AWS aurora-dsql documentation change
Summary
Updated documentation about PostgreSQL compatibility limitations, added transaction constraints, user permission restrictions, and connection/timezone limitations
Security assessment
Adds documentation about security-adjacent permissions (non-admin users being restricted from schema creation/public schema modifications) but does not indicate any vulnerability being fixed. The changes describe existing security controls rather than addressing a new issue.
Diff
diff --git a/aurora-dsql/latest/userguide/working-with-postgresql-compatibility-unsupported-features.md b/aurora-dsql/latest/userguide/working-with-postgresql-compatibility-unsupported-features.md index 3766bd679..a3803b1bf 100644 --- a//aurora-dsql/latest/userguide/working-with-postgresql-compatibility-unsupported-features.md +++ b//aurora-dsql/latest/userguide/working-with-postgresql-compatibility-unsupported-features.md @@ -5,3 +5 @@ -Unsupported objectsUnsupported constraintsUnsupported operationsUnsupported extensionsUnsupported SQL expressionsLimitations - -Amazon Aurora DSQL is provided as a Preview service. To learn more, see [Betas and Previews ](https://aws.amazon.com/service-terms/) in the AWS Service Terms. +Unsupported objectsUnsupported constraintsUnsupported commandsUnsupported extensionsUnsupported SQL expressionsCompatibility considerations @@ -16,0 +15,2 @@ The following sections highlight which PostgreSQL features are currently unsuppo +Objects supported by Aurora DSQL include the following: + @@ -23 +23 @@ The following sections highlight which PostgreSQL features are currently unsuppo - * Types + * Types (partial support) @@ -30,0 +31,2 @@ The following sections highlight which PostgreSQL features are currently unsuppo + * Partitions + @@ -43 +45 @@ The following sections highlight which PostgreSQL features are currently unsuppo -## Unsupported operations +## Unsupported commands @@ -48,0 +51,2 @@ The following sections highlight which PostgreSQL features are currently unsuppo + * `SAVEPOINT` + @@ -55,2 +58,0 @@ Aurora DSQL doesn't require vacuuming. The system maintains statistics and manag - * `SAVEPOINT` - @@ -62 +64 @@ Aurora DSQL doesn't require vacuuming. The system maintains statistics and manag -Aurora DSQL doesn't support PostgreSQL extensions. The following notable extensions are unsupported: +Aurora DSQL doesn't support PostgreSQL extensions. The followingable extensions are unsupported: @@ -104 +106,15 @@ Category | Primary Clause | Unsupported Clause -## Aurora DSQL limitations +## Aurora DSQL considerations for PostgreSQL compatibility + +Consider the following compatibility limitations when using Aurora DSQL. For general considerations, see [Considerations for working with Amazon Aurora DSQL](./considerations.html). For quotas and limits, see [Cluster quotas and database limits in Amazon Aurora DSQL](./CHAP_quotas.html). + + * Aurora DSQL uses a single built-in database named `postgres`. You can't create additional databases or rename or drop the `postgres` database. + + * The `postgres` database uses UTF-8 character encoding. You can't change the encoding. + + * The database uses the `C` collation only. + + * Aurora DSQL uses `UTC` as the system timezone. You can't modify the timezone using parameters or SQL statements like `SET TIMEZONE`. + + * The transaction isolation level is fixed at PostgreSQL `Repeatable Read`. + + * Transactions have the following constraints: @@ -106 +122 @@ Category | Primary Clause | Unsupported Clause -Note the following limitations of Aurora DSQL: + * A transaction can't mix DDL and DML operations @@ -108 +124 @@ Note the following limitations of Aurora DSQL: - * You are restricted to using the single built-in database called `postgres`. You can't create, rename, or drop other databases. + * A transaction can include only 1 DDL statement @@ -110 +126 @@ Note the following limitations of Aurora DSQL: - * You can't change the character encoding of the `postgres` database, which is set to `UTF-8`. + * A transaction can modify up to 3,000 rows, regardless of the number of secondary indexes @@ -112 +128 @@ Note the following limitations of Aurora DSQL: - * The collation of the database is `C` only. + * The 3,000-row limit applies to all DML statements (`INSERT`, `UPDATE`, `DELETE`) @@ -114 +130 @@ Note the following limitations of Aurora DSQL: - * The system timezone is set to `UTC`. You can't modify the default timezone using parameters or SQL statements such as `SET TIMEZONE`. + * Database connections time out after 1 hour. @@ -116 +132 @@ Note the following limitations of Aurora DSQL: - * The transaction isolation level is equivalent to PostgreSQL Repeatable Read. You can't change this isolation level. + * Aurora DSQL doesn't currently let you run `GRANT [permission] ON DATABASE`. If you attempt to run that statement, Aurora DSQL returns the error message `ERROR: unsupported object type in GRANT`. @@ -118 +134 @@ Note the following limitations of Aurora DSQL: - * A transaction can't contain a mixture of DDL and DML operations. + * Aurora DSQL doesn't let non-admin user roles to run the `CREATE SCHEMA` command. You can't run the `GRANT [permission] on DATABASE` command and grant `CREATE` permissions on the database. If a non-admin user role tries to create a schema, Aurora DSQL returns with the error message `ERROR: permission denied for database postgres`. @@ -120 +136 @@ Note the following limitations of Aurora DSQL: - * A transaction can contain at most 1 DDL statement. + * Non-admin users can't create objects in the public schema. Only admin users can crete objects in the public schema. The admin user role has permissions to grant read, write, and modify access to these objects to non-admin users, but it cannot grant `CREATE` permissions to the public schema itself. Non-admin users must use different, user-created schemas for object creation. @@ -122 +138 @@ Note the following limitations of Aurora DSQL: - * A transaction cannot modify more than 3,000 rows. The number of secondary indexes does not influence this number. This limit applies to all DML statements (INSERT, UPDATE, DELETE). + * Aurora DSQL doesn't support the command `ALTER ROLE [] CONNECTION LIMIT`. Contact AWS support if you need a connection limit increase. @@ -124 +140 @@ Note the following limitations of Aurora DSQL: - * A connection can't exceed 1 hour. + * Aurora DSQL doesn't support asyncpg, the asynchronous PostgreSQL database driver for Python.