AWS aurora-dsql documentation change
Summary
Updated authentication token documentation with clarified expiration behavior, connection persistence after token expiration, improved terminology consistency ('token' to 'authentication token'), added S3 permission requirements for CloudShell, and corrected SDK implementation guidance
Security assessment
The change adds security documentation by clarifying that authentication tokens only govern initial connection (persisting sessions after expiration) and explicitly linking to S3 permission requirements. However, there is no evidence of addressing a specific vulnerability. The updates improve security awareness but don't fix a known issue.
Diff
diff --git a/aurora-dsql/latest/userguide/SECTION_authentication-token.md b/aurora-dsql/latest/userguide/SECTION_authentication-token.md index 22dcc5776..965ea9267 100644 --- a//aurora-dsql/latest/userguide/SECTION_authentication-token.md +++ b//aurora-dsql/latest/userguide/SECTION_authentication-token.md @@ -7,2 +6,0 @@ ConsoleAWS CloudShellAWS CLIAurora DSQL SDKs -Amazon Aurora DSQL is provided as a Preview service. To learn more, see [Betas and Previews ](https://aws.amazon.com/service-terms/) in the AWS Service Terms. - @@ -11 +9,3 @@ Amazon Aurora DSQL is provided as a Preview service. To learn more, see [Betas a -To connect to Amazon Aurora DSQL with a SQL client, generate an authentication token to use as the password. If you create the token using the AWS console, these tokens automatically expire in one hour by default. If you use the AWS CLI or SDKs to create the token, the default is 15 minutes. The maximum is 604,800 seconds, which is one week. To connect to Aurora DSQL from your client again, you can use the same token if it hasn't expired, or you can generate a new one. +To connect to Amazon Aurora DSQL with a SQL client, generate an authentication token to use as the password. This token is used only for authenticating the connection. After the connection is established, the connection remains valid even if the authentication token expires. + +If you create an authentication token using the AWS console, the token automatically expires in one hour by default. If you use the AWS CLI or SDKs to create the token, the default is 15 minutes. The maximum duration is 604,800 seconds, which is one week. To connect to Aurora DSQL from your client again, you can use the same authentication token if it hasn't expired, or you can generate a new one. @@ -13 +13 @@ To connect to Amazon Aurora DSQL with a SQL client, generate an authentication t -To get started with generating a token, [create an IAM policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) and [a cluster in Aurora DSQL](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/getting-started.html#getting-started-quickstart). Then use the console, AWS CLI, or the AWS SDKs to generate a token. +To get started with generating a token, [create an IAM policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) and [a cluster in Aurora DSQL](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/getting-started.html#getting-started-quickstart). Then use the AWS console , AWS CLI, or the AWS SDKs to generate a token. @@ -19 +19 @@ At a minimum, you must have the IAM permissions listed in [Connecting to your cl - * Use the AWS console to generate a token in Aurora DSQL + * Use the AWS console to generate an authentication token in Aurora DSQL @@ -21 +21 @@ At a minimum, you must have the IAM permissions listed in [Connecting to your cl - * Use AWS CloudShell to generate a token in Aurora DSQL + * Use AWS CloudShell to generate an authentication token in Aurora DSQL @@ -23 +23 @@ At a minimum, you must have the IAM permissions listed in [Connecting to your cl - * Use the AWS CLI to generate a token in Aurora DSQL + * Use the AWS CLI to generate an authentication token in Aurora DSQL @@ -30 +30 @@ At a minimum, you must have the IAM permissions listed in [Connecting to your cl -## Use the AWS console to generate a token in Aurora DSQL +## Use the AWS console to generate an authentication token in Aurora DSQL @@ -38 +38 @@ Aurora DSQL authenticates users with a token rather than a password. You can gen - 2. Create a cluster using the steps in [Step 1: Create an Aurora DSQL single-Region cluster](./getting-started.html#getting-started-create-cluster) or [Step 4: Create a multi-Region peered cluster](./getting-started.html#getting-started-multi-region). + 2. Choose the cluster ID of the cluster for which you want to generate an authentication token. If you haven't yet created a cluster, follow the steps in [Step 1: Create an Aurora DSQL single-Region cluster](./getting-started.html#getting-started-create-cluster) or [Step 4: Create a multi-Region cluster](./getting-started.html#getting-started-multi-region). @@ -40 +40 @@ Aurora DSQL authenticates users with a token rather than a password. You can gen - 3. After you create a cluster, choose the cluster ID of the cluster for which you want to generate an authentication token. + 3. Choose **Connect**. @@ -42 +42 @@ Aurora DSQL authenticates users with a token rather than a password. You can gen - 4. Choose **Connect**. + 4. Choose whether you want to connect as `admin` or with a [custom database role](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/authentication-authorization.html#authentication-authorization-iam-role-connect). @@ -44,3 +44 @@ Aurora DSQL authenticates users with a token rather than a password. You can gen - 5. In the modal, choose whether you want to connect as `admin` or with a [custom database role](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/authentication-authorization.html#authentication-authorization-iam-role-connect). - - 6. Copy the generated authentication token and use it to connect to [ Aurora DSQL from your SQL client](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/accessing-sql-clients.html). + 5. Copy the generated authentication token and use it to connect to [ Aurora DSQL from your SQL client](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/accessing-sql-clients.html). @@ -53 +51 @@ To learn more about custom database roles and IAM in Aurora DSQL, see [Authentic -## Use AWS CloudShell to generate a token in Aurora DSQL +## Use AWS CloudShell to generate an authentication token in Aurora DSQL @@ -55 +53 @@ To learn more about custom database roles and IAM in Aurora DSQL, see [Authentic -Before you can generate an authentication token using AWS CloudShell, make sure that you have completed the following prerequisites: +Before you can generate an authentication token using AWS CloudShell, make sure that you do the following: @@ -57 +55 @@ Before you can generate an authentication token using AWS CloudShell, make sure - * [Created a Aurora DSQL cluster](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/getting-started.html#getting-started-quickstart) + * [Create a Aurora DSQL cluster](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/getting-started.html#getting-started-quickstart). @@ -59 +57 @@ Before you can generate an authentication token using AWS CloudShell, make sure - * Added permission to run the Amazon S3 operation `get-object` to retrieve objects from an AWS account outside of your organization + * Add a permission to run the Amazon S3 operation `get-object` to retrieve objects from an AWS account outside of your organization. For more information, see the [_Amazon S3 User Guide_](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example4.html). @@ -74 +72 @@ Before you can generate an authentication token using AWS CloudShell, make sure - 4. Run the following command to generate an authentication token for the `admin` role. Replace `us-east-1` with your Region and `cluster_endpoint` with the endpoint of your own cluster. + 4. Run the following command to generate an authentication token for the `admin` role. Replace `us-east-1` with your Region and `your_cluster_endpoint` with the endpoint of your own cluster. @@ -83 +81 @@ If you're not connecting as `admin`, use `generate-db-connect-auth-token` instea - --hostname cluster_endpoint + --hostname your_cluster_endpoint @@ -109 +107 @@ To learn more about custom database roles and IAM in Aurora DSQL, see [Authentic -## Use the AWS CLI to generate a token in Aurora DSQL +## Use the AWS CLI to generate an authentication token in Aurora DSQL @@ -111 +109 @@ To learn more about custom database roles and IAM in Aurora DSQL, see [Authentic -When your cluster is `ACTIVE`, you can generate an authentication token. Use either of the following techniques: +When your cluster is `ACTIVE`, you can generate an authentication token on the CLI by using the `aws dsql` command. Use either of the following techniques: @@ -113 +111 @@ When your cluster is `ACTIVE`, you can generate an authentication token. Use eit - * If you are connecting with the `admin` role, use the `generate-db-connect-admin-auth-token` command. + * If you are connecting with the `admin` role, use the `generate-db-connect-admin-auth-token` option. @@ -115 +113 @@ When your cluster is `ACTIVE`, you can generate an authentication token. Use eit - * If you are connecting with a custom database role, use the `generate-db-connect-auth-token` command. + * If you are connecting with a custom database role, use the `generate-db-connect-auth-token` option. @@ -175 +173 @@ You can generate the token in the following ways: - # use `generate_db_connect_auth_token` instead if you are _not_ connecting as admin. + # use `generate_db_connect_auth_token` instead if you are not connecting as admin. @@ -343,2 +341 @@ You can generate the token in the following ways: - # The token expiration time is optional, and the default value 900 seconds - # if you are not using admin role, use generate_db_connect_auth_token instead + # if you're not using admin role, use generate_db_connect_auth_token instead @@ -359 +356 @@ You can generate the token in the following ways: -The .NET SDK doesn't provide the API to generate the token. The following code sample shows how to generate the authentication token for .NET. +The official SDK for .NET doesn't include a built-in API call to generate an authentication token for Aurora DSQL. Instead, you must use `DSQLAuthTokenGenerator`, which is a utility class. The following code sample shows how to generate the authentication token for .NET. @@ -390 +387 @@ Golang -The Golang SDK does not provide the API to generate the token. The following code sample shows how to generate the authentication token for Golang. +The Golang SDK doesn't provide a built-in method for generating a pre-signed token. You must manually construct the signed request, as shown in the following code example. @@ -392 +389 @@ The Golang SDK does not provide the API to generate the token. The following cod -You can generate the token in the following ways: +In the following code example, specify the `action` based on the PostgreSQL user: @@ -394 +391 @@ You can generate the token in the following ways: - * If you're connecting with the `admin` role, use `DbConnectAdmin`. + * If you're connecting with the `admin` role, use the `DbConnectAdmin` action. @@ -396 +393 @@ You can generate the token in the following ways: - * If you're connecting with a custom database role, use `DbConnect`. + * If you're connecting with a custom database role, use the `DbConnect` action.