AWS dms documentation change
Summary
Expanded Oracle source permissions documentation with detailed grants for AWS-managed databases
Security assessment
The change provides more granular permission requirements including EXECUTE on DBMS_XMLGEN, improving security documentation for proper access controls. However, there's no evidence this addresses a specific existing security issue.
Diff
diff --git a/dms/latest/userguide/CHAP_Tasks.AssessmentReport.Oracle.md b/dms/latest/userguide/CHAP_Tasks.AssessmentReport.Oracle.md index 210a83332..3968447fa 100644 --- a//dms/latest/userguide/CHAP_Tasks.AssessmentReport.Oracle.md +++ b//dms/latest/userguide/CHAP_Tasks.AssessmentReport.Oracle.md @@ -13 +13 @@ This section describes individual premigration assessments for migration tasks t -To use the premigration assessments in this section, you must add the following permissions to `dms_user`: +If you are using self-managed Oracle database as a source for AWS DMS, please use following permission set: @@ -30 +30 @@ To use the premigration assessments in this section, you must add the following -If you are using AWS-managed Oracle source database (RDS), please add following permission: `grant select on RDSADMIN.RDS_CONFIGURATION to dms_user;` +If you are using an AWS-managed Oracle database as a source for AWS DMS, please use following permission set: @@ -32 +32,16 @@ If you are using AWS-managed Oracle source database (RDS), please add following -For more information about permissions when using Oracle as a source, see [User account privileges required on a self-managed Oracle source for AWS DMS](./CHAP_Source.Oracle.html#CHAP_Source.Oracle.Self-Managed.Privileges). + + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('V_$PARAMETER', 'dms_user', 'SELECT'); + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('V_$INSTANCE', 'dms_user', 'SELECT'); + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('V_$VERSION','dms_user', 'SELECT'); + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('GV_$ASM_DISKGROUP','dms_user', 'SELECT'); + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('GV_$DATABASE','dms_user', 'SELECT'); + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('DBA_DB_LINKS','dms_user', 'SELECT'); + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('GV_$LOG_HISTORY','dms_user', 'SELECT'); + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('GV_$LOG','dms_user', 'SELECT'); + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('DBA_TYPES','dms_user', 'SELECT'); + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('DBA_USERS','dms_user', 'SELECT'); + EXEC RDSADMIN.RDSADMIN_UTIL.GRANT_SYS_OBJECT('DBA_DIRECTORIES','dms_user', 'SELECT'); + GRANT SELECT ON RDSADMIN.RDS_CONFIGURATION to dms_user; + GRANT EXECUTE ON SYS.DBMS_XMLGEN TO dms_user; + +For more information about permissions when using Oracle as a source, see [User account privileges required on a self-managed Oracle source for AWS DMS](./CHAP_Source.Oracle.html#CHAP_Source.Oracle.Self-Managed.Privileges) or [User account privileges required on an AWS-managed Oracle source for AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.Oracle.html#CHAP_Source.Oracle.Amazon-Managed).