AWS dms medium security documentation change
Summary
Added three new data masking transformation rule checks: Digits Randomize, Digits Mask, and Hashing Mask validations
Security assessment
The changes document data masking transformation rules which are security features for protecting sensitive data. The validations specifically warn about transforming columns involved in constraints (PKs, unique indexes, FKs) which could impact data integrity if masked improperly.
Diff
diff --git a/dms/latest/userguide/CHAP_Tasks.AssessmentReport.MySQL.md b/dms/latest/userguide/CHAP_Tasks.AssessmentReport.MySQL.md index a9c1f690c..104775bab 100644 --- a/dms/latest/userguide/CHAP_Tasks.AssessmentReport.MySQL.md +++ b/dms/latest/userguide/CHAP_Tasks.AssessmentReport.MySQL.md @@ -5 +5 @@ -Validate if Binary Log transaction compression is disabledValidate if DMS user has REPLICATION CLIENT and REPLICATION SLAVE permissions for the source databaseValidate if DMS user has SELECT permissions for the source database tablesValidate if the server_id is set to 1 or greater in the source databaseValidate if DMS user has necessary permissions for the MySQL database as a targetValidate if automatic removal of binary logs is set for the source databaseValidate that limited LOB mode only is used when BatchApplyEnabled is set to trueValidate if a table uses a storage engine other than InnodbValidate if auto-increment is enabled on any tables used for migrationValidate if the database binlog image is set to FULL to support DMS CDCValidate if the source database is a MySQL Read-ReplicaValidate if a table has partitions, and recommend target_table_prep_mode for full-load task settingsValidate if DMS supports the database versionValidate if the target database is configured to set local_infile to 1Validate if target database has tables with foreign keysValidate if source tables in the task scope have cascade constraintsValidate if the timeout values are appropriate for a MySQL source or targetValidate max_statement_time database parameterValidate if Primary Key or Unique Index exist on target for Batch ApplyValidate if both Primary Key and Unique index exist on target for Batch ApplyValidate if secondary indexes are enabled during full load on the target databaseValidate if table has primary key or unique index when DMS validation is enabledRecommendation on using MaxFullLoadSubTasks setting +Validate if Binary Log transaction compression is disabledValidate if DMS user has REPLICATION CLIENT and REPLICATION SLAVE permissions for the source databaseValidate if DMS user has SELECT permissions for the source database tablesValidate if the server_id is set to 1 or greater in the source databaseValidate if DMS user has necessary permissions for the MySQL database as a targetValidate if automatic removal of binary logs is set for the source databaseValidate that limited LOB mode only is used when BatchApplyEnabled is set to trueValidate if a table uses a storage engine other than InnodbValidate if auto-increment is enabled on any tables used for migrationValidate if the database binlog image is set to FULL to support DMS CDCValidate if the source database is a MySQL Read-ReplicaValidate if a table has partitions, and recommend target_table_prep_mode for full-load task settingsValidate if DMS supports the database versionValidate if the target database is configured to set local_infile to 1Validate if target database has tables with foreign keysValidate if source tables in the task scope have cascade constraintsValidate if the timeout values are appropriate for a MySQL source or targetValidate max_statement_time database parameterValidate if Primary Key or Unique Index exist on target for Batch ApplyValidate if both Primary Key and Unique index exist on target for Batch ApplyValidate if secondary indexes are enabled during full load on the target databaseValidate if table has primary key or unique index when DMS validation is enabledRecommendation on using MaxFullLoadSubTasks settingCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing mask @@ -58,0 +59,6 @@ This section describes individual premigration assessments for migration tasks t + * Check Transformation Rule for Digits Randomize + + * Check Transformation Rule for Digits mask + + * Check Transformation Rule for Hashing mask + @@ -270,0 +277,18 @@ For more information, see [Full-load task settings](https://docs.aws.amazon.com/ +## Check Transformation Rule for Digits Randomize + +**API key** : `mysql-datamasking-digits-randomize` + +This assessment validates whether columns used in table mappings are compatible with the Digits Randomize transformation rule. Additionally, the assessment checks if any columns selected for transformation are part of primary keys, unique constraints, or foreign keys, as applying digits randomize transformations does not guarantee any uniqueness. + +## Check Transformation Rule for Digits mask + +**API key** : `mysql-datamasking-digits-mask` + +This assessment validates whether any columns used in the table mapping are not supported by the Digits Mask transformation rule. Additionally, the assessment checks if any columns selected for transformation are part of primary keys, unique constraints, or foreign keys, as applying Digits Mask transformations to such columns could cause DMS task failures since uniqueness cannot be guaranteed. + +## Check Transformation Rule for Hashing mask + +**API key** : `mysql-datamasking-hash-mask` + +This assessment validates whether any of the columns used in the table mapping are not supported by the Hashing Mask transformation rule. It also checks if the length of the source column exceeds 64 characters. Ideally, the target column length should be greater than 64 characters to support hash masking. Additionally, the assessment checks if any columns selected for transformation are part of primary keys, unique constraints, or foreign keys, as applying digits randomize transformations does not guarantee any uniqueness. +