AWS AmazonRDS medium security documentation change
Summary
Added detailed credential management options (AWS Secrets Manager vs self-managed) for tenant databases, emphasized Secrets Manager as a security recommendation, updated CLI commands to use --manage-master-user-password instead of direct password input, and clarified security-related output exclusions.
Security assessment
The changes explicitly promote AWS Secrets Manager for credential management, reference KMS encryption for secrets, remove direct password exposure in CLI examples (replacing --master-user-password with --manage-master-user-password), and exclude sensitive data like master user secrets from command output. These are security-focused improvements to enforce credential protection and reduce password leakage risks.
Diff
diff --git a/AmazonRDS/latest/UserGuide/oracle-cdb.configuring.md b/AmazonRDS/latest/UserGuide/oracle-cdb.configuring.md index 24792e82c..722024032 100644 --- a//AmazonRDS/latest/UserGuide/oracle-cdb.configuring.md +++ b//AmazonRDS/latest/UserGuide/oracle-cdb.configuring.md @@ -22 +22 @@ Configuring a CDB is similar to configuring a non-CDB. -In RDS for Oracle, creating a CDB is almost identical to creating a non-CDB. The difference is that you choose the Oracle multitenant architecture when creating your DB instance and also choose an architecture configuration: multi-tenant or single-tenant. If you create tags when you create a CDB in the multi-tenant configuration, RDS propagates the tags to the initial tenant database. To create a CDB, use the AWS Management Console, the AWS CLI, or the RDS API. +In RDS for Oracle, creating a CDB instance is almost identical to creating a non-CDB instance. The difference is that you choose the Oracle multitenant architecture when creating your DB instance and also choose an architecture configuration: multi-tenant or single-tenant. If you create tags when you create a CDB in the multi-tenant configuration, RDS propagates the tags to the initial tenant database. To create a CDB, use the AWS Management Console, the AWS CLI, or the RDS API. @@ -54 +54,13 @@ In RDS for Oracle, creating a CDB is almost identical to creating a non-CDB. The - * Either enter a password in **Tenant database master password** or choose **Auto generate a password**. + * For **Credentials management** , choose either of the following credentials management options: + + * **Managed in AWS Secrets Manager** + +The managed password is for the initial tenant database rather than for the instance. In **Select the encryption key** , choose either a KMS key that Secrets Manager creates or a key that you have created. + +###### Note + +We recommend AWS Secrets Manager as the most secure technique for managing credentials. Additional charges apply. For more information, see [Password management with Amazon RDS and AWS Secrets Manager](./rds-secrets-manager.html). + + * **Self managed** + +To specify a password, clear the **Auto generate a password** check box if it is selected. Enter the same password in **Master password** and **Confirm master password**. @@ -62 +74,17 @@ The default PDB character set is **AL32UTF8**. If you choose a nondefault PDB ch -You can't create multiple tenant databases as part of the CDB creation process. You can only add PDBs to an already existing CDB. +You can't specify multiple tenant databases in the create operation. The CDB has one PDB when it is created. You can add PDBs to an existing CDB in a separate operation. + + 11. (Single-tenant configuration) Choose the settings that you want based on the options listed in [Settings for DB instances](./USER_CreateDBInstance.Settings.html): + + 1. In the **Settings** section, open **Credential Settings**. Then do the following: + + 1. For **Master username** , enter the name for a local user in your PDB. You can't use the master username to log in to the CDB root. + + 2. For **Credentials management** , choose either of the following credentials management options: + + * **Managed in AWS Secrets Manager** + +In **Select the encryption key** , choose either a KMS key that Secrets Manager creates or a key that you have created. + +###### Note + +We recommend AWS Secrets Manager as the most secure technique for managing credentials. Additional charges apply. For more information, see [Password management with Amazon RDS and AWS Secrets Manager](./rds-secrets-manager.html). @@ -64 +92 @@ You can't create multiple tenant databases as part of the CDB creation process. - 11. (Single-tenant configuration) Choose the settings that you want based on the options listed in [Settings for DB instances](./USER_CreateDBInstance.Settings.html). Note the following: + * **Self managed** @@ -66 +94 @@ You can't create multiple tenant databases as part of the CDB creation process. - * For **Master username** , enter the name for a local user in your PDB. You can't use the master username to log in to the CDB root. +To specify a password, clear the **Auto generate a password** check box if it is selected. Enter the same password in **Master password** and **Confirm master password**. @@ -68 +96 @@ You can't create multiple tenant databases as part of the CDB creation process. - * For **Initial database name** , enter the name of your PDB. You can't name the CDB, which has the default name `RDSCDB`. + 12. For the remaining sections, specify your DB instance settings. For information about each setting, see [Settings for DB instances](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CreateDBInstance.Settings.html). @@ -70 +98 @@ You can't create multiple tenant databases as part of the CDB creation process. - 12. Choose **Create database**. + 13. Choose **Create database**. @@ -85 +113 @@ To create a CDB in the multi-tenant configuration, use the [create-db-instance]( - * `--master-user-password` + * `--master-user-password` or `--manage-master-user-password` @@ -113 +141 @@ For Linux, macOS, or Unix: - --master-user-password pdb_admin_password \ + --manage-master-user-password \ @@ -127 +155 @@ For Windows: - --master-user-password pdb_admin_password ^ + --manage-master-user-password \ ^ @@ -134 +162 @@ Specify a password other than the prompt shown here as a security best practice. -This command produces output similar to the following. The database name, character set, national character set, and master user aren't included in the output. You can view this information by using the CLI command `describe-tenant-databases`. +This command produces output similar to the following. The database name, character set, national character set, master user, and master user secret aren't included in the output. You can view this information by using the CLI command `describe-tenant-databases`.