AWS SchemaConversionTool high security documentation change
Summary
Expanded installation documentation with detailed verification procedures, OS-specific installation steps, JDBC driver requirements, and CLI information. Added multiple verification methods (checksum validation, RPM/DEB signature checks, Windows digital signature verification) for download integrity.
Security assessment
Added explicit instructions for verifying file integrity through checksums and digital signatures. These changes address potential security risks from compromised downloads by providing validation methods to ensure authenticity.
Diff
diff --git a/SchemaConversionTool/latest/userguide/CHAP_Installing.md b/SchemaConversionTool/latest/userguide/CHAP_Installing.md index 0bf7ebe72..a71d2558a 100644 --- a/SchemaConversionTool/latest/userguide/CHAP_Installing.md +++ b/SchemaConversionTool/latest/userguide/CHAP_Installing.md @@ -5 +5,3 @@ -# Installing and Configuring AWS Schema Conversion Tool +Installing AWS SCT Verifying the AWS SCT file downloadDownloading the required database driversUpdating AWS SCTAWS SCT CLI + +# Installing, verifying, and updating AWS SCT @@ -11 +13,68 @@ To ensure that you get the correct version of the AWS SCT distribution file we p -AWS SCT is available as both a standalone application and a command-line tool. For information about the command line tool, see [AWS Schema Conversion Tool CLI](./CHAP_Installing.CLI.html). +AWS SCT is available as both a standalone application and a command-line tool. For information about the command line tool, see AWS SCT CLI. + +###### Topics + + * Installing AWS SCT + + * Verifying the AWS SCT file download + + * Downloading the required database drivers + + * Updating AWS SCT + + * AWS SCT CLI + + + + +## Installing AWS SCT + +You can install AWS SCT on the following operating systems: + + * Microsoft Windows 10 + + * Fedora Linux 36 and higher + + * Ubuntu Linux 18 and higher + + + + +###### To install AWS SCT + + 1. Download the compressed file that contains the AWS SCT installer, using the link for your operating system. All compressed files have a .zip extension. When you extract the AWS SCT installer file, it will be in the appropriate format for your operating system. + + * [Microsoft Windows](https://s3.amazonaws.com/publicsctdownload/Windows/aws-schema-conversion-tool-1.0.latest.zip) + + * [Ubuntu Linux (.deb)](https://s3.amazonaws.com/publicsctdownload/Ubuntu/aws-schema-conversion-tool-1.0.latest.zip) + + * [Fedora Linux (.rpm)](https://s3.amazonaws.com/publicsctdownload/Fedora/aws-schema-conversion-tool-1.0.latest.zip) + + 2. Extract the AWS SCT installer file for your operating system, shown following. + +Operating system | File name +---|--- +Fedora Linux | `aws-schema-conversion-tool-1.0.`build-number`.x86_64.rpm` +Microsoft Windows | `AWS Schema Conversion Tool-1.0.`build-number`.msi` +Ubuntu Linux | `aws-schema-conversion-tool-1.0.`build-number`.deb` + + 3. Run the AWS SCT installer file extracted in the previous step. Use the instructions for your operating system, shown following. + +Operating system | Install instructions +---|--- +Fedora Linux | Run the following command in the folder that you downloaded the file to: `sudo yum install aws-schema-conversion-tool-1.0.`build-number`.x86_64.rpm` +Microsoft Windows | Double-click the file to run the installer. +Ubuntu Linux | Run the following command in the folder that you downloaded the file to: `sudo dpkg -i aws-schema-conversion-tool-1.0.`build-number`.deb` + + 4. Download the Java Database Connectivity (JDBC) drivers for your source and target database engines. For instructions and download links, see Downloading the required database drivers. + + + + +Now, you have completed the setup of the AWS SCT application. Double-click the application icon to run AWS SCT. + +## Verifying the AWS SCT file download + +There are several ways you can verify the distribution file of AWS SCT. The simplest is to compare the checksum of the file with the published checksum from AWS. As an additional level of security, you can use the procedures following to verify the distribution file, based on the operating system where you installed the file. + +This section includes the following topics. @@ -15 +84,225 @@ AWS SCT is available as both a standalone application and a command-line tool. F - * [Installing AWS Schema Conversion Tool](./CHAP_Installing.Procedure.html) + * Verifying the checksum of the AWS SCT file + + * Verifying the AWS SCT RPM files on Fedora + + * Verifying the AWS SCT DEB files on Ubuntu + + * Verifying the AWS SCT MSI file on Microsoft Windows + + + + +### Verifying the checksum of the AWS SCT file + +In order to detect any errors that could have been introduced when downloading or storing the AWS SCT compressed file, you can compare the file checksum with a value provided by AWS. AWS uses the SHA256 algorithm for the checksum. + +###### To verify the AWS SCT distribution file using a checksum + + 1. Download the AWS SCT distribution file using the links in the Installing section. For more information, see Installing AWS SCT. + + 2. Download the latest checksum file, called [sha256Check.txt](https://d2fk11eyrwr7ob.cloudfront.net/sha256Check.txt). This file includes the checksums for the latest AWS SCT version. For example, the file can appear as follows: + + Fedora b4f5f66f91bfcc1b312e2827e960691c269a9002cd1371cf1841593f88cbb5e6 + Ubuntu 4315eb666449d4fcd95932351f00399adb6c6cf64b9f30adda2eec903c54eca4 + Windows 6e29679a3c53c5396a06d8d50f308981e4ec34bd0acd608874470700a0ae9a23 + + + 3. Run the SHA256 validation command for your operating system in the directory that contains the distribution file. For example, run the following command in Linux. + + shasum -a 256 aws-schema-conversion-tool-1.0.latest.zip + + 4. Compare the results of the command with the value shown in the sha256Check.txt file. If the checksums match, then it is safe to run the distribution file. If the checksums don't match, then don't run the distribution file, and [contact AWS Support](https://aws.amazon.com/contact-us/). + + + + +### Verifying the AWS SCT RPM files on Fedora + +AWS provides another level of validation in addition to the distribution file checksum. All RPM files in the distribution file are signed by an AWS private key. The public GPG key can be viewed at [amazon.com.public.gpg-key](https://d2fk11eyrwr7ob.cloudfront.net/[email protected]). + +###### To verify the AWS SCT RPM files on Fedora + + 1. Download the AWS SCT distribution file using the links in the Installing section. + + 2. Verify the checksum of the AWS SCT distribution file. + + 3. Extract the contents of the distribution file. Locate the RPM file you want to verify. + + 4. Download GPG public key from [ amazon.com.public.gpg-key ](https://d2fk11eyrwr7ob.cloudfront.net/[email protected]) + + 5. Import the public key to your RPM DB (make sure you have the appropriate permissions) by using the following command: + + sudo rpm --import [email protected] + + 6. Check that the import was successful by running the following command: + + rpm -q --qf "%{NAME}-%{VERSION}-%{RELEASE} \n %{SUMMARY} \n" gpg-pubkey-ea22abf4-5a21d30c + + 7. Check the RPM signature by running the following command: + + rpm --checksig -v aws-schema-conversion-tool-1.0.build number-1.x86_64.rpm + + + + +### Verifying the AWS SCT DEB files on Ubuntu + +AWS provides another level of validation in addition to the distribution file checksum. All DEB files in the distribution file are signed by a GPG detached signature. + +###### To verify the AWS SCT DEB files on Ubuntu + + 1. Download the AWS SCT distribution file using the links in the Installing section. + + 2. Verifying the checksum of the AWS SCT distribution file. + + 3. Extract the contents of the distribution file. Locate the DEB file you want to verify. + + 4. Download the detached signature from [aws-schema-conversion-tool-1.0.latest.deb.asc](https://d2fk11eyrwr7ob.cloudfront.net/Ubuntu/signatures/aws-schema-conversion-tool-1.0.latest.deb.asc). + + 5. Download the GPG public key from [amazon.com.public.gpg-key](https://d2fk11eyrwr7ob.cloudfront.net/[email protected]). + + 6. Import the GPG public key by running the following command: + + gpg --import [email protected] + + 7. Verify the signature by running the following command: + + gpg --verify aws-schema-conversion-tool-1.0.latest.deb.asc aws-schema-conversion-tool-1.0.build number.deb + + + + +### Verifying the AWS SCT MSI file on Microsoft Windows + +AWS provides another level of validation in addition to the distribution file checksum. The MSI file has a digital signature you can check to ensure it was signed by AWS. + +###### To verify the AWS SCT MSI file on Windows + + 1. Download the AWS SCT distribution file using the links in the Installing section. + + 2. Verifying the checksum of the AWS SCT distribution file. + + 3. Extract the contents of the distribution file. Locate the MSI file you want to verify. + + 4. In Windows Explorer, right-click the MSI file and select **Properties**. + + 5. Choose the **Digital Signatures** tab. + + 6. Verify that the digital signature is from Amazon Services LLC. + + + + +## Downloading the required database drivers + +For AWS SCT to work correctly, download the JDBC drivers for your source and target database engines. If you use a virtual target database platform, you don't need to download the JDBC driver for your target database engine. For more information, see [Using virtual targets](./CHAP_Mapping.VirtualTargets.html). + +After you download the drivers, you give the location of the driver files. For more information, see Storing driver paths in the global settings. + +You can download the database drivers from the following locations.