AWS AWSCloudFormation documentation change
Summary
Updated Multi-AZ DB cluster example template to add encryption, CloudWatch logs export, deletion protection, and explicit MySQL engine configuration. Removed user/password parameters in favor of master password with NoEcho.
Security assessment
Added security features include StorageEncrypted: true and DeletionProtection: true which are security best practices. NoEcho for MasterPassword prevents credential exposure. However, there's no evidence this addresses a specific security vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.md b/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.md index 6f6fc534d..5ea01692d 100644 --- a/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.md +++ b/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.md @@ -1838 +1838 @@ The following example creates an Amazon Aurora PostgreSQL DB cluster that export -The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a writer DB instance and two reader DB instances in three separate Availability Zones in the same AWS Region. Multi-AZ DB clusters provide high availability, increased capacity for read workloads, and lower write latency. You must specify a supported DB engine and DB engine version while creating a Multi-AZ DB cluster. For more information, see [Multi-AZ DB cluster deployments](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/multi-az-db-clusters-concepts.html) in the _Amazon RDS User Guide_. +The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster provides high availability by maintaining standby replicas in different Availability Zones. This template creates a DB cluster and automatically provisions the required reader and writer DB instances. For more information, see [Multi-AZ DB cluster deployments](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/multi-az-db-clusters-concepts.html) in the _Amazon RDS User Guide_. @@ -1845 +1845 @@ The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a - "Description": "AWS CloudFormation Sample Template for creating a Multi-AZ DB cluster.", + "Description": "CloudFormation template to create a MySQL Multi-AZ DB cluster with encryption, CloudWatch logs, deletion protection, and allocated storage.", @@ -1847,12 +1847 @@ The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a - "DBUsername": { - "NoEcho": "true", - "Description": "Username for database access", - "Type": "String", - "MinLength": "1", - "MaxLength": "16", - "AllowedPattern": "[a-zA-Z][a-zA-Z0-9]*", - "ConstraintDescription": "Must begin with a letter and contain only alphanumeric characters." - }, - "DBPassword": { - "NoEcho": "true", - "Description": "Password for database access", + "MasterPassword": { @@ -1860,19 +1849,2 @@ The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a - "MinLength": "8", - "MaxLength": "41", - "AllowedPattern": "[a-zA-Z0-9]*", - "ConstraintDescription": "Must contain only alphanumeric characters." - }, - "DBClusterIdentifier": { - "Type": "String" - }, - "Engine": { - "Type": "String" - }, - "EngineVersion": { - "Type": "String" - }, - "AllocatedStorage": { - "Type": "Number" - }, - "Iops": { - "Type": "Number" + "NoEcho": true, + "Description": "The master password for the DB cluster." @@ -1882 +1854 @@ The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a - "MultiAZDBCluster": { + "MyDBCluster": { @@ -1885,24 +1857,15 @@ The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a - "MasterUsername": { - "Ref": "DBUsername" - }, - "MasterUserPassword": { - "Ref": "DBPassword" - }, - "DBClusterIdentifier": { - "Ref": "DBClusterIdentifier" - }, - "Engine": { - "Ref": "Engine" - }, - "EngineVersion": { - "Ref": "EngineVersion" - }, - "AllocatedStorage": { - "Ref": "AllocatedStorage" - }, - "Iops": { - "Ref": "Iops" - }, - "DBClusterInstanceClass": "db.r6gd.xlarge", - "BackupRetentionPeriod": 1, - "StorageType": "io1" + "Engine": "mysql", + "EngineVersion": "8.0.32", + "DatabaseName": "MyDatabase", + "MasterUsername": "admin", + "MasterUserPassword": { "Ref": "MasterPassword" }, + "StorageEncrypted": true, + "EnableCloudwatchLogsExports": [ + "error", + "general", + "slowquery" + ], + "DeletionProtection": true, + "AllocatedStorage": 20, + "DBClusterInstanceClass": "db.m5d.xlarge", + "StorageType": "gp3" @@ -1920,2 +1880,2 @@ The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a - AWSTemplateFormatVersion: 2010-09-09 - Description: AWS CloudFormation Sample Template for creating a Multi-AZ DB cluster. + AWSTemplateFormatVersion: "2010-09-09" + Description: "CloudFormation template to create a MySQL Multi-AZ DB cluster with encryption, CloudWatch logs, deletion protection, and allocated storage." @@ -1923,3 +1883 @@ The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a - DBUsername: - NoEcho: 'true' - Description: Username for database access + MasterPassword: @@ -1927,22 +1885,2 @@ The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a - MinLength: '1' - MaxLength: '16' - AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*' - ConstraintDescription: Must begin with a letter and contain only alphanumeric characters. - DBPassword: - NoEcho: 'true' - Description: Password for database access - Type: String - MinLength: '8' - MaxLength: '41' - AllowedPattern: '[a-zA-Z0-9]*' - ConstraintDescription: Must contain only alphanumeric characters. - DBClusterIdentifier: - Type: String - Engine: - Type: String - EngineVersion: - Type: String - AllocatedStorage: - Type: Number - Iops: - Type: Number + NoEcho: true + Description: "The master password for the DB cluster." @@ -1950,2 +1888,2 @@ The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a - MultiAZDBCluster: - Type: 'AWS::RDS::DBCluster' + MyDBCluster: + Type: AWS::RDS::DBCluster @@ -1953,10 +1891,14 @@ The following example creates a Multi-AZ DB cluster. A Multi-AZ DB cluster has a - MasterUsername: !Ref DBUsername - MasterUserPassword: !Ref DBPassword - DBClusterIdentifier: !Ref DBClusterIdentifier - Engine: !Ref Engine - EngineVersion: !Ref EngineVersion - AllocatedStorage: !Ref AllocatedStorage - Iops: !Ref Iops - DBClusterInstanceClass: db.r6gd.xlarge - BackupRetentionPeriod: 1 - StorageType: io1 + Engine: mysql + EngineVersion: "8.0.32" + DatabaseName: MyDatabase + MasterUsername: admin + MasterUserPassword: !Ref MasterPassword + StorageEncrypted: true + EnableCloudwatchLogsExports: + - "error" + - "general" + - "slowquery" + DeletionProtection: true + AllocatedStorage: 20 + DBClusterInstanceClass: db.m5d.xlarge + StorageType: gp3