AWS AmazonRDS documentation change
Summary
Updated SSH key naming conventions and examples for RDS Custom instances
Security assessment
The changes clarify SSH key naming formats and usage examples but do not introduce or modify security features or address vulnerabilities.
Diff
diff --git a/AmazonRDS/latest/UserGuide/custom-creating.md b/AmazonRDS/latest/UserGuide/custom-creating.md index 96dad7f4a..2482af766 100644 --- a//AmazonRDS/latest/UserGuide/custom-creating.md +++ b//AmazonRDS/latest/UserGuide/custom-creating.md @@ -359 +359 @@ To change the accessibility settings for your DB instance, see [Modifying an Ama -To connect to the DB instance using SSH, you need the SSH key pair associated with the instance. RDS Custom creates the SSH key pair on your behalf, naming it with the prefix `do-not-delete-rds-custom-ssh-privatekey-db-`. AWS Secrets Manager stores your SSH private key as a secret. +To connect to the DB instance using SSH, you need the SSH key pair associated with the instance. RDS Custom creates the SSH key pair on your behalf, using the naming convention `do-not-delete-rds-custom-ssh-privatekey-`resource_id`-`uuid`` or `rds-custom!oracle-do-not-delete-`resource_id`-`uuid`-ssh-privatekey`. AWS Secrets Manager stores your SSH private key as a secret. @@ -379 +379 @@ Retrieve your SSH secret key using either AWS Management Console or the AWS CLI. - 8. In **Details** , find **Key pair name**. The pair name includes the DB instance resource ID. For example, the pair name might be `do-not-delete-rds-custom-ssh-privatekey-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c`. + 8. In **Details** , find **Key pair name**. The pair name includes the DB instance resource ID. For example, the pair name might be `do-not-delete-rds-custom-ssh-privatekey-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c` or `rds-custom!oracle-do-not-delete-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c-ssh-privatekey`. @@ -389 +389 @@ Retrieve your SSH secret key using either AWS Management Console or the AWS CLI. - 13. Copy the SSH private key into a text file, and then save the file with the `.pem` extension. For example, save the file as `/tmp/do-not-delete-rds-custom-ssh-privatekey-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c.pem`. + 13. Copy the SSH private key into a text file, and then save the file with the `.pem` extension. For example, save the file as `/tmp/do-not-delete-rds-custom-ssh-privatekey-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c.pem` or `/tmp/rds-custom!oracle-do-not-delete-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c-ssh-privatekey.pem`. @@ -424 +424 @@ The following sample output shows the EC2 instance ID. -The following sample output shows the key name, which uses the prefix `do-not-delete-rds-custom-ssh-privatekey-`. +The following sample output shows the key name, which uses the naming format `do-not-delete-rds-custom-ssh-privatekey-`resource_id`-`uuid`` or `rds-custom!oracle-do-not-delete-`resource_id`-`uuid`-ssh-privatekey`. @@ -426,0 +427 @@ The following sample output shows the key name, which uses the prefix `do-not-de + rds-custom!oracle-do-not-delete-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c-ssh-privatekey @@ -428 +429,3 @@ The following sample output shows the key name, which uses the prefix `do-not-de - 4. Save the private key in a .pem file named after the key using `aws secretsmanager`. The following example saves the file in your `/tmp` directory. + 4. Save the private key in a .pem file named after the key using `aws secretsmanager`. + +The following example saves the key `do-not-delete-rds-custom-ssh-privatekey-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c` to a file in your `/tmp` directory. @@ -434,0 +438,7 @@ The following sample output shows the key name, which uses the prefix `do-not-de +The following example saves the key `rds-custom!oracle-do-not-delete-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c-ssh-privatekey` to a file in your `/tmp` directory. + + aws secretsmanager get-secret-value \ + --secret-id rds-custom!oracle-do-not-delete-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c-ssh-privatekey \ + --query SecretString \ + --output text >/tmp/rds-custom!oracle-do-not-delete-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c-ssh-privatekey.pem + @@ -452,0 +463,2 @@ Add the following lines to `~/.ssh/config`. These lines proxy SSH commands for h +The following example changes to the `/tmp` directory and sets permissions for .pem file `do-not-delete-rds-custom-ssh-privatekey-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c.pem`. + @@ -455,0 +468,5 @@ Add the following lines to `~/.ssh/config`. These lines proxy SSH commands for h +The following example changes to the `/tmp` directory and sets permissions for .pem file `rds-custom!oracle-do-not-delete-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c-ssh-privatekey.pem`. + + cd /tmp + chmod 400 rds-custom!oracle-do-not-delete-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c-ssh-privatekey.pem + @@ -459,0 +477 @@ The following example connects to a public instance using the DNS name `ec2-12-3 + # .pem file using naming prefix do-not-delete @@ -463,0 +482,5 @@ The following example connects to a public instance using the DNS name `ec2-12-3 + # .pem file using naming prefix rds-custom!oracle-do-not-delete + ssh -i \ + "rds-custom!oracle-do-not-delete-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c-ssh-privatekey.pem" \ + [email protected] + @@ -465,0 +489 @@ The following example connects to a private instance using the EC2 instance ID ` + # .pem file using naming prefix do-not-delete @@ -469,0 +494,5 @@ The following example connects to a private instance using the EC2 instance ID ` + # .pem file using naming prefix rds-custom!oracle-do-not-delete + ssh -i \ + "rds-custom!oracle-do-not-delete-db-ABCDEFGHIJKLMNOPQRS0123456-0d726c-ssh-privatekey.pem" \ + ec2-user@i-0bdc4219e66944afa +