AWS dms medium security documentation change
Summary
Added three new premigration assessments verifying incompatible combinations of Data Validation and Data Masking features (Digit randomization, Hashing mask, Digit mask)
Security assessment
The changes address potential security misconfigurations by preventing simultaneous use of Data Validation and Data Masking features, which could lead to data exposure or validation failures. Data Masking is a security feature for protecting sensitive data, and improper combinations might compromise its effectiveness.
Diff
diff --git a/dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md b/dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md index 3ae99bf51..4dfaf8f84 100644 --- a//dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md +++ b//dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md @@ -5 +5 @@ -Validate if DDL event trigger is set to ENABLE ALWAYSValidate if PostGIS columns exist in the source databaseValidate if foreign key constraint is disabled on the target tables during the full-load processValidate if tables with similar names existValidate if there are tables with ARRAY data type without a primary keyValidate if primary keys or unique indexes exist on the target tables when BatchApplyEnabled is enabledValidate if any table of the target database has secondary indexes for the full-load migration taskValidate that limited LOB mode only is used when BatchApplyEnabled is set to trueValidate if source database version is supported by DMS for migrationValidate the logical_decoding_work_mem parameter on the source databaseValidate whether the source database has any long running transactionsValidate the source database parameter max_slot_wal_keep_sizeCheck if the source database parameter postgres-check-maxwalsenders is set to support CDC.Check if the source database is configured for PGLOGICALValidate if the source table primary key is of LOB DatatypeValidate if the source table has a primary keyValidate if prepared transactions are present on the source databaseValidate if wal_sender_timeout is set to a minimum required value to support DMS CDCValidate if wal_level is set to logical on the source databaseValidate if both Primary Key and Unique index exist on target for Batch ApplyRecommend Max LOB setting when LOB objects are foundValidate if table has primary key or unique index and its state is well when DMS validation is enabledValidate if AWS DMS user has necessary privileges to the targetValidates availability of free replication slots for CDCVerify DMS User Full Load PermissionsCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing mask +Validate if DDL event trigger is set to ENABLE ALWAYSValidate if PostGIS columns exist in the source databaseValidate if foreign key constraint is disabled on the target tables during the full-load processValidate if tables with similar names existValidate if there are tables with ARRAY data type without a primary keyValidate if primary keys or unique indexes exist on the target tables when BatchApplyEnabled is enabledValidate if any table of the target database has secondary indexes for the full-load migration taskValidate that limited LOB mode only is used when BatchApplyEnabled is set to trueValidate if source database version is supported by DMS for migrationValidate the logical_decoding_work_mem parameter on the source databaseValidate whether the source database has any long running transactionsValidate the source database parameter max_slot_wal_keep_sizeCheck if the source database parameter postgres-check-maxwalsenders is set to support CDC.Check if the source database is configured for PGLOGICALValidate if the source table primary key is of LOB DatatypeValidate if the source table has a primary keyValidate if prepared transactions are present on the source databaseValidate if wal_sender_timeout is set to a minimum required value to support DMS CDCValidate if wal_level is set to logical on the source databaseValidate if both Primary Key and Unique index exist on target for Batch ApplyRecommend Max LOB setting when LOB objects are foundValidate if table has primary key or unique index and its state is well when DMS validation is enabledValidate if AWS DMS user has necessary privileges to the targetValidates availability of free replication slots for CDCVerify DMS User Full Load PermissionsCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing maskVerify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneously @@ -68,0 +69,6 @@ This section describes individual premigration assessments for migration tasks t + * Verify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneously + + * Verify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneously + + * Verify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneously + @@ -266,0 +273,18 @@ This assessment validates whether any of the columns used in the table mapping a +## Verify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneously + +**API key** : `all-to-all-validation-with-datamasking-digits-randomize` + +This premigration assessment verifies that Data Validation setting and Data Masking Digit randomization are not simultaneously enabled, as these features are incompatible. + +## Verify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneously + +**API key** : `all-to-all-validation-with-datamasking-hash-mask` + +This premigration assessment verifies that Data Validation setting and Data Masking Hashing mask are not simultaneously enabled, as these features are incompatible. + +## Verify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneously + +**API key** : `all-to-all-validation-with-digit-mask` + +This premigration assessment verifies that Data Validation setting and Data Masking Digit mask are not simultaneously enabled, as these features are incompatible. +