AWS aurora-dsql medium security documentation change
Summary
Updated multi-Region cluster documentation with witness Region details, encryption properties, and example cluster identifiers
Security assessment
Added explicit mention of encrypted transaction logs in witness Regions and introduced 'encryptionDetails' properties in examples. This demonstrates documentation of encryption-at-rest security controls.
Diff
diff --git a/aurora-dsql/latest/userguide/configuring-multi-region-clusters.md b/aurora-dsql/latest/userguide/configuring-multi-region-clusters.md index b12a70ece..69e7cfeb4 100644 --- a//aurora-dsql/latest/userguide/configuring-multi-region-clusters.md +++ b//aurora-dsql/latest/userguide/configuring-multi-region-clusters.md @@ -7,2 +6,0 @@ Connecting to your multi-Region clusterCreating multi-Region clustersDeleting mu -Amazon Aurora DSQL is provided as a Preview service. To learn more, see [Betas and Previews ](https://aws.amazon.com/service-terms/) in the AWS Service Terms. - @@ -15 +13 @@ This chapter explains how to configure and manage clusters across multiple AWS R -Multi-Region peered clusters provide two regional endpoints, one in each peered cluster AWS Region. Both endpoints present a single logical database that supports concurrent read and write operations with strong data consistency. Multi-Region witness clusters do not have endpoints. +Multi-Region peered clusters provide two regional endpoints, one in each peered cluster AWS Region. Both endpoints present a single logical database that supports concurrent read and write operations with strong data consistency. In addition to peered clusters, a multi-Region cluster also has a witness Region that stores a limited window of encrypted transaction logs, which is used to improve multi-Region durability and availability. Multi-Region witness Regions do not have endpoints. @@ -19 +17 @@ Multi-Region peered clusters provide two regional endpoints, one in each peered -To create multi-Region clusters, you first create a cluster with a witness Region and then peer it with another cluster. The following example shows how to create clusters in US East (N. Virginia) and US East (Ohio) with US West (Oregon) as the witness Region. +To create multi-Region clusters, you first create a cluster with a witness Region. Then you peer this cluster with a second cluster that shares the same witness Region as your first cluster. The following example shows how to create clusters in US East (N. Virginia) and US East (Ohio) with US West (Oregon) as the witness Region. @@ -34,10 +32,6 @@ To create a cluster in the US East (N. Virginia) AWS Region with multi-Region pr - "identifier": "foo0bar1baz2quux3quuxquux4", - "arn": "arn:aws:dsql:us-east-1:111122223333:cluster/foo0bar1baz2quux3quuxquux4", - "status": "PENDING_SETUP", - "creationTime": "2025-05-06T06:46:10.745000-07:00", - "deletionProtectionEnabled": true, - "multiRegionProperties": { - "witnessRegion": "us-west-2", - "clusters": [ - "arn:aws:dsql:us-east-1:111122223333:cluster/foo0bar1baz2quux3quuxquux4" - ] + "identifier": "abc0def1baz2quux3quuux4", + "arn": "arn:aws:dsql:us-east-1:111122223333:cluster/abc0def1baz2quux3quuux4", + "status": "UPDATING", + "encryptionDetails": { + "encryptionType": "AWS_OWNED_KMS_KEY", + "encryptionStatus": "ENABLED" @@ -44,0 +39 @@ To create a cluster in the US East (N. Virginia) AWS Region with multi-Region pr + "creationTime": "2024-05-24T09:15:32.708000-07:00" @@ -50 +44 @@ To create a cluster in the US East (N. Virginia) AWS Region with multi-Region pr -When the API operation succeeds, the cluster enters the `PENDING_SETUP` state. Cluster creation remains on hold until you update the cluster with the ARN of its peer cluster. +When the API operation succeeds, the cluster enters the `PENDING_SETUP` state. Cluster creation remains in the `PENDING_SETUP` until you update the cluster with the ARN of its peer cluster. @@ -78,2 +72 @@ To create a cluster in the US East (Ohio) AWS Region with multi-Region propertie - -When the API operation succeeds, the cluster transitions to `PENDING_SETUP` state. The cluster creation remains on hold until you update it with the ARN of another cluster for peering. +When the API operation succeeds, the cluster transitions to `PENDING_SETUP` state. The cluster creation remains in the `PENDING_SETUP` state until you update it with the ARN of another cluster for peering. @@ -140,0 +134,4 @@ When you describe a cluster, you can view multi-Region properties for clusters i + "encryptionDetails": { + "encryptionType": "AWS_OWNED_KMS_KEY", + "encryptionStatus": "ENABLED" + }, @@ -192,2 +189,2 @@ The command returns the following response. - "identifier": "foo0bar1baz2quux3quux4quuux", - "arn": "arn:aws:dsql:us-east-1:111122223333:cluster/foo0bar1baz2quux3quux4quuux", + "identifier": "foo0bar1baz2quux3quuxquux4", + "arn": "arn:aws:dsql:us-east-1:111122223333:cluster/foo0bar1baz2quux3quuxquux4", @@ -218 +215 @@ The cluster transitions to `PENDING_DELETE` status. The deletion isn't complete - --identifier 'foo0bar1baz2quux3quux5quuuux' + --identifier 'foo0bar1baz2quux3quuxquux5' @@ -223,2 +220,2 @@ The command returns the following response: - "identifier": "foo0bar1baz2quux3quux5quuuux", - "arn": "arn:aws:dsql:us-east-2:111122223333:cluster/foo0bar1baz2quux3quux5quuuux", + "identifier": "foo0bar1baz2quux3quuxquux5", + "arn": "arn:aws:dsql:us-east-2:111122223333:cluster/foo0bar1baz2quux3quuxquux5", @@ -244 +241 @@ Single-Region clusters -Logging with CloudTrail +Programming with Aurora DSQL