AWS AmazonRDS documentation change
Summary
Added documentation about Secrets Manager integration for master password management during CDB conversion, including CLI examples with --manage-master-user-password flag
Security assessment
The changes introduce AWS Secrets Manager as an option for credential management during database conversion, which is a security best practice for secret storage. However, there's no evidence this addresses a specific existing security vulnerability.
Diff
diff --git a/AmazonRDS/latest/UserGuide/oracle-cdb-converting.md b/AmazonRDS/latest/UserGuide/oracle-cdb-converting.md index 0dc64a0e1..d21bfee3f 100644 --- a//AmazonRDS/latest/UserGuide/oracle-cdb-converting.md +++ b//AmazonRDS/latest/UserGuide/oracle-cdb-converting.md @@ -36,0 +37,2 @@ Before converting your non-CDB, consider the following: + * You can convert existing non-CDB instances that uses managed master passwords to single-tenant instances in a single operation. The single-tenant instances inherit the managed passwords. + @@ -60 +62,3 @@ Before converting your non-CDB, consider the following: - 8. When all the changes are as you want them, choose **Continue** and check the summary of modifications. + 8. (Optional) For **Credentials management** , choose **Managed in AWS Secrets Manager** or **Self-managed**. For more information, see [Managing the master user password for a DB instance with Secrets Manager](./rds-secrets-manager.html#rds-secrets-manager-db-instance). + + 9. When all the changes are as you want them, choose **Continue** and check the summary of modifications. @@ -62 +66 @@ Before converting your non-CDB, consider the following: - 9. (Optional) Choose **Apply immediately** to apply the changes immediately. Choosing this option can cause downtime in some cases. For more information, see [Using the schedule modifications setting](./USER_ModifyInstance.ApplyImmediately.html). + 10. (Optional) Choose **Apply immediately** to apply the changes immediately. Choosing this option can cause downtime in some cases. For more information, see [Using the schedule modifications setting](./USER_ModifyInstance.ApplyImmediately.html). @@ -64 +68 @@ Before converting your non-CDB, consider the following: - 10. On the confirmation page, review your changes. If they are correct, choose **Modify DB instance**. + 11. On the confirmation page, review your changes. If they are correct, choose **Modify DB instance**. @@ -73 +77 @@ To convert the non-CDB on your DB instance to a CDB in the single-tenant configu -The following example converts the DB instance named `my-non-cdb` and specifies a custom option group and parameter group. +The following example converts the DB instance named `my-non-cdb` and specifies a custom option group and parameter group. The command also enables password management with Secrets Manager. @@ -84 +88,2 @@ For Linux, macOS, or Unix: - --db-parameter-group-name custom-parameter-group + --db-parameter-group-name custom-parameter-group \ + --manage-master-user-password @@ -93 +98,2 @@ For Windows: - --db-parameter-group-name custom-parameter-group + --db-parameter-group-name custom-parameter-group ^ + --manage-master-user-password @@ -105 +111 @@ Backing up and restoring a CDB -Converting the single-tenant configuration to multi-tenant +Converting single-tenant to multi-tenant