AWS AmazonRDS documentation change
Summary
Added documentation section for viewing secret details of tenant databases including ARN retrieval, status monitoring, and KMS key information
Security assessment
The change adds documentation about managing database credentials through Secrets Manager but does not address a specific security vulnerability. It provides operational guidance for existing security features (secret rotation, status monitoring, KMS encryption) rather than patching weaknesses.
Diff
diff --git a/AmazonRDS/latest/UserGuide/rds-secrets-manager.md b/AmazonRDS/latest/UserGuide/rds-secrets-manager.md index 8005ab3e2..c5872e55e 100644 --- a//AmazonRDS/latest/UserGuide/rds-secrets-manager.md +++ b//AmazonRDS/latest/UserGuide/rds-secrets-manager.md @@ -5 +5 @@ -LimitationsOverviewBenefitsPermissions required for Secrets Manager integrationEnforcing RDS managementManaging the master user password for a DB instanceManaging the master user password for a tenant databaseManaging the master user password for a Multi-AZ DB clusterRotating the master user password secret for a DB instanceRotating the master user password secret for a Multi-AZ DB clusterViewing the details about a secret for a DB instanceViewing the details about a secret for a Multi-AZ DB clusterRegion and version availability +LimitationsOverviewBenefitsPermissions required for Secrets Manager integrationEnforcing RDS managementManaging the master user password for a DB instanceManaging the master user password for a tenant databaseManaging the master user password for a Multi-AZ DB clusterRotating the master user password secret for a DB instanceRotating the master user password secret for a Multi-AZ DB clusterViewing the details about a secret for a DB instanceViewing the details about a secret for a Multi-AZ DB clusterViewing the details about a secret for a tenant databaseRegion and version availability @@ -36,0 +37,2 @@ Amazon RDS integrates with Secrets Manager to manage master user passwords for y + * Viewing the details about a secret for a tenant database + @@ -714,0 +717,82 @@ When you have the secret ARN, you can view details about the secret using the [G +## Viewing the details about a secret for a tenant database + +You can retrieve your secrets using the console ([https://console.aws.amazon.com/secretsmanager/](https://console.aws.amazon.com/secretsmanager/)) or the AWS CLI ([get-secret-value](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/get-secret-value.html) Secrets Manager command). + +You can find the Amazon Resource Name (ARN) of a secret managed by Amazon RDS in AWS Secrets Manager with the Amazon RDS console, the AWS CLI, or the Amazon RDS API. + +###### To view the details about a secret managed by Amazon RDS in AWS Secrets Manager for a tenant database + + 1. Sign in to the AWS Management Console and open the Amazon RDS console at [https://console.aws.amazon.com/rds/](https://console.aws.amazon.com/rds/). + + 2. In the navigation pane, choose **Databases**. + + 3. Choose the name of the DB instance that contains the tenant database to show its details. + + 4. Choose the **Configuration** tab. + +In the **Tenant databases** section, find the tenant database and view its **Master Credentials ARN**. + +You can follow the **Manage in Secrets Manager** link to view and manage the secret in the Secrets Manager console. + + + + +You can use the [describe-tenant-databases](https://docs.aws.amazon.com/cli/latest/reference/rds/describe-tenant-databases.html) Amazon RDS AWS CLI command to find the following information about a secret managed by Amazon RDS in AWS Secrets Manager for a tenant database: + + * `SecretArn` – The ARN of the secret + + * `SecretStatus` – The status of the secret + +The possible status values include the following: + + * `creating` – The secret is being created. + + * `active` – The secret is available for normal use and rotation. + + * `rotating` – The secret is being rotated. + + * `impaired` – The secret can be used to access database credentials, but it can't be rotated. A secret might have this status if, for example, permissions are changed so that Amazon RDS can no longer access the secret or the KMS key for the secret. + +When a secret has this status, you can correct the condition that caused the status. If you correct the condition that caused status, the status remains `impaired` until the next rotation. Alternatively, you can modify the tenant database to turn off automatic management of database credentials, and then modify the tenant database again to turn on automatic management of database credentials. To modify the tenant database, use the `--manage-master-user-password` option in the [modify-tenant-database](https://docs.aws.amazon.com/cli/latest/reference/rds/modify-tenant-database.html) command. + + * `KmsKeyId` – The ARN of the KMS key that is used to encrypt the secret + + + + +Specify the `--db-instance-identifier` option to show output for tenant databases in a specific DB instance. You can also specify the `--tenant-db-name` option to show output for a specific tenant database. This example shows the output for a secret that is used by a tenant database. + + + aws rds describe-tenant-databases \ + --db-instance-identifier database-3 \ + --query "TenantDatabases[0].MasterUserSecret" + +Following is sample output for a secret: + + + { + "SecretArn": "arn:aws:secretsmanager:us-east-2:123456789012:secret:rds!db-ABC123", + "SecretStatus": "active", + "KmsKeyId": "arn:aws:kms:us-east-2:123456789012:key/aa11bb22-####-####-####-fedcba123456" + } + +When you have the secret ARN, you can view details about the secret using the [get-secret-value](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/get-secret-value.html) Secrets Manager AWS CLI command. + +This example shows the details for the secret in the previous sample output. + +For Linux, macOS, or Unix: + + + aws secretsmanager get-secret-value \ + --secret-id 'arn:aws:secretsmanager:us-east-2:123456789012:secret:rds!db-ABC123' + +For Windows: + + + aws secretsmanager get-secret-value ^ + --secret-id 'arn:aws:secretsmanager:us-east-2:123456789012:secret:rds!db-ABC123' + +You can view the ARN, status, and KMS key for a secret managed by Amazon RDS in AWS Secrets Manager by using the [DescribeTenantDatabases](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeTenantDatabases.html) operation and setting the `DBInstanceIdentifier` parameter to a DB instance identifier. You can also set the `TenantDBName` parameter to a specific tenant database name. Details about the secret are included in the output. + +When you have the secret ARN, you can view details about the secret using the [GetSecretValue](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html) Secrets Manager operation. +