AWS AmazonRDS medium security documentation change
Summary
Updated conversion documentation with IAM requirements, Secrets Manager integration details, and irreversible operation warnings
Security assessment
Added requirement for IAM permissions to create tenant databases and explicit restriction on modifying managed master passwords during conversion. These changes enforce security controls around credential management and access permissions during critical operations.
Diff
diff --git a/AmazonRDS/latest/UserGuide/oracle-single-tenant-converting.md b/AmazonRDS/latest/UserGuide/oracle-single-tenant-converting.md index 8422a1a7e..024f8ca1c 100644 --- a//AmazonRDS/latest/UserGuide/oracle-single-tenant-converting.md +++ b//AmazonRDS/latest/UserGuide/oracle-single-tenant-converting.md @@ -7 +7 @@ -You can modify the architecture of an RDS for Oracle CDB from the single-tenant configuration to the multi-tenant configuration. Before and after the conversion, your CDB contains a single tenant database (PDB). +You can modify the architecture of an RDS for Oracle CDB from the single-tenant configuration to the multi-tenant configuration. Before and after the conversion, your CDB contains a single tenant database (PDB). Tags for the DB instance propagate to the initial tenant database created during the conversion. @@ -9 +9 @@ You can modify the architecture of an RDS for Oracle CDB from the single-tenant -During the conversion, RDS for Oracle migrates the following metadata to the new tenant database: +Before you begin, make sure that your IAM policy has permission to create a tenant database. During the conversion, RDS for Oracle migrates the following metadata to the new tenant database: @@ -12,0 +13,2 @@ During the conversion, RDS for Oracle migrates the following metadata to the new + * The managed master password (if the source CDB integrates with Secrets Manager) + @@ -22,3 +24 @@ During the conversion, RDS for Oracle migrates the following metadata to the new -Before the conversion, you could view the preceding information by using the `describe-db-instances` command. After the conversion, you view the information by using the `describe-tenant-database` command. - -The conversion has the following requirements and limitations: +Before the conversion, you view the preceding information by using the `describe-db-instances` command. After the conversion, you view the information by using the `describe-tenant-database` command. @@ -26 +26 @@ The conversion has the following requirements and limitations: - * After you convert the single-tenant architecture configuration to the multi-tenant configuration, you can't later convert the architecture back to the single-tenant configuration. The operation is irreversible. +The conversion from single-tenant to multi-tenant has the following limitations: @@ -28 +28 @@ The conversion has the following requirements and limitations: - * The tags for the DB instance propagate to the initial tenant DB created during the conversion. + * You can't later convert back to the single-tenant configuration after you convert to the multi-tenant configuration. The conversion is irreversible. @@ -34 +34 @@ The conversion has the following requirements and limitations: - * Your IAM policy must have permission to create a tenant database. + * You can't enable or disable managed master user passwords during the conversion.