AWS AmazonRDS medium security documentation change
Summary
Updated limitations for Oracle read replicas, including option group propagation rules, cross-Region replica restrictions, and a new limitation about Secrets Manager-managed credentials
Security assessment
Added explicit restriction preventing read replica creation when source uses Secrets Manager for master user credentials. This addresses potential security risks of credential propagation in replication scenarios.
Diff
diff --git a/AmazonRDS/latest/UserGuide/oracle-read-replicas.limitations.md b/AmazonRDS/latest/UserGuide/oracle-read-replicas.limitations.md index c586e2c60..1aa5997bd 100644 --- a//AmazonRDS/latest/UserGuide/oracle-read-replicas.limitations.md +++ b//AmazonRDS/latest/UserGuide/oracle-read-replicas.limitations.md @@ -53 +53 @@ For more information about upgrading the DB engine version, see [Upgrading the R -Before you create an RDS for Oracle replica, consider the following: +When working with option groups for your RDS for Oracle replica, consider the following: @@ -55 +55 @@ Before you create an RDS for Oracle replica, consider the following: - * If your Oracle replica is in the same AWS Region as its source DB instance, the replica can't use a different option group from the source DB instance. Modifications to the source option group or source option group membership propagate to Oracle replicas. These changes are applied to the replicas immediately after they are applied to the source DB instance, regardless of the replica's maintenance window. + * You can't use a replica option group different from the source DB instance option group when the source and replica are in the same AWS Region. @@ -57 +57 @@ Before you create an RDS for Oracle replica, consider the following: -For more information about option groups, see [Working with option groups](./USER_WorkingWithOptionGroups.html). +Modifications to the source option group or source option group membership propagate to Oracle replicas. These changes are applied to the replicas immediately after they are applied to the source DB instance, regardless of the replica's maintenance window. For more information about option groups, see [Working with option groups](./USER_WorkingWithOptionGroups.html). @@ -63 +63 @@ For more information about option groups, see [Working with option groups](./USE - * You can only add or remove the following nonreplicated options from a dedicated option group for an RDS for Oracle cross-Region replica: + * You can't add or remove nonreplicated options from a dedicated option group for an RDS for Oracle cross-Region replica, with the exception of the following options: @@ -79 +79 @@ For more information about option groups, see [Working with option groups](./USE - * The `EFS_INTEGRATION` option isn't supported for RDS for Oracle cross-Region replicas. + * You can't add the `EFS_INTEGRATION` option to RDS for Oracle cross-Region replicas. @@ -132,0 +133,2 @@ Before you create an RDS for Oracle replica, consider the following: + * You can't create an Oracle read replica when the source database manages master user credentials with Secrets Manager. +