AWS neptune medium security documentation change
Summary
Updated OS upgrade documentation with new procedures, added CLI/console instructions, and emphasized security/compliance implications
Security assessment
The changes explicitly state that OS updates include critical security patches and compliance requirements. Added guidance to 'stay current on all updates' specifically references security improvements. The addition of RDS-EVENT-0230 subscription for security patching events directly ties to security monitoring.
Diff
diff --git a/neptune/latest/userguide/security-os-upgrades.md b/neptune/latest/userguide/security-os-upgrades.md index 717ceb59b..3857db3d0 100644 --- a//neptune/latest/userguide/security-os-upgrades.md +++ b//neptune/latest/userguide/security-os-upgrades.md @@ -5 +5 @@ -Minimizing downtime for OS upgrades that require a restartOperations that trigger OS upgrades +Minimizing downtime for OS upgrades that require a restartApplying OS upgrades to your Neptune DB instance @@ -7 +7 @@ Minimizing downtime for OS upgrades that require a restartOperations that trigge -# OS upgrades for Neptune services +# Amazon Neptune operating system upgrades @@ -9 +9,3 @@ Minimizing downtime for OS upgrades that require a restartOperations that trigge -Amazon Neptune ensures continuous improvements in database performance, security, and stability through regular OS upgrades. These upgrades are applied to both Neptune Databases and Neptune Analytics, following a structured update process. Amazon Neptune releases OS upgrades at least once a month. +Amazon Neptune ensures continuous improvements in database performance, security, and stability through regular OS upgrades. These upgrades are applied to both Neptune Databases and Neptune Analytics, following a structured update process. Amazon Neptune releases OS upgrades at least once per month. + +Neptune Database OS updates that do not require downtime are automatically applied during the maintenance window. Certain OS updates (eg: kernel version upgrade) requires an instance restart. These updates are optional and don't have a set date to apply them. However, if you don't apply these updates, they may eventually become required and automatically applied during your instance's maintenance window. @@ -13 +15 @@ Amazon Neptune ensures continuous improvements in database performance, security -**Neptune Database** \- Neptune Database OS updates that do not require downtime are automatically applied during the maintenance window. Certain OS updates (eg: kernel version upgrade) requires an instance restart. These updates are staged but not automatically applied; they are applied only when the instance is restarted. OS updates that involve kernel updates require downtime and must be planned for. +To maintain security and compliance, we recommend that you apply all updates made available by Amazon Neptune routinely during your maintenance window. Staying current on all optional and mandatory updates helps incorporate critical security patches and ensures alignment with various compliance obligations. Outdated OS versions may result in non-compliance with regulatory requirements. @@ -17 +19,23 @@ Amazon Neptune ensures continuous improvements in database performance, security -For OS upgrades that require a restart, you can minimize downtime by following these steps: +For OS upgrades that require a restart, we recommend that you update the reader instances in a cluster first, then the writer instance to maximize the availability of your cluster. We don't recommend updating reader and writer instances at the same time, because you could incur longer downtime in the event of a failover. + +## Applying OS upgrades to your Neptune DB instance + +Neptune DB instances occasionally require operating system updates. Amazon Neptune upgrades the operating system to a newer version to improve database performance and customers overall security posture. Typically, the updates take about 10 minutes. Operating system updates don't change the DB engine version or DB instance class of a DB instance. + +To be notified when a new optional update becomes available, you can subscribe to `RDS-EVENT-0230` in the security patching event category. For information about subscribing to Amazon Neptune events, see [ Subscribing to Neptune event notification](https://docs.aws.amazon.com/neptune/latest/userguide/events-subscribing.html). + +###### Important + +Your Amazon Neptune DB instance will be taken offline during the operating system upgrade. You can minimize cluster downtime by having a multi-instance cluster. If you do not have a multi-instance cluster then you can choose to temporarily create one by adding secondary instance(s) to perform this maintenance, then deleting the additional reader instance(s) once the maintenance is completed (regular charges for the secondary instance will apply). + +You can use the AWS Management Console or the AWS CLI to determine whether an update is available. + +### Using the AWS Management Console + +To determine whether an update is available using the AWS Management Console: + + 1. Sign in to the AWS Management Console, and open the Amazon Neptune console at [https://console.aws.amazon.com/neptune/home](https://console.aws.amazon.com/neptune/home). + + 2. In the navigation pane, choose **Clusters** , and then select the instance. + + 3. Choose **Maintenance**. @@ -19 +43 @@ For OS upgrades that require a restart, you can minimize downtime by following t - * Add a new DB instance(s) to the cluster - All new instances will use the latest OS released by the service. + 4. In the **Pending Maintenance** section, find the operating system update. @@ -21 +44,0 @@ For OS upgrades that require a restart, you can minimize downtime by following t - * Delete the Old DB instance(s). @@ -23 +45,0 @@ For OS upgrades that require a restart, you can minimize downtime by following t - * If the old DB instance is a reader, this process does not introduce any downtime. @@ -25 +46,0 @@ For OS upgrades that require a restart, you can minimize downtime by following t - * If the old DB instance is a writer, this will trigger a failover operation, limiting downtime to just a few seconds. @@ -26,0 +48 @@ For OS upgrades that require a restart, you can minimize downtime by following t + @@ -27,0 +50 @@ For OS upgrades that require a restart, you can minimize downtime by following t +You can select the operating system update and click **Apply now** or **Apply at next maintenance window** in the **Pending Maintenance** section. If the maintenance value is **next window** , defer the maintenance items by choosing **Defer upgrade**. You can't defer a maintenance action if it has already started. @@ -28,0 +52 @@ For OS upgrades that require a restart, you can minimize downtime by following t +Alternatively, you can choose the instance from a list of clusters by clicking on **Clusters** in the navigation pane and select **Apply now** or **Apply at next maintenance window** from the **Actions** menu. @@ -30 +54 @@ For OS upgrades that require a restart, you can minimize downtime by following t -By following this approach, you can ensure your Neptune DB instances remain updated while minimizing disruptions to your applications. +### Using the AWS CLI @@ -32 +56 @@ By following this approach, you can ensure your Neptune DB instances remain upda -## Operations that trigger OS upgrades +To determine whether an update is available using the , call the `describe-pending-maintenance-actions` command: @@ -34 +57,0 @@ By following this approach, you can ensure your Neptune DB instances remain upda -Pending OS upgrades for Neptune DB instances are also applied when any of the following operations are performed: @@ -36 +59 @@ Pending OS upgrades for Neptune DB instances are also applied when any of the fo - * Compute Scaling: Changing the DB instance class triggers the pending OS upgrades. + aws neptune describe-pending-maintenance-actions @@ -38 +60,0 @@ Pending OS upgrades for Neptune DB instances are also applied when any of the fo - * Cluster Stop/Start: Restarting a Neptune DB cluster applies any pending OS upgrades. @@ -40 +62,9 @@ Pending OS upgrades for Neptune DB instances are also applied when any of the fo - * New DB Instances: Any new DB instance launched in a cluster always starts with the latest available OS version. + { + "ResourceIdentifier": "arn:aws:rds:us-east-1:123456789012:db:myneptune", + "PendingMaintenanceActionDetails": [ + { + "Action": "system-update", + "Description": "New Operating System update is available" + } + ] + } @@ -41,0 +72 @@ Pending OS upgrades for Neptune DB instances are also applied when any of the fo +To apply the Operating system updates, call the `apply-pending-maintenance-action` command: @@ -43,0 +75,4 @@ Pending OS upgrades for Neptune DB instances are also applied when any of the fo + aws neptune apply-pending-maintenance-action \ + --apply-action system-update \ + --resource-identifier (ARN of your DB instance) \ + --opt-in-type immediate