AWS documentdb documentation change
Summary
Added documentation for automatic server certificate rotation and updated CA certificate expiration details
Security assessment
Adds security documentation about TLS certificate management and automatic rotation best practices, but does not address a specific disclosed vulnerability
Diff
diff --git a/documentdb/latest/developerguide/ca_cert_rotation.md b/documentdb/latest/developerguide/ca_cert_rotation.md index db3def058..0fb95a46f 100644 --- a//documentdb/latest/developerguide/ca_cert_rotation.md +++ b//documentdb/latest/developerguide/ca_cert_rotation.md @@ -5 +5 @@ -Updating your application and Amazon DocumentDB clusterTroubleshootingFrequently Asked Questions +Updating your application and Amazon DocumentDB clusterAutomatic server certificate rotationTroubleshootingFrequently Asked Questions @@ -12,0 +13,2 @@ Updating your application and Amazon DocumentDB clusterTroubleshootingFrequently + * Automatic server certificate rotation + @@ -20 +22 @@ Updating your application and Amazon DocumentDB clusterTroubleshootingFrequently -The certificate authority (CA) certificate for Amazon DocumentDB clusters will update starting in **August, 2024**. If you are using Amazon DocumentDB clusters with Transport Layer Security (TLS) enabled (the default setting) and you have not rotated your client application and server certificates, the following steps are required to mitigate connectivity issues between your application and your Amazon DocumentDB clusters. +The certificate authority (CA) certificate for Amazon DocumentDB clusters was updated in August of 2024. If you are using Amazon DocumentDB clusters with Transport Layer Security (TLS) enabled (the default setting) and you have not rotated your client application and server certificates, the following steps are required to mitigate connectivity issues between your application and your Amazon DocumentDB clusters. @@ -147,0 +150,29 @@ Complete the following steps to identify and rotate the old server certificate f +## Automatic server certificate rotation + +Amazon DocumentDB supports automatic server certificate rotation. The server certificate is the leaf certificate issued to each cluster instance. As opposed to the root CA certificates, the server certificates have short (12 months) validity and Amazon DocumentDB automatically handles their rotation without any action from you. Amazon DocumentDB uses the same root CA for this automatic rotation, so you don't need to download a new CA bundle. + +###### Important + +When connecting to your Amazon DocumentDB cluster, we recommend that you trust the root CA bundle as opposed to directly trusting each server certificate. This will prevent connection errors after the server certificate is rotated. See [Connecting with TLS enabled](./connect_programmatically.html#connect_programmatically-tls_enabled). + +Amazon DocumentDB attempts to rotate your server certificate in your preferred maintenance window at the server certificate half life. The new server certificate is valid for 12 months. + +Use the [`describe-db-engine-versions`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/docdb/describe-db-engine-versions.html) command and inspect the `SupportsCertificateRotationWithoutRestart` flag to identify whether the engine version supports rotating the certificate without restart. + +###### Note + +Amazon DocumentDB supports server certificate rotation without restarts if your cluster is running on the following engine patch versions: + + * Amazon DocumentDB 3.6: 1.0.208662 or greater + + * Amazon DocumentDB 4.0: 2.0.10179 or greater + + * Amazon DocumentDB 5.0: 3.0.4780 or greater + + + + +You can determine the current Amazon DocumentDB engine patch version by running this command: `db.runCommand({getEngineVersion: 1})`. + +If you are using an older engine patch version, Amazon DocumentDB will rotate the server certificate and schedule a database restart event on your preferred maintenance window. + @@ -177 +208 @@ You can determine whether your cluster is using TLS by examining the `tls` param -The Amazon DocumentDB CA and server certificates are being updated as part of standard maintenance and security best practices for Amazon DocumentDB. The current CA and server certificates are expiring beginning August, 2024. +The Amazon DocumentDB CA and server certificates are being updated as part of standard maintenance and security best practices for Amazon DocumentDB. @@ -181 +212 @@ The Amazon DocumentDB CA and server certificates are being updated as part of st -If you are using TLS to connect to your Amazon DocumentDB cluster and you do not make the certificate change by August, 2024, your applications that connect via TLS will no longer be able to communicate with the Amazon DocumentDB cluster. +If you are using TLS to connect to your Amazon DocumentDB cluster with an expired CA certificate, your applications that connect via TLS will no longer be able to communicate with the Amazon DocumentDB cluster.