AWS dms documentation change
Summary
Added three new premigration assessment checks to verify that Data Validation task settings are not enabled simultaneously with specific Data Masking features (Digit randomization, Hashing mask, Digit mask).
Security assessment
The changes document incompatibility between Data Validation and Data Masking features. While Data Masking is a security feature for obfuscating sensitive data, the updates focus on preventing misconfiguration that could cause validation failures rather than addressing a security vulnerability. No evidence of a security exploit or vulnerability is mentioned.
Diff
diff --git a/dms/latest/userguide/CHAP_Tasks.AssessmentReport.SqlServer.md b/dms/latest/userguide/CHAP_Tasks.AssessmentReport.SqlServer.md index ab9a26ebf..830e3c107 100644 --- a//dms/latest/userguide/CHAP_Tasks.AssessmentReport.SqlServer.md +++ b//dms/latest/userguide/CHAP_Tasks.AssessmentReport.SqlServer.md @@ -5 +5 @@ -Validate if secondary indexes are enabled on the target database during full-load Validate that limited LOB mode only is used when BatchApplyEnabled is set to trueValidate if target database has any triggers enabled on tables in the scope of the taskCheck if tables in task scope contain computed columnsCheck if tables in task scope have column store indexesCheck if memory optimized tables are a part of the task scopeCheck if temporal tables are a part of the task scopeCheck if delayed durability is enabled at the database levelCheck if accelerated data recovery is enabled at the database levelCheck if table mapping has more than 10K tables with primary keysCheck if the source database has tables or schema names with special characters.Check if the source database has column names with masked dataCheck if the source database has encrypted backupsCheck if the source database has backups stored at a URL or on Windows Azure. Check if the source database has backups on multiple disksCheck if the source database has at least one full backupCheck if the source database has sparse columns and columnar structure compression.Check if the source database instance has server level auditing for SQL Server 2008 or SQL Server 2008 R2Check if the source database has geometry columns for full LOB modeCheck if the source database has columns with the Identity property.Check if the DMS user has FULL LOAD permissionsCheck if the DMS user has FULL LOAD and CDC or CDC only permissionsCheck whether the ignoreMsReplicationEnablement ECA is set when using MS-CDC with on-premises or EC2 databasesCheck if the DMS user has the VIEW DEFINITION permission.Check if the DMS user has the VIEW DATABASE STATE permission on the MASTER database for users without the Sysadmin role.Check if the DMS user has the VIEW SERVER STATE permission.Validate if text repl size parameter is not unlimitedValidate if Primary Key or Unique Index exist on target for Batch ApplyValidate if both Primary Key and Unique index exist on target when batch apply enabledValidate if table has primary key or unique index when DMS validation is enabledValidate if AWS DMS user has necessary privileges to the targetRecommendation on using MaxFullLoadSubTasks settingCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing mask +Validate if secondary indexes are enabled on the target database during full-load Validate that limited LOB mode only is used when BatchApplyEnabled is set to trueValidate if target database has any triggers enabled on tables in the scope of the taskCheck if tables in task scope contain computed columnsCheck if tables in task scope have column store indexesCheck if memory optimized tables are a part of the task scopeCheck if temporal tables are a part of the task scopeCheck if delayed durability is enabled at the database levelCheck if accelerated data recovery is enabled at the database levelCheck if table mapping has more than 10K tables with primary keysCheck if the source database has tables or schema names with special characters.Check if the source database has column names with masked dataCheck if the source database has encrypted backupsCheck if the source database has backups stored at a URL or on Windows Azure. Check if the source database has backups on multiple disksCheck if the source database has at least one full backupCheck if the source database has sparse columns and columnar structure compression.Check if the source database instance has server level auditing for SQL Server 2008 or SQL Server 2008 R2Check if the source database has geometry columns for full LOB modeCheck if the source database has columns with the Identity property.Check if the DMS user has FULL LOAD permissionsCheck if the DMS user has FULL LOAD and CDC or CDC only permissionsCheck whether the ignoreMsReplicationEnablement ECA is set when using MS-CDC with on-premises or EC2 databasesCheck if the DMS user has the VIEW DEFINITION permission.Check if the DMS user has the VIEW DATABASE STATE permission on the MASTER database for users without the Sysadmin role.Check if the DMS user has the VIEW SERVER STATE permission.Validate if text repl size parameter is not unlimitedValidate if Primary Key or Unique Index exist on target for Batch ApplyValidate if both Primary Key and Unique index exist on target when batch apply enabledValidate if table has primary key or unique index when DMS validation is enabledValidate if AWS DMS user has necessary privileges to the targetRecommendation on using MaxFullLoadSubTasks settingCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing maskVerify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneously @@ -82,0 +83,6 @@ This section describes individual premigration assessments for migration tasks t + * Verify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneously + + * Verify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneously + + * Verify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneously + @@ -374,0 +381,18 @@ This assessment validates whether any of the columns used in the table mapping a +## Verify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneously + +**API key** : `all-to-all-validation-with-datamasking-digits-randomize` + +This premigration assessment verifies that Data Validation setting and Data Masking Digit randomization are not simultaneously enabled, as these features are incompatible. + +## Verify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneously + +**API key** : `all-to-all-validation-with-datamasking-hash-mask` + +This premigration assessment verifies that Data Validation setting and Data Masking Hashing mask are not simultaneously enabled, as these features are incompatible. + +## Verify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneously + +**API key** : `all-to-all-validation-with-digit-mask` + +This premigration assessment verifies that Data Validation setting and Data Masking Digit mask are not simultaneously enabled, as these features are incompatible. +