AWS license-manager documentation change
Summary
Added documentation section 'CAL token handling during migration to RDS SAL' explaining behavior of existing Client Access License tokens during migration
Security assessment
The change documents operational behavior of license token handling during migration but does not address any security vulnerability or weakness. It explains existing token expiration mechanics rather than introducing security controls.
Diff
diff --git a/license-manager/latest/userguide/troubleshooting.md b/license-manager/latest/userguide/troubleshooting.md index 104876308..1a01742c2 100644 --- a//license-manager/latest/userguide/troubleshooting.md +++ b//license-manager/latest/userguide/troubleshooting.md @@ -5 +5 @@ -Cross-account discovery errorManagement account cannot disassociate resources from a self-managed licenseSystems Manager Inventory is out of dateApparent persistence of a de-registered AMINew child account instances are slow to appear in resource inventoryAfter enabling cross-account mode, child account instances are slow to appearCross-account discovery cannot be disabledChild account user cannot associate shared self-managed license with an instanceLinking AWS Organizations accounts failsUser subscription product configuration failingUser subscription instances failing to launchSeamless domain join for EC2 instances with user subscription products doesn't workUnable to delete active directoryVPC endpoint was created in my accountRemove all VPC endpoint resources created by License ManagerUnable to delete AWSServiceRoleForAWSLicenseManagerUserSubscriptionsService Service Linked Role (SLR)Subscription is not present error for RDS SAL productTroubleshooting trustsBilling issues for user subscriptionsUser subscription products show Marketplace subscription status of InactiveChange a username on Managed Active DirectoryDissociate users from a terminated instanceUser limits per instanceInstalling additional software on user subscription instancesJapanese Language Packs on user subscription instancesLocal Administrator user on user subscription instancesUnhealthy instancesNumber of users that can RDP to a user subscriptions instanceSupported Windows operating systemsSupported versions of Office and Visual StudioUsing user subscription with older Windows Server versionsUsing License Manager user subscriptions across accounts or regionsUsers in my self-managed AD with User subscription productsTips for contacting AWS Support +Cross-account discovery errorManagement account cannot disassociate resources from a self-managed licenseSystems Manager Inventory is out of dateApparent persistence of a de-registered AMINew child account instances are slow to appear in resource inventoryAfter enabling cross-account mode, child account instances are slow to appearCross-account discovery cannot be disabledChild account user cannot associate shared self-managed license with an instanceLinking AWS Organizations accounts failsUser subscription product configuration failingUser subscription instances failing to launchSeamless domain join for EC2 instances with user subscription products doesn't workUnable to delete active directoryVPC endpoint was created in my accountRemove all VPC endpoint resources created by License ManagerUnable to delete AWSServiceRoleForAWSLicenseManagerUserSubscriptionsService Service Linked Role (SLR)Subscription is not present error for RDS SAL productTroubleshooting trustsBilling issues for user subscriptionsUser subscription products show Marketplace subscription status of InactiveChange a username on Managed Active DirectoryDissociate users from a terminated instanceUser limits per instanceInstalling additional software on user subscription instancesJapanese Language Packs on user subscription instancesLocal Administrator user on user subscription instancesUnhealthy instancesNumber of users that can RDP to a user subscriptions instanceSupported Windows operating systemsSupported versions of Office and Visual StudioUsing user subscription with older Windows Server versionsUsing License Manager user subscriptions across accounts or regions CAL token handling during migration to RDS SAL Users in my self-managed AD with User subscription productsTips for contacting AWS Support @@ -274,0 +275,4 @@ These scenarios are not supported: +## CAL token handling during migration to RDS SAL + +If you use your own Microsoft RDS license servers, any Client Access License (CAL) tokens already issued remain valid until they expire. During this period users with valid CAL tokens are not automatically subscribed to the RDS SAL product. New user sessions are not automatically subscribed to RDS SAL even though License Manager is configured. License Manager does not override existing CAL tokens issued by your own license servers. The service-managed license server begins issuing tokens and handling new requests only after the existing CAL tokens expire. Once the currently issued CAL tokens reach their expiration date, new token requests are handled by the service-managed license server, and users are auto-subscribed to the RDS SAL product as needed. +