AWS AmazonRDS medium security documentation change
Summary
Added requirement for CONNECT privilege when creating new PostgreSQL users for RDS Proxy access
Security assessment
Explicitly addresses a security-related configuration requirement (CONNECT privilege) that could lead to connection failures if misconfigured. While not a vulnerability disclosure, it documents security-relevant access control requirements.
Diff
diff --git a/AmazonRDS/latest/UserGuide/rds-proxy-connecting.md b/AmazonRDS/latest/UserGuide/rds-proxy-connecting.md index 4af783d54..bdf605611 100644 --- a/AmazonRDS/latest/UserGuide/rds-proxy-connecting.md +++ b/AmazonRDS/latest/UserGuide/rds-proxy-connecting.md @@ -96 +96 @@ Under some conditions, a proxy can't share a database connection and instead pin -For PostgreSQL, when a client starts a connection to a PostgreSQL database, it sends a startup message. This message includes pairs of parameter name and value strings. For details, see the `StartupMessage` in [PostgreSQL message formats](https://www.postgresql.org/docs/current/protocol-message-formats.html) in the PostgreSQL documentation. +If you create a new PostgreSQL database user for connecting to RDS Proxy, make sure that you grant the user `CONNECT` privilege on the database. Without this, the user can't establish a connection. For more information, see [Adding a new database user to a PostgreSQL database when using RDS Proxy](./rds-proxy-new-db-user.html#rds-proxy-new-db-user-pg). @@ -98 +98,3 @@ For PostgreSQL, when a client starts a connection to a PostgreSQL database, it s -When connecting through an RDS proxy, the startup message can include the following currently recognized parameters: +When a client starts a connection to a PostgreSQL database, it sends a startup message. This message includes pairs of parameter name and value strings. For details, see the `StartupMessage` in [PostgreSQL message formats](https://www.postgresql.org/docs/current/protocol-message-formats.html) in the PostgreSQL documentation. + +When you connect through an RDS proxy, the startup message can include the following currently recognized parameters: