AWS AmazonRDS medium security documentation change
Summary
Updated mysqldump command to include --routines=0, --triggers=0, and --events=0 flags to exclude database objects during import, added security best practice guidance for credentials, and restructured documentation for clarity.
Security assessment
The addition of flags to exclude routines, triggers, and events addresses potential security risks from importing untrusted code. The documentation explicitly warns users to manually recreate these objects after review, mitigating arbitrary code execution vulnerabilities. The emphasis on avoiding password exposure in command prompts (no space after -p) and credential management best practices further strengthens security.
Diff
diff --git a/AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.SmallExisting.md b/AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.SmallExisting.md index 2079ff468..0225348dc 100644 --- a//AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.SmallExisting.md +++ b//AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.SmallExisting.md @@ -7 +7 @@ -You can also import data from an existing MariaDB or MySQL database to a MySQL or MariaDB DB instance. You do so by copying the database with [mysqldump](https://dev.mysql.com/doc/refman/8.0/en/mysqldump.html) and piping it directly into the MariaDB or MySQL DB instance. The `mysqldump` command line utility is commonly used to make backups and transfer data from one MariaDB or MySQL server to another. It's included with MySQL and MariaDB client software. +You can import data from an existing MariaDB or MySQL database to an RDS for MariaDB or RDS for MySQL DB instance. You do so by copying the database with [mysqldump](https://dev.mysql.com/doc/refman/8.0/en/mysqldump.html) and piping it directly into the RDS for MariaDB or RDS for MySQL DB instance. The `mysqldump` command line utility is commonly used to make backups and transfer data from one MariaDB or MySQL server to another. It's included with MySQL and MariaDB client software. @@ -17 +17 @@ Amazon RDS doesn't support `xtrabackup` for MariaDB or `mariabackup`. Amazon RDS -A typical `mysqldump` command to move data from an external database to an Amazon RDS DB instance looks similar to the following example. For MariaDB 11.0.1 and higher versions, replace `mysqldump` with `mariadb-dump` and `mysql` with `mariadb` in the following example. +A typical `mysqldump` command to move data from an external database to an Amazon RDS DB instance looks similar to the following example. Replace values with your own information. For MariaDB 11.0.1 and higher versions, replace `mysqldump` with `mariadb-dump` and `mysql` with `mariadb`. @@ -25 +25,3 @@ A typical `mysqldump` command to move data from an external database to an Amazo - -plocal_password | mysql -u RDS_user \ + --routines=0 \ + --triggers=0 \ + --events=0 \****-plocal_password | mysql -u RDS_user \ @@ -34 +36 @@ Make sure not to leave a space between the `-p` option and the entered password. -Specify credentials other than the prompts shown here as a security best practice. +As a security best practice, specify credentials other than the prompts shown in this example. @@ -38 +40,9 @@ Make sure that you're aware of the following recommendations and considerations: - * Exclude the following schemas from the dump file: `sys`, `performance_schema`, and `information_schema`. The `mysqldump` and `mariadb-dump` utility excludes these schemas by default. + * Exclude the following schemas from the dump file: + + * `sys` + + * `performance_schema` + + * `information_schema` + +The `mysqldump` and `mariadb-dump` utility excludes these schemas by default. @@ -49 +59 @@ The parameters used are as follows: - * `-u `local_user`` – Use to specify a user name. In the first usage of this parameter, you specify the name of a user account on the local MariaDB or MySQL database identified by the `--databases` parameter. + * `-u `local_user`` – Use to specify a user name. In the first usage of this parameter, specify the name of a user account on the local MariaDB or MySQL database that you identify with the `--databases` parameter. @@ -59 +69,5 @@ The parameters used are as follows: - * `-p`local_password`` – Use to specify a password. In the first usage of this parameter, you specify the password for the user account identified by the first `-u` parameter. + * `--routines` – Use if routines such as stored procedures or functions exist in the database that you are copying. Set the parameter to `0`, which excludes the routines during the import process. Then later manually recreate the routines in the Amazon RDS database. + + * `--triggers` – Use if triggers exist in the database that you are copying. Set the parameter to `0`, which excludes the triggers during the import process. Then later manually recreate the triggers in the Amazon RDS database. + + * `--events` – Use if events exist in the database that you are copying. Set the parameter to `0`, which excludes the events during the import process. Then later manually recreate the events in the Amazon RDS database. @@ -61 +75 @@ The parameters used are as follows: - * `-u `RDS_user`` – Use to specify a user name. In the second usage of this parameter, you specify the name of a user account on the default database for the MariaDB or MySQL DB instance identified by the `--host` parameter. + * `-p`local_password`` – Use to specify a password. In the first usage of this parameter, specify the password for the user account that you identify with the first `-u` parameter. @@ -63 +77 @@ The parameters used are as follows: - * `--port `port_number`` – Use to specify the port for your MariaDB or MySQL DB instance. By default, this is 3306 unless you changed the value when creating the instance. + * `-u `RDS_user`` – Use to specify a user name. In the second usage of this parameter, specify the name of a user account on the default database for the MariaDB or MySQL DB instance that you identify with the `--host` parameter. @@ -65 +79,3 @@ The parameters used are as follows: - * `--host `host_name`` – Use to specify the Domain Name System (DNS) name from the Amazon RDS DB instance endpoint, for example, `myinstance.123456789012.us-east-1.rds.amazonaws.com`. You can find the endpoint value in the instance details in the Amazon RDS Management Console. + * `--port `port_number`` – Use to specify the port for your MariaDB or MySQL DB instance. By default, this is 3306 unless you changed the value when creating the DB instance. + + * `--host `host_name`` – Use to specify the Domain Name System (DNS) name from the Amazon RDS DB instance endpoint, for example, `myinstance.123456789012.us-east-1.rds.amazonaws.com`. You can find the endpoint value in the DB instance details in the Amazon RDS console. @@ -72 +88,3 @@ The parameters used are as follows: -Make sure to create any stored procedures, triggers, functions, or events manually in your Amazon RDS database. If you have any of these objects in the database that you are copying, then exclude them when you run `mysqldump` or `mariadb-dump`. To do so, include the following parameters with your `mysqldump` or `mariadb-dump` command: `--routines=0 --triggers=0 --events=0`. +Make sure to create any stored procedures, triggers, functions, or events manually in your Amazon RDS database. If you have any of these objects in the database that you are copying, then exclude them when you run `mysqldump` or `mariadb-dump`. To do so, include the following parameters with your `mysqldump` or `mariadb-dump` command: + + * `--routines=0` @@ -74 +92,10 @@ Make sure to create any stored procedures, triggers, functions, or events manual -The following example copies the `world` sample database on the local host to a MySQL DB instance. To copy the sample database to a MariaDB DB instance, replace `mysqldump` with `mariadb-dump` and `mysql` with `mariadb`. + * `--triggers=0` + + * `--events=0` + + + + +**Example** + +The following example copies the `world` sample database on the local host to an RDS for MySQL DB instance. Replace values with your own information. To copy the sample database to an RDS for MariaDB DB instance, replace `mysqldump` with `mariadb-dump` and `mysql` with `mariadb`. @@ -79 +106 @@ For Linux, macOS, or Unix: - sudo mysqldump -u localuser \ + sudo mysqldump -u local_user \ @@ -87 +114 @@ For Linux, macOS, or Unix: - -plocalpassword | mysql -u rdsuser \ + -plocal_password | mysql -u rds_user \ @@ -89,2 +116,2 @@ For Linux, macOS, or Unix: - --host=myinstance.123456789012.us-east-1.rds.amazonaws.com \ - -prdspassword + --host=my_instance.123456789012.us-east-1.rds.amazonaws.com \ + -pRDS_password @@ -92 +119 @@ For Linux, macOS, or Unix: -For Windows, run the following command in a command prompt that has been opened by right-clicking **Command Prompt** on the Windows programs menu and choosing **Run as administrator** : +For Windows: @@ -93,0 +121 @@ For Windows, run the following command in a command prompt that has been opened +Run the following command in a command prompt that has been opened by right-clicking **Command Prompt** on the Windows programs menu and choosing **Run as administrator**. Replace values with your own information. To copy the sample database to an RDS for MariaDB DB instance, replace `mysqldump` with `mariadb-dump` and `mysql` with `mariadb`. @@ -95 +123,2 @@ For Windows, run the following command in a command prompt that has been opened - mysqldump -u localuser ^ + + mysqldump -u local_user ^ @@ -103 +132 @@ For Windows, run the following command in a command prompt that has been opened - -plocalpassword | mysql -u rdsuser ^ + -plocal_password | mysql -u RDS_user ^ @@ -105,2 +134,2 @@ For Windows, run the following command in a command prompt that has been opened - --host=myinstance.123456789012.us-east-1.rds.amazonaws.com ^ - -prdspassword + --host=my_instance.123456789012.us-east-1.rds.amazonaws.com ^ + -pRDS_password @@ -110 +139 @@ For Windows, run the following command in a command prompt that has been opened -Specify credentials other than the prompts shown here as a security best practice. +As a security best practice, specify credentials other than the prompts shown in the example.