AWS dms documentation change
Summary
Added new validation checks for Data Masking/Validation incompatibility, streaming target LOB handling, and CDC OpenTransactionWindow configuration
Security assessment
The changes add documentation about Data Masking features (security-related functionality) and warn about incompatible combinations with Data Validation. While this improves security awareness, there's no evidence of addressing an active vulnerability. The streaming target LOB warning prevents data loss scenarios but relates to data integrity rather than security exploitation.
Diff
diff --git a/dms/latest/userguide/CHAP_Tasks.AssessmentReport.Oracle.md b/dms/latest/userguide/CHAP_Tasks.AssessmentReport.Oracle.md index 3968447fa..187ecdba4 100644 --- a//dms/latest/userguide/CHAP_Tasks.AssessmentReport.Oracle.md +++ b//dms/latest/userguide/CHAP_Tasks.AssessmentReport.Oracle.md @@ -5 +5 @@ -Validate that limited LOB mode only is used when BatchApplyEnabled is enabled Validate if tables on the source has columns without scale specified for the Number data type Validate triggers on the target database Validate if source has archivelog DEST_ID set to 0 Validate if secondary indexes are enabled on the target database during full-load Validate if tables used in the DMS task scope with BatchApplyEnabled have more than 999 columnsCheck supplemental logging on database levelValidate if required DB link is created for StandbyOracle validation for LOB datatype and if binary reader is configuredValidate if the database is CDBCheck the Oracle Database EditionValidate Oracle CDC method for DMSValidate Oracle RAC configuration for DMSValidate if DMS user has permissions on targetValidate if supplemental logging is required for all columnsValidate if supplemental logging is enabled on tables with Primary or Unique keysValidate if there are SecureFile LOBs and the task is configured for Full LOB modeValidate whether Function-Based Indexes are being used within the tables included in the task scope. Validate whether global temporary tables are being used on the tables included in the task scope. Validate whether index-organized tables with an overflow segment are being used on the tables included in the task scope.Validate if multilevel nesting tables are used on the tables included in the task scope. Validate if invisible columns are used on the tables included in the task scope.Validate if materialized views based on a ROWID column are used on the tables included in the task scope.Validate if Active Data Guard DML Redirect feature is used.Validate if Hybrid Partitioned Tables are used.Validate if schema-only Oracle accounts are usedValidate if Virtual Columns are usedValidate whether table names defined in the task scope contain apostrophes. Validate whether the columns defined in the task scope have XMLType, Long, or Long Raw datatypes and verify the LOB mode configuration in the task settings.Validate whether the source Oracle version is supported by AWS DMS.Validate whether the target Oracle version is supported by AWS DMS.Validate whether the DMS user has the required permissions to use data validation.Validate if the DMS user has permissions to use Binary Reader with Oracle ASMValidate if the DMS user has permissions to use Binary Reader with Oracle non-ASMValidate if the DMS user has permissions to use Binary Reader with CopyToTempFolder methodValidate if the DMS user has permissions to use Oracle Standby as a SourceValidate if the DMS source is connected to an application container PDB Validate if the table has XML datatypes included in the task scope. Validate whether archivelog mode is enabled on the source database.Validates the archivelog retention for RDS Oracle. Validate if the table has Extended datatypes included in the task scope. Validate the length of the object name included in the task scope. Validate if the DMS source is connected to an Oracle PDBValidate if the table has spatial columns included in the task scope.Validate if the DMS source is connected to an Oracle standby.Validate if the source database tablespace is encrypted using TDE.Validate if the source database is Oracle ASMValidate if the batch apply is enabled and whether the table on the target Oracle database has parallelism enabled at the table or index level.Recommend “Bulk Array Size” parameter by validating the tables in the task scope.Validate if HandleCollationDiff task setting is ConfiguredValidate if table has primary key or unique index and its state is VALID when DMS validation is enabledValidate if Binary Reader is used for Oracle Standby as a sourceValidate if the AWS DMS user has the required directory permissions to replicate data from an Oracle RDS Standby database. Validate the type of Oracle Standby used for replicationValidate if required directories are created for RDS Oracle standbyValidate if Primary Key or Unique Index exists on target for Batch ApplyValidate if both Primary Key and Unique index exist on target for Batch ApplyValidate if unsupported HCC levels are used for Full LoadValidate if unsupported HCC levels are used for Full Load with CDCValidate if unsupported HCC compression used for CDCCDC Recommendation based on source compression methodCheck if batch apply is enabled and validate whether the table has more than 999 columnsCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing mask +Validate that limited LOB mode only is used when BatchApplyEnabled is enabled Validate if tables on the source has columns without scale specified for the Number data type Validate triggers on the target database Validate if source has archivelog DEST_ID set to 0 Validate if secondary indexes are enabled on the target database during full-load Validate if tables used in the DMS task scope with BatchApplyEnabled have more than 999 columnsCheck supplemental logging on database levelValidate if required DB link is created for StandbyOracle validation for LOB datatype and if binary reader is configuredValidate if the database is CDBCheck the Oracle Database EditionValidate Oracle CDC method for DMSValidate Oracle RAC configuration for DMSValidate if DMS user has permissions on targetValidate if supplemental logging is required for all columnsValidate if supplemental logging is enabled on tables with Primary or Unique keysValidate if there are SecureFile LOBs and the task is configured for Full LOB modeValidate whether Function-Based Indexes are being used within the tables included in the task scope. Validate whether global temporary tables are being used on the tables included in the task scope. Validate whether index-organized tables with an overflow segment are being used on the tables included in the task scope.Validate if multilevel nesting tables are used on the tables included in the task scope. Validate if invisible columns are used on the tables included in the task scope.Validate if materialized views based on a ROWID column are used on the tables included in the task scope.Validate if Active Data Guard DML Redirect feature is used.Validate if Hybrid Partitioned Tables are used.Validate if schema-only Oracle accounts are usedValidate if Virtual Columns are usedValidate whether table names defined in the task scope contain apostrophes. Validate whether the columns defined in the task scope have XMLType, Long, or Long Raw datatypes and verify the LOB mode configuration in the task settings.Validate whether the source Oracle version is supported by AWS DMS.Validate whether the target Oracle version is supported by AWS DMS.Validate whether the DMS user has the required permissions to use data validation.Validate if the DMS user has permissions to use Binary Reader with Oracle ASMValidate if the DMS user has permissions to use Binary Reader with Oracle non-ASMValidate if the DMS user has permissions to use Binary Reader with CopyToTempFolder methodValidate if the DMS user has permissions to use Oracle Standby as a SourceValidate if the DMS source is connected to an application container PDB Validate if the table has XML datatypes included in the task scope. Validate whether archivelog mode is enabled on the source database.Validates the archivelog retention for RDS Oracle. Validate if the table has Extended datatypes included in the task scope. Validate the length of the object name included in the task scope. Validate if the DMS source is connected to an Oracle PDBValidate if the table has spatial columns included in the task scope.Validate if the DMS source is connected to an Oracle standby.Validate if the source database tablespace is encrypted using TDE.Validate if the source database is Oracle ASMValidate if the batch apply is enabled and whether the table on the target Oracle database has parallelism enabled at the table or index level.Recommend “Bulk Array Size” parameter by validating the tables in the task scope.Validate if HandleCollationDiff task setting is ConfiguredValidate if table has primary key or unique index and its state is VALID when DMS validation is enabledValidate if Binary Reader is used for Oracle Standby as a sourceValidate if the AWS DMS user has the required directory permissions to replicate data from an Oracle RDS Standby database. Validate the type of Oracle Standby used for replicationValidate if required directories are created for RDS Oracle standbyValidate if Primary Key or Unique Index exists on target for Batch ApplyValidate if both Primary Key and Unique index exist on target for Batch ApplyValidate if unsupported HCC levels are used for Full LoadValidate if unsupported HCC levels are used for Full Load with CDCValidate if unsupported HCC compression used for CDCCDC Recommendation based on source compression methodCheck if batch apply is enabled and validate whether the table has more than 999 columnsCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing maskVerify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneouslyValidate that replication to a streaming target does not include LOBs or extended data type columns.Validate if CDC-only task is configured to use the OpenTransactionWindow endpoint setting. @@ -180,0 +181,10 @@ For more information about permissions when using Oracle as a source, see [User + * Verify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneously + + * Verify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneously + + * Verify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneously + + * Validate that replication to a streaming target does not include LOBs or extended data type columns. + + * Validate if CDC-only task is configured to use the OpenTransactionWindow endpoint setting. + @@ -653,0 +664,30 @@ This assessment validates whether any of the columns used in the table mapping a +## Verify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneously + +**API key** : `all-to-all-validation-with-datamasking-digits-randomize` + +This premigration assessment verifies that Data Validation setting and Data Masking Digit randomization are not simultaneously enabled, as these features are incompatible. + +## Verify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneously + +**API key** : `all-to-all-validation-with-datamasking-hash-mask` + +This premigration assessment verifies that Data Validation setting and Data Masking Hashing mask are not simultaneously enabled, as these features are incompatible. + +## Verify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneously + +**API key** : `all-to-all-validation-with-digit-mask` + +This premigration assessment verifies that Data Validation setting and Data Masking Digit mask are not simultaneously enabled, as these features are incompatible. + +## Validate that replication to a streaming target does not include LOBs or extended data type columns. + +**API key** : `oracle-validate-lob-to-streaming-target` + +This assessment identifies potential data loss when migrating LOB or extended data types to streaming target endpoints (such as S3, Kinesis, or Kafka). Oracle database does not track changes to these data types in its log files causing DMS to write `NULL` values to the streaming target. To prevent data loss, you can implement a '`before`' trigger on the source database which forces Oracle to log these changes. + +## Validate if CDC-only task is configured to use the OpenTransactionWindow endpoint setting. + +**API key** : `oracle-check-cdc-open-tx-window` + +For CDC-only tasks, use OpenTransactionWindow to avoid missing data. For more information, see [Creating tasks for ongoing replication using AWS DMS](https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Task.CDC.html). +