AWS AmazonRDS documentation change
Summary
Added documentation requirement for granting CONNECT privilege to new PostgreSQL users when using RDS Proxy, and reorganized startup message explanation
Security assessment
The change adds guidance about proper user permissions (CONNECT privilege) which is a security best practice, but does not reference any specific vulnerability or incident
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/rds-proxy-connecting.md b/AmazonRDS/latest/AuroraUserGuide/rds-proxy-connecting.md index 6004f570e..28397f0d4 100644 --- a/AmazonRDS/latest/AuroraUserGuide/rds-proxy-connecting.md +++ b/AmazonRDS/latest/AuroraUserGuide/rds-proxy-connecting.md @@ -88 +88 @@ You can grant a specific user access to the proxy by modifying the IAM policy. A -For PostgreSQL, when a client starts a connection to a PostgreSQL database, it sends a startup message. This message includes pairs of parameter name and value strings. For details, see the `StartupMessage` in [PostgreSQL message formats](https://www.postgresql.org/docs/current/protocol-message-formats.html) in the PostgreSQL documentation. +If you create a new PostgreSQL database user for connecting to RDS Proxy, make sure that you grant the user `CONNECT` privilege on the database. Without this, the user can't establish a connection. For more information, see [Adding a new database user to a PostgreSQL database when using RDS Proxy](./rds-proxy-new-db-user.html#rds-proxy-new-db-user-pg). @@ -90 +90,3 @@ For PostgreSQL, when a client starts a connection to a PostgreSQL database, it s -When connecting through an RDS proxy, the startup message can include the following currently recognized parameters: +When a client starts a connection to a PostgreSQL database, it sends a startup message. This message includes pairs of parameter name and value strings. For details, see the `StartupMessage` in [PostgreSQL message formats](https://www.postgresql.org/docs/current/protocol-message-formats.html) in the PostgreSQL documentation. + +When you connect through an RDS proxy, the startup message can include the following currently recognized parameters: