AWS documentdb medium security documentation change
Summary
Updated EC2 and DocumentDB cluster setup instructions with revised security group configuration guidance, image references, and instance configuration details. Added explicit steps for creating security groups and removed deprecated images.
Security assessment
The change modifies security group configuration instructions to emphasize creating new security groups instead of selecting existing ones, reducing risks of misconfiguration. Added note directing users to manual process for existing groups (which may enforce stricter security checks). This addresses potential security weaknesses from overly permissive existing groups.
Diff
diff --git a/documentdb/latest/developerguide/connect-ec2-auto.md b/documentdb/latest/developerguide/connect-ec2-auto.md index 170daa2e9..e34ab9f51 100644 --- a//documentdb/latest/developerguide/connect-ec2-auto.md +++ b//documentdb/latest/developerguide/connect-ec2-auto.md @@ -65 +65 @@ In this step, you will create an Amazon EC2 instance in the same Region and Amaz - + @@ -69,2 +68,0 @@ In this step, you will create an Amazon EC2 instance in the same Region and Amaz - - @@ -99 +97,3 @@ For security purposes, we highly recommend using a key-pair for both SSH and int - 6. **Optional:** In the **Network settings section** , under **Firewall (security groups)** , choose either **Create security group** or **Select existing security group**. + 6. **Optional:** In the **Network settings section** , under **Firewall (security groups)** , choose **Create security group**. + + @@ -101 +101 @@ For security purposes, we highly recommend using a key-pair for both SSH and int - +Choose **Create security group** (check all the traffic allow rules that apply to your EC2 connectivity). @@ -103 +103 @@ For security purposes, we highly recommend using a key-pair for both SSH and int -If you chose to select an existing security group, select one from the **Common security groups** drop-down list. +###### Note @@ -105 +105 @@ If you chose to select an existing security group, select one from the **Common -If you chose to create a new security group, check all the traffic allow rules that apply to your EC2 connectivity. +If you want to use an existing security group, follow the instructions in [Connect Amazon EC2 manually](./connect-ec2-manual.html). @@ -109,2 +108,0 @@ If you chose to create a new security group, check all the traffic allow rules t - - @@ -116 +114 @@ If you chose to create a new security group, check all the traffic allow rules t -While the Amazon EC2 instance is being provisioned, you will create your Amazon DocumentDB cluster. +While the Amazon EC2 instance is being provisioned, create your Amazon DocumentDB cluster. @@ -120,2 +117,0 @@ While the Amazon EC2 instance is being provisioned, you will create your Amazon - - @@ -124 +120,5 @@ While the Amazon EC2 instance is being provisioned, you will create your Amazon - + 3. Leave the **Cluster type** setting at it's default of **Instance Based Cluster**. + + 4. In **Cluster configuration** , for **Cluster identifier** , enter a unique name. Note that the console will change all cluster names into lower-case regardless of how they are entered. + +Leave the **Engine version** at it's default value of **5.0.0**. @@ -126 +126 @@ While the Amazon EC2 instance is being provisioned, you will create your Amazon - 3. Leave the **Cluster type** setting at its default of **Instance Based Cluster**. + 5. For **Cluster storage configuration** , leave the default setting of **Amazon DocumentDB Standard**. @@ -128 +128 @@ While the Amazon EC2 instance is being provisioned, you will create your Amazon - + 6. In **Instance configuration** : @@ -130 +130 @@ While the Amazon EC2 instance is being provisioned, you will create your Amazon - 4. For **Number of instances** , choose **1**. This will minimize cost. Leave the other settings at their default. + * For **DB instance class** , choose **Memory optimized classes (include r classes)** (this is default). @@ -132 +132 @@ While the Amazon EC2 instance is being provisioned, you will create your Amazon - +The other instance option is **NVMe-backed classes**. To learn more, see [NVMe-backed instances](./db-instance-nvme.html). @@ -134 +134,7 @@ While the Amazon EC2 instance is being provisioned, you will create your Amazon - 5. For **Connectivity** , choose **Connect to an EC2 compute resource**. This is the EC2 instance you created in Step 1. + * For **Instance class** , choose the instance type that suits your needs. For a more detailed explanation of instance classes, see [Instance class specifications](./db-instance-classes.html#db-instance-class-specs). + + * For **number of instances** , choose a number that best reflects your needs. Remember, the lower the number, the lower the cost, and the lower the read/write volume that can be managed by the cluster. + + + + 7. For **Connectivity** , choose **Connect to an EC2 compute resource**. This is the EC2 instance you created in Step 1. @@ -142 +148 @@ Connecting to an EC2 compute resource automatically creates a security group for - 6. In the **Authentication** section, enter a username for the primary user, and then choose **Self managed**. Enter a password, then confirm it. + 8. In the **Authentication** section, enter a username for the primary user, and then choose **Self managed**. Enter a password, then confirm it. @@ -146,5 +152 @@ If you instead chose **Managed in AWS Secrets Manager** , see [Password manageme - - - 7. Choose **Create cluster**. - - + 9. Choose **Create cluster**. @@ -268,2 +269,0 @@ Transport Layer Security (TLS) is enabled by default for any new Amazon Document - -