root directory. When configuring the database connection in your function code, you must reference this exact path. Example: + +Node.js + + +The `readFileSync` function is required because Node.js database clients need the actual certificate content in memory, not just the path to the certificate file. Without `readFileSync`, the client interprets the path string as certificate content, resulting in a "self-signed certificate in certificate chain" error. + +###### Example Node.js connection config for OCI function + + + import { readFileSync } from 'fs'; + + // ... + + let connectionConfig = { + host: process.env.ProxyHostName, + user: process.env.DBUserName, + password: token, + database: process.env.DBName, + ssl: { + ca: readFileSync('/us-east-1-bundle.pem') // Load RDS certificate content from file into memory + } + }; + +Python + + +###### Example Python connection config for OCI function + + + connection = pymysql.connect( + host=proxy_host_name, + user=db_username, + password=token, + db=db_name, + port=port, + ssl={'ca': '/us-east-1-bundle.pem'} #Path to the certificate in container + ) + +Java + + +For Java functions using JDBC connections, the connection string must include: + + * `useSSL=true` @@ -131 +186 @@ Amazon RDS charges an hourly rate for proxies based on the database instance siz -###### Lambda and Amazon RDS setup + * `requireSSL=true` @@ -133 +188,78 @@ Amazon RDS charges an hourly rate for proxies based on the database instance siz -Both Lambda and Amazon RDS consoles will assist you in automatically configuring some of the required resources to make a connection between Lambda and Amazon RDS. + * An `sslCA` parameter that points to the location of the Amazon RDS certificate in the container image + + + + +###### Example Java connection string for OCI function + + + // Define connection string + String connectionString = String.format("jdbc:mysql://%s:%s/%s?useSSL=true&requireSSL=true&sslCA=/us-east-1-bundle.pem", // Path to the certificate in container + System.getenv("ProxyHostName"), + System.getenv("Port"), + System.getenv("DBName")); + +.NET + + +###### Example .NET connection string for MySQL connection in OCI function + + + /// Build the Connection String with the Token + string connectionString = $"Server={Environment.GetEnvironmentVariable("RDS_ENDPOINT")};" + + $"Port={Environment.GetEnvironmentVariable("RDS_PORT")};" + + $"Uid={Environment.GetEnvironmentVariable("RDS_USERNAME")};" + + $"Pwd={authToken};" + + "SslMode=Required;" + + "SslCa=/us-east-1-bundle.pem"; // Path to the certificate in container + +Go + + +For Go functions using MySQL connections, load the Amazon RDS certificate into a certificate pool and register it with the MySQL driver. The connection string must then reference this configuration using the `tls` parameter. + +###### Example Go code for MySQL connection in OCI function + + + import ( + "crypto/tls" + "crypto/x509" + "os" + "github.com/go-sql-driver/mysql" + ) + + ... + + // Create certificate pool and register TLS config + rootCertPool := x509.NewCertPool() + pem, err := os.ReadFile("/us-east-1-bundle.pem") // Path to the certificate in container + if err != nil { + panic("failed to read certificate file: " + err.Error()) + } + if ok := rootCertPool.AppendCertsFromPEM(pem); !ok { + panic("failed to append PEM") + } + + mysql.RegisterTLSConfig("custom", &tls.Config{ + RootCAs: rootCertPool, + }) + + dsn := fmt.Sprintf("%s:%s@tcp(%s)/%s?allowCleartextPasswords=true&tls=custom", + dbUser, authenticationToken, dbEndpoint, dbName, + ) + +Ruby + + +###### Example Ruby connection config for OCI function + + + conn = Mysql2::Client.new( + host: endpoint, + username: user, + password: token, + port: port, + database: db_name, + sslca: '/us-east-1-bundle.pem', # Path to the certificate in container + sslverify: true + ) @@ -137 +269,5 @@ Both Lambda and Amazon RDS consoles will assist you in automatically configuring -The following code example shows how to implement a Lambda function that connects to an Amazon RDS database. The function makes a simple database request and returns the result. +The following code examples shows how to implement a Lambda function that connects to an Amazon RDS database. The function makes a simple database request and returns the result. + +###### Note + +These code examples are valid for [.zip deployment packages](./configuration-function-zip.html) only. If you're deploying your function using a [container image,](./images-create.html) you must specify the Amazon RDS certificate file in your function code, as explained in the preceding section.