AWS AmazonRDS medium security documentation change
Summary
Added SQL queries to identify stored objects with 'rdsadmin@localhost' definer and user accounts with unsupported privileges.
Security assessment
These queries help users audit and mitigate privilege escalation risks by identifying objects tied to the restricted 'rdsadmin' account and users with excessive privileges. This directly addresses access control concerns.
Diff
diff --git a/AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.md b/AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.md index 92e26c9e2..9e1437aeb 100644 --- a//AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.md +++ b//AmazonRDS/latest/UserGuide/MySQL.Procedural.Importing.md @@ -5 +5 @@ -Overview of setting upCreating your database backupCreating an IAM role manuallyImporting data from Amazon S3Limitations and recommendations +Overview of setupCreating your database backupCreating an IAM role manuallyImporting data from Amazon S3Limitations and considerations @@ -9 +9 @@ Overview of setting upCreating your database backupCreating an IAM role manually -Amazon RDS supports importing MySQL databases by using backup files. You can create a backup of your database, store it on Amazon S3, and then restore the backup file onto a new Amazon RDS DB instance running MySQL. +Amazon RDS supports importing MySQL databases with backup files. You can create a backup of your database, store the backup file on Amazon S3, and then restore the backup file to a new Amazon RDS DB instance running MySQL. Amazon RDS supports importing backup files from Amazon S3 in all AWS Regions. @@ -11 +11 @@ Amazon RDS supports importing MySQL databases by using backup files. You can cre -The scenario described in this section restores a backup of an on-premises database. You can use this technique for databases in other locations, such as Amazon EC2 or non-AWS cloud services, as long as the database is accessible. +The scenario described in this section restores a backup of an on-premises database. As long as the database is accessible, you can use this technique for databases in other locations, such as Amazon EC2 or other cloud services. @@ -13 +13 @@ The scenario described in this section restores a backup of an on-premises datab -You can find the supported scenario in the following diagram. +The following diagram shows the supported scenario. @@ -17 +17 @@ You can find the supported scenario in the following diagram. -Importing backup files from Amazon S3 is supported for MySQL in all AWS Regions. +If your on-premises database can be offline while you create, copy, and restore backup files, then we recommend that you use backup files to import your database to Amazon RDS. If your database can't be offline, then you can use one of the following methods: @@ -19 +19 @@ Importing backup files from Amazon S3 is supported for MySQL in all AWS Regions. -We recommend that you import your database to Amazon RDS by using backup files if your on-premises database can be offline while the backup file is created, copied, and restored. If your database can't be offline, you can use binary log (binlog) replication to update your database after you have migrated to Amazon RDS through Amazon S3 as explained in this topic. For more information, see [Configuring binary log file position replication with an external source instance](./MySQL.Procedural.Importing.External.Repl.html). You can also use the AWS Database Migration Service to migrate your database to Amazon RDS. For more information, see [What is AWS Database Migration Service?](https://docs.aws.amazon.com/dms/latest/userguide/Welcome.html) + * **Binary logs** — First, import backup files from Amazon S3 and to Amazon RDS, as explained in this topic. Then use binary log (binlog) replication to update your database. For more information, see [Configuring binary log file position replication with an external source instance](./MySQL.Procedural.Importing.External.Repl.html). @@ -21 +21 @@ We recommend that you import your database to Amazon RDS by using backup files i -## Overview of setting up to import backup files from Amazon S3 to Amazon RDS + * **AWS Database Migration Service** — Use AWS Database Migration Service to migrate your database to Amazon RDS. For more information, see [What is AWS Database Migration Service?](https://docs.aws.amazon.com/dms/latest/userguide/Welcome.html) @@ -23 +23,6 @@ We recommend that you import your database to Amazon RDS by using backup files i -These are the components you need to set up to import backup files from Amazon S3 to Amazon RDS: + + + +## Overview of setup to import backup files from Amazon S3 to Amazon RDS + +To import backup files from Amazon S3 to Amazon RDS, you need the following components: @@ -26,0 +32,2 @@ These are the components you need to set up to import backup files from Amazon S +If you already have an Amazon S3 bucket, you can use that bucket. If you don't have an Amazon S3 bucket, create a new one. For more information, see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/CreatingaBucket.html). + @@ -29 +36,5 @@ These are the components you need to set up to import backup files from Amazon S - * An AWS Identity and Access Management (IAM) role to allow Amazon RDS to access the bucket. +For more information, see Creating your database backup. + + * An AWS Identity and Access Management (IAM) role to allow Amazon RDS to access the S3 bucket. + +If you already have an IAM role, you can use that role and attach trust and permissions policies to it. For more information, see Creating an IAM role manually. @@ -30,0 +42 @@ These are the components you need to set up to import backup files from Amazon S +If you don't have an IAM role, you have two options: @@ -31,0 +44 @@ These are the components you need to set up to import backup files from Amazon S + * You can manually create a new IAM role. For more information, see Creating an IAM role manually. @@ -32,0 +46 @@ These are the components you need to set up to import backup files from Amazon S + * You can choose for Amazon RDS to create a new IAM role for you. If you want Amazon RDS to create a new IAM role for you, follow the procedure that uses the AWS Management Console in Importing data from Amazon S3 to a new MySQL DB instance section. @@ -34 +47,0 @@ These are the components you need to set up to import backup files from Amazon S -If you already have an Amazon S3 bucket, you can use that. If you don't have an Amazon S3 bucket, you can create a new one. If you want to create a new bucket, see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/CreatingaBucket.html). @@ -36 +48,0 @@ If you already have an Amazon S3 bucket, you can use that. If you don't have an -Use the Percona XtraBackup tool to create your backup. For more information, see Creating your database backup. @@ -38 +49,0 @@ Use the Percona XtraBackup tool to create your backup. For more information, see -If you already have an IAM role, you can use that. If you don't have an IAM role, you can create a new one manually. Alternatively, you can choose to have a new IAM role created for you in your account by the wizard when you restore the database by using the AWS Management Console. If you want to create a new IAM role manually, or attach trust and permissions policies to an existing IAM role, see Creating an IAM role manually. If you want to have a new IAM role created for you, follow the procedure in Console. @@ -42 +53 @@ If you already have an IAM role, you can use that. If you don't have an IAM role -Use the Percona XtraBackup software to create your backup. We recommend that you use the latest version of Percona XtraBackup. You can install Percona XtraBackup from [Download Percona XtraBackup](https://www.percona.com/downloads/Percona-XtraBackup-LATEST/). +Use the Percona XtraBackup software to create your backup. We recommend that you use the latest version of Percona XtraBackup. You can install Percona XtraBackup from [Software Downloads](https://www.percona.com/downloads/) on the Percona website. @@ -46 +57,7 @@ Use the Percona XtraBackup software to create your backup. We recommend that you -When creating a database backup, XtraBackup might save credentials in the xtrabackup_info file. Make sure you examine that file so that the `tool_command` setting in it doesn't contain any sensitive information. +When creating a database backup, XtraBackup might save credentials in the xtrabackup_info file. Make sure to confirm that the `tool_command` setting in the xtrabackup_info file doesn't contain any sensitive information. + +The Percona XtraBackup version that you use depends on the MySQL version that you are backing up. + + * **MySQL 8.4** — Use Percona XtraBackup version 8.4. + + * **MySQL 8.0** — Use Percona XtraBackup version 8.0. @@ -50 +67 @@ When creating a database backup, XtraBackup might save credentials in the xtraba -For a MySQL 8.4 migration, you must use Percona XtraBackup 8.4. +Percona XtraBackup 8.0.12 and higher versions support migration of all versions of MySQL 8.0. If you are migrating to RDS for MySQL 8.0.32 or higher, you must use Percona XtraBackup 8.0.12 or higher. @@ -52 +69 @@ For a MySQL 8.4 migration, you must use Percona XtraBackup 8.4. -For MySQL 8.0 migration, you must use Percona XtraBackup 8.0. Percona XtraBackup 8.0.12 and higher versions support migration of all versions of MySQL 8.0. If you are migrating to RDS for MySQL 8.0.32 or higher, you must use Percona XtraBackup 8.0.12 or higher. + * **MySQL 5.7** — Use Percona XtraBackup version 2.4. @@ -54 +70,0 @@ For MySQL 8.0 migration, you must use Percona XtraBackup 8.0. Percona XtraBackup -For MySQL 5.7 migrations, you can also use Percona XtraBackup 2.4. For migrations of earlier MySQL versions, you can also use Percona XtraBackup 2.3 or 2.4. @@ -56 +71,0 @@ For MySQL 5.7 migrations, you can also use Percona XtraBackup 2.4. For migration -You can create a full backup of your MySQL database files using Percona XtraBackup. Alternatively, if you already use Percona XtraBackup to back up your MySQL database files, you can upload your existing full and incremental backup directories and files. @@ -58 +73,4 @@ You can create a full backup of your MySQL database files using Percona XtraBack -For more information about backing up your database with Percona XtraBackup, see [Percona XtraBackup - documentation](https://www.percona.com/doc/percona-xtrabackup/LATEST/index.html) and [ The xtrabackup binary](https://docs.percona.com/percona-xtrabackup/8.0/working-with-binary-logs.html) on the Percona website. + +You can use Percona XtraBackup to create a full backup of your MySQL database files. Alternatively, if you already use Percona XtraBackup to back up your MySQL database files, you can upload your existing full and incremental backup directories and files. + +For more information about backing up your database with Percona XtraBackup, see [Percona XtraBackup - Documentation](https://www.percona.com/doc/percona-xtrabackup/LATEST/index.html) on the Percona website. @@ -62 +80 @@ For more information about backing up your database with Percona XtraBackup, see -To create a full backup of your MySQL database files that can be restored from Amazon S3, use the Percona XtraBackup utility (`xtrabackup`) to back up your database. +To create a full backup of your MySQL database files that Amazon RDS can restore from Amazon S3, use the Percona XtraBackup utility (`xtrabackup`). @@ -67 +85 @@ For example, the following command creates a backup of a MySQL database and stor - xtrabackup --backup --user=<myuser> --password=<password> --target-dir=</on-premises/s3-restore/backup> + xtrabackup --backup --user=myuser --password=password --target-dir=/on-premises/s3-restore/backup @@ -69 +87 @@ For example, the following command creates a backup of a MySQL database and stor -If you want to compress your backup into a single file (which can be split later, if needed), you can save your backup in one of the following formats: +If you want to compress your backup into a single file—which you can split into multiple files later, if needed—you can save your backup in one of the following formats based on your MySQL version: @@ -71 +89 @@ If you want to compress your backup into a single file (which can be split later - * Gzip (.gz) + * **Gzip (.gz)** – For MySQL 5.7 and lower versions @@ -73 +91 @@ If you want to compress your backup into a single file (which can be split later - * tar (.tar) + * **tar (.tar)** – For MySQL 5.7 and lower versions @@ -75 +93 @@ If you want to compress your backup into a single file (which can be split later - * Percona xbstream (.xbstream) + * **Percona xbstream (.xbstream)** – For all MySQL versions @@ -82 +100,3 @@ If you want to compress your backup into a single file (which can be split later -Percona XtraBackup 8.0 only supports Percona xbstream for compression. +Percona XtraBackup 8.0 and higher only supports Percona xbstream for compression. + +**MySQL 5.7 and lower versions** @@ -84 +104 @@ Percona XtraBackup 8.0 only supports Percona xbstream for compression. -The following command creates a backup of your MySQL database split into multiple Gzip files. +The following command creates a backup of your MySQL database split into multiple Gzip files. Replace values with your own information. @@ -87,3 +107,3 @@ The following command creates a backup of your MySQL database split into multipl - xtrabackup --backup --user=<myuser> --password=<password> --stream=tar \ - --target-dir=</on-premises/s3-restore/backup> | gzip - | split -d --bytes=500MB \ - - </on-premises/s3-restore/backup/backup>.tar.gz + xtrabackup --backup --user=my_user --password=password --stream=tar \ + --target-dir=/on-premises/s3-restore/backup | gzip - | split -d --bytes=500MB \ + - /on-premises/s3-restore/backup/backup.tar.gz @@ -91 +111 @@ The following command creates a backup of your MySQL database split into multipl -The following command creates a backup of your MySQL database split into multiple tar files. +**MySQL 5.7 and lower versions** @@ -92,0 +113 @@ The following command creates a backup of your MySQL database split into multipl +The following command creates a backup of your MySQL database split into multiple tar files. Replace values with your own information. @@ -94,3 +114,0 @@ The following command creates a backup of your MySQL database split into multipl - xtrabackup --backup --user=<myuser> --password=<password> --stream=tar \ - --target-dir=</on-premises/s3-restore/backup> | split -d --bytes=500MB \ - - </on-premises/s3-restore/backup/backup>.tar @@ -98 +116,3 @@ The following command creates a backup of your MySQL database split into multipl -The following command creates a backup of your MySQL database split into multiple xbstream files. + xtrabackup --backup --user=my_user --password=password --stream=tar \ + --target-dir=/on-premises/s3-restore/backup | split -d --bytes=500MB \ + - /on-premises/s3-restore/backup/backup.tar @@ -99,0 +120 @@ The following command creates a backup of your MySQL database split into multipl +**All MySQL versions** @@ -101,3 +122,6 @@ The following command creates a backup of your MySQL database split into multipl - xtrabackup --backup --user=<myuser> --password=<password> --stream=xbstream \ - --target-dir=</on-premises/s3-restore/backup> | split -d --bytes=500MB \ - - </on-premises/s3-restore/backup/backup>.xbstream +The following command creates a backup of your MySQL database split into multiple xbstream files. Replace values with your own information. + + + xtrabackup --backup --user=myuser --password=password --stream=xbstream \ + --target-dir=/on-premises/s3-restore/backup | split -d --bytes=500MB \ + - /on-premises/s3-restore/backup/backup.xbstream @@ -107 +131 @@ The following command creates a backup of your MySQL database split into multipl -If you see the following error, it might be caused by mixing file formats in your command: +If you see the following error, it might be because you mixed file formats in your command: @@ -114 +138 @@ If you see the following error, it might be caused by mixing file formats in you -If you already use Percona XtraBackup to perform full and incremental backups of your MySQL database files, you don't need to create a full backup and upload the backup files to Amazon S3. Instead, you can save a significant amount of time by copying your existing backup directories and files to your Amazon S3 bucket. For more information about creating incremental backups using Percona XtraBackup, see [Incremental backup](https://docs.percona.com/percona-xtrabackup/8.0/create-incremental-backup.html). +If you already use Percona XtraBackup to perform full and incremental backups of your MySQL database files, you don't need to create a full backup and upload the backup files to Amazon S3. Instead, to save time, copy your existing backup directories and files to your Amazon S3 bucket. For more information about creating incremental backups using Percona XtraBackup, see [Create an incremental backup](https://docs.percona.com/percona-xtrabackup/LATEST/create-incremental-backup.html) on the Percona website. @@ -116 +140 @@ If you already use Percona XtraBackup to perform full and incremental backups of -When copying your existing full and incremental backup files to an Amazon S3 bucket, you must recursively copy the contents of the base directory. Those contents include the full backup and also all incremental backup directories and files. This copy must preserve the directory structure in the Amazon S3 bucket. Amazon RDS iterates through all files and directories. Amazon RDS uses the `xtrabackup-checkpoints` file that is included with each incremental backup to identify the base directory, and to order incremental backups by log sequence number (LSN) range. +When copying your existing full and incremental backup files to an Amazon S3 bucket, you must recursively copy the contents of the base directory. Those contents include both the full backup and all incremental backup directories and files. This copy must preserve the directory structure in the Amazon S3 bucket. Amazon RDS iterates through all files and directories. Amazon RDS uses the `xtrabackup-checkpoints` file that is included with each incremental backup to identify the base directory and to order incremental backups by log sequence number (LSN) range. @@ -120 +144,17 @@ When copying your existing full and incremental backup files to an Amazon S3 buc -Amazon RDS consumes your backup files based on the file name. Name your backup files with the appropriate file extension based on the file format—for example, `.xbstream` for files stored using the Percona xbstream format. +Amazon RDS consumes your backup files based on the file name. Name your backup files with the appropriate file extension based on the file format. For example, use `.xbstream` for files stored using the Percona xbstream format. + +Amazon RDS consumes your backup files in alphabetical order and also in natural number order. To ensure that your backup files are written and named in the proper order, use the `split` option when you issue the `xtrabackup` command. + +Amazon RDS doesn't support partial backups created using Percona XtraBackup. You can't use the following options to create a partial backup when you back up the source files for your database: + + * `--tables` + + * `--tables-exclude` + + * `--tables-file` + + * `--databases` + + * `--databases-exclude` + + * `--databases-file` @@ -122 +161,0 @@ Amazon RDS consumes your backup files based on the file name. Name your backup f -Amazon RDS consumes your backup files in alphabetical order and also in natural number order. Use the `split` option when you issue the `xtrabackup` command to ensure that your backup files are written and named in the proper order. @@ -124 +162,0 @@ Amazon RDS consumes your backup files in alphabetical order and also in natural -Amazon RDS doesn't support partial backups created using Percona XtraBackup. You can't use the following options to create a partial backup when you back up the source files for your database: `--tables`, `--tables-exclude`, `--tables-file`, `--databases`, `--databases-exclude`, or `--databases-file`. @@ -126 +163,0 @@ Amazon RDS doesn't support partial backups created using Percona XtraBackup. You -Amazon RDS supports incremental backups created using Percona XtraBackup. For more information about creating incremental backups using Percona XtraBackup, see [Incremental backup](https://docs.percona.com/percona-xtrabackup/8.0/create-incremental-backup.html). @@ -130 +167 @@ Amazon RDS supports incremental backups created using Percona XtraBackup. For mo -If you don't have an IAM role, you can create a new one manually. However, if you restore the database by using the AWS Management Console, we recommend that you follow the procedure in Console and choose to have RDS create this new IAM role for you. +If you don't have an IAM role, you can create a new one manually. However, if you restore the database by using the AWS Management Console, we recommend that you choose to have Amazon RDS create this new IAM role for you. For Amazon RDS to create this role for you, follow the procedure in the Importing data from Amazon S3 to a new MySQL DB instance section. @@ -132 +169 @@ If you don't have an IAM role, you can create a new one manually. However, if yo -To manually create a new IAM role for importing your database from Amazon S3, create a role to delegate permissions from Amazon RDS to your Amazon S3 bucket. When you create an IAM role, you attach trust and permissions policies. To import your backup files from Amazon S3, use trust and permissions policies similar to the following examples. For more information about creating the role, see [Creating a role to delegate permissions to an AWS service](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html). +To create a new IAM role manually for importing your database from Amazon S3, create a role to delegate permissions from Amazon RDS to your Amazon S3 bucket. When you create an IAM role, you attach trust and permissions policies. To import your backup files from Amazon S3, use trust and permissions policies similar to the following examples. For more information about creating the role, see [Creating a role to delegate permissions to an AWS service](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html). @@ -218 +255 @@ You can import data from Amazon S3 to a new MySQL DB instance using the AWS Mana - 2. In the top right corner of the Amazon RDS console, choose the AWS Region in which to create your DB instance. Choose the same AWS Region as the Amazon S3 bucket that contains your database backup. + 2. In the upper-right corner of the Amazon RDS console, choose the AWS Region where you want to create your DB instance. Choose the same AWS Region as the Amazon S3 bucket that contains your database backup. @@ -228 +265 @@ The **Create database by restoring from S3** page appears. - 5. Under **S3 destination** : + 5. Under **S3 source** : @@ -234 +271 @@ The **Create database by restoring from S3** page appears. -If you don't specify a prefix, then RDS creates your DB instance using all of the files and folders in the root folder of the S3 bucket. If you do specify a prefix, then RDS creates your DB instance using the files and folders in the S3 bucket where the path for the file begins with the specified prefix. +If you don't specify a prefix, then Amazon RDS creates your DB instance using all of the files and folders in the root folder of the S3 bucket. If you do specify a prefix, then Amazon RDS creates your DB instance using the files and folders in the S3 bucket where the path for the file begins with the specified prefix. @@ -236 +273 @@ If you don't specify a prefix, then RDS creates your DB instance using all of th -For example, suppose that you store your backup files on S3 in a subfolder named backups, and you have multiple sets of backup files, each in its own directory (gzip_backup1, gzip_backup2, and so on). In this case, you specify a prefix of backups/gzip_backup1 to restore from the files in the gzip_backup1 folder. +For example, you store your backup files on S3 in a subfolder named backups, and you have multiple sets of backup files, each in its own directory (gzip_backup1, gzip_backup2, and so on). In this case, to restore from the files in the gzip_backup1 folder, you specify the prefix backups/gzip_backup1. @@ -246 +283 @@ For example, suppose that you store your backup files on S3 in a subfolder named -In the AWS Management Console, only the default minor version is available. You can upgrade your DB instance after importing. +In the AWS Management Console, only the default minor version is available. After you complete the import, you can upgrade your DB instance. @@ -250 +287 @@ In the AWS Management Console, only the default minor version is available. You - * (Recommended) Choose **Create a new role** , and enter the **IAM role name**. With this option, RDS automatically creates the role with the trust policy and permissions policy for you. + * (Recommended) Choose **Create a new role** , and enter the **IAM role name**. With this option, Amazon RDS automatically creates the role with the trust policy and permissions policy for you.