AWS aurora-dsql medium security documentation change
Summary
Updated code examples across multiple languages to demonstrate cluster updates with deletion protection parameter, improved error handling, and modernized syntax
Security assessment
The changes consistently highlight the 'deletion_protection_enabled' parameter across all language examples, which is a critical security feature that prevents accidental cluster deletion. While not addressing a specific vulnerability, this documentation update emphasizes security best practices by demonstrating protection against unintended data loss.
Diff
diff --git a/aurora-dsql/latest/userguide/getting-started-update-cluster.md b/aurora-dsql/latest/userguide/getting-started-update-cluster.md index 776596586..d6a3c0847 100644 --- a//aurora-dsql/latest/userguide/getting-started-update-cluster.md +++ b//aurora-dsql/latest/userguide/getting-started-update-cluster.md @@ -7 +7 @@ Amazon Aurora DSQL is provided as a Preview service. To learn more, see [Betas a -# Update a cluster in Aurora DSQL with the AWS SDKs +# Update a cluster @@ -19 +19,2 @@ To update a single or multi-Region cluster, use the following example. - def update_cluster(cluster_id, deletionProtectionEnabled, client): + + def update_cluster(region, cluster_id, deletion_protection_enabled): @@ -21 +22,2 @@ To update a single or multi-Region cluster, use the following example. - return client.update_cluster(identifier=cluster_id, deletionProtectionEnabled=deletionProtectionEnabled) + client = boto3.client("dsql", region_name=region) + return client.update_cluster(identifier=cluster_id, deletionProtectionEnabled=deletion_protection_enabled) @@ -28,5 +31,5 @@ To update a single or multi-Region cluster, use the following example. - client = boto3.client("dsql", region_name=region) - cluster_id = "foo0bar1baz2quux3quuux4" - deletionProtectionEnabled = True - response = update_cluster(cluster_id, deletionProtectionEnabled, client) - print("Deletion Protection Updating to: " + str(deletionProtectionEnabled) + ", Cluster Status: " + response['status']) + cluster_id = "<your cluster id>" + deletion_protection_enabled = False + response = update_cluster(region, cluster_id, deletion_protection_enabled) + print(f"Updated {response["arn"]} with deletion_protection_enabled: {deletion_protection_enabled}") + @@ -44,0 +48 @@ Use the following example to update a single or multi-Region cluster. + #include <aws/core/utils/Outcome.h> @@ -53,10 +57,16 @@ Use the following example to update a single or multi-Region cluster. - ClusterStatus updateCluster(const String& clusterId, bool deletionProtection, DSQLClient& client) { - UpdateClusterRequest request; - request.SetIdentifier(clusterId); - request.SetDeletionProtectionEnabled(deletionProtection); - UpdateClusterOutcome outcome = client.UpdateCluster(request); - ClusterStatus status = ClusterStatus::NOT_SET; - - if (outcome.IsSuccess()) { - const auto& cluster = outcome.GetResult(); - status = cluster.GetStatus(); + /** + * Updates a cluster in Amazon Aurora DSQL + */ + UpdateClusterResult UpdateCluster(const Aws::String& region, const Aws::Map<Aws::String, Aws::String>& updateParams) { + // Create client for the specified region + DSQL::DSQLClientConfiguration clientConfig; + clientConfig.region = region; + DSQL::DSQLClient client(clientConfig); + + // Create update request + UpdateClusterRequest updateRequest; + updateRequest.SetClientToken(Aws::Utils::UUID::RandomUUID()); + + // Set identifier (required) + if (updateParams.find("identifier") != updateParams.end()) { + updateRequest.SetIdentifier(updateParams.at("identifier")); @@ -64 +74 @@ Use the following example to update a single or multi-Region cluster. - std::cerr << "Update operation failed: " << outcome.GetError().GetMessage() << std::endl; + throw std::runtime_error("Cluster identifier is required for update operation"); @@ -67,2 +77,14 @@ Use the following example to update a single or multi-Region cluster. - std::cout << "Cluster Status: " << ClusterStatusMapper::GetNameForClusterStatus(status) << std::endl; - return status; + // Set deletion protection if specified + if (updateParams.find("deletion_protection_enabled") != updateParams.end()) { + bool deletionProtection = (updateParams.at("deletion_protection_enabled") == "true"); + updateRequest.SetDeletionProtectionEnabled(deletionProtection); + } + + // Execute the update + auto updateOutcome = client.UpdateCluster(updateRequest); + if (!updateOutcome.IsSuccess()) { + std::cerr << "Failed to update cluster: " << updateOutcome.GetError().GetMessage() << std::endl; + throw std::runtime_error("Unable to update cluster"); + } + + return updateOutcome.GetResult(); @@ -74,3 +96,5 @@ Use the following example to update a single or multi-Region cluster. - DSQLClientConfiguration clientConfig; - - clientConfig.region = "us-east-1"; + { + try { + // Define region and update parameters + Aws::String region = "us-east-1"; + Aws::String clusterId = "<your cluster id>"; @@ -78 +102,4 @@ Use the following example to update a single or multi-Region cluster. - DSQLClient client(clientConfig); + // Create parameter map + Aws::Map<Aws::String, Aws::String> updateParams; + updateParams["identifier"] = clusterId; + updateParams["deletion_protection_enabled"] = "false"; @@ -80,2 +107 @@ Use the following example to update a single or multi-Region cluster. - String clusterId = "foo0bar1baz2quux3quuux4"; - bool deletionProtection = true; + auto updatedCluster = UpdateCluster(region, updateParams); @@ -83 +109,6 @@ Use the following example to update a single or multi-Region cluster. - updateCluster(clusterId, deletionProtection, client); + std::cout << "Updated " << updatedCluster.GetArn() << std::endl; + } + catch (const std::exception& e) { + std::cerr << "Error: " << e.what() << std::endl; + } + } @@ -96,2 +126,5 @@ To update a single or multi-Region cluster, use the following example. - import { DSQLClient } from "@aws-sdk/client-dsql"; - import { UpdateClusterCommand } from "@aws-sdk/client-dsql"; + import { DSQLClient, UpdateClusterCommand } from "@aws-sdk/client-dsql"; + + export async function updateCluster(region, clusterId, deletionProtectionEnabled) { + + const client = new DSQLClient({ region }); @@ -99 +131,0 @@ To update a single or multi-Region cluster, use the following example. - async function updateCluster(clusterId, deletionProtectionEnabled, client) { @@ -115,7 +147,2 @@ To update a single or multi-Region cluster, use the following example. - const client = new DSQLClient({ region }); - - const clusterId = "foo0bar1baz2quux3quuux4"; - const deletionProtectionEnabled = true; - - const response = await updateCluster(clusterId, deletionProtectionEnabled, client); - console.log("Updating deletion protection: " + deletionProtectionEnabled + "- Cluster Status: " + response.status); + const clusterId = "<CLUSTER_ID>"; + const deletionProtectionEnabled = false; @@ -122,0 +150,2 @@ To update a single or multi-Region cluster, use the following example. + const response = await updateCluster(region, clusterId, deletionProtectionEnabled); + console.log(`Updated ${response.arn}`); @@ -133,0 +162,2 @@ Use the following example to update a single or a multi-Region cluster. + package org.example; + @@ -135,3 +164,0 @@ Use the following example to update a single or a multi-Region cluster. - import software.amazon.awssdk.core.client.config.ClientOverrideConfiguration; - import software.amazon.awssdk.core.retry.RetryMode; - import software.amazon.awssdk.http.urlconnection.UrlConnectionHttpClient; @@ -139 +165,0 @@ Use the following example to update a single or a multi-Region cluster. - import software.amazon.awssdk.retries.StandardRetryStrategy; @@ -144,2 +169,0 @@ Use the following example to update a single or a multi-Region cluster. - import java.net.URI; - @@ -148,0 +174 @@ Use the following example to update a single or a multi-Region cluster. + String clusterId = "<your cluster id>"; @@ -150,4 +176 @@ Use the following example to update a single or a multi-Region cluster. - ClientOverrideConfiguration clientOverrideConfiguration = ClientOverrideConfiguration.builder() - .retryStrategy(StandardRetryStrategy.builder().build()) - .build(); - + try ( @@ -155,2 +177,0 @@ Use the following example to update a single or a multi-Region cluster. - .httpClient(UrlConnectionHttpClient.create()) - .overrideConfiguration(clientOverrideConfiguration) @@ -158,0 +180,5 @@ Use the following example to update a single or a multi-Region cluster. + .build() + ) { + UpdateClusterRequest request = UpdateClusterRequest.builder() + .identifier(clusterId) + .deletionProtectionEnabled(false) @@ -160,18 +186,2 @@ Use the following example to update a single or a multi-Region cluster. - - String cluster_id = "foo0bar1baz2quux3quuux4"; - Boolean deletionProtectionEnabled = false; - - UpdateClusterResponse response = updateCluster(cluster_id, deletionProtectionEnabled, client); - System.out.println("Deletion Protection updating to: " + deletionProtectionEnabled.toString() + ", Status: " + response.status()); - } - - public static UpdateClusterResponse updateCluster(String cluster_id, boolean deletionProtectionEnabled, DsqlClient client){ - UpdateClusterRequest updateClusterRequest = UpdateClusterRequest.builder() - .identifier(cluster_id) - .deletionProtectionEnabled(deletionProtectionEnabled) - .build(); - try { - return client.updateCluster(updateClusterRequest); - } catch (Exception e) { - System.out.println(("Unable to update deletion protection: " + e.getMessage())); - throw e; + UpdateClusterResponse cluster = client.updateCluster(request); + System.out.println("Updated " + cluster.arn()); @@ -190 +198,0 @@ Use the following example to update a single or a multi-Region cluster. - use aws_sdk_dsql::{config::{BehaviorVersion, Region}, Client, Config}; @@ -191,0 +200,4 @@ Use the following example to update a single or a multi-Region cluster. + use aws_sdk_dsql::{ + Client, Config, + config::{BehaviorVersion, Region}, + }; @@ -200,3 +212 @@ Use the following example to update a single or a multi-Region cluster. - let credentials = sdk_defaults - .credentials_provider() - .unwrap(); + let credentials = sdk_defaults.credentials_provider().unwrap(); @@ -213,2 +223,2 @@ Use the following example to update a single or a multi-Region cluster. - // Update a DSQL cluster and set delete protection to false. Also add new tags. - pub async fn update_cluster(region: &'static str, identifier: String) -> UpdateClusterOutput { + /// Update a DSQL cluster and set delete protection to false. Also add new tags. + pub async fn update_cluster(region: &'static str, identifier: &'static str) -> UpdateClusterOutput { @@ -225,10 +234,0 @@ Use the following example to update a single or a multi-Region cluster. - // Add new tags - client - .tag_resource() - .resource_arn(update_response.arn().to_owned()) - .tags(String::from("Function"), String::from("Billing")) - .tags(String::from("Environment"), String::from("Production")) - .send()