AWS AmazonRDS medium security documentation change
Summary
Added new event codes (SP-S1011 to SP-S1016, SP-S3008) related to CloudWatch event permissions and database count limits for RDS Custom SQL Server instances
Security assessment
The changes document required permissions configurations (event bus policies, IAM profiles, permissions boundaries) that prevent security misconfigurations. Missing these permissions could block monitoring/logging capabilities and lead to undetected security issues.
Diff
diff --git a/AmazonRDS/latest/UserGuide/custom-troubleshooting-sqlserver.md b/AmazonRDS/latest/UserGuide/custom-troubleshooting-sqlserver.md index ee2ae2891..148c273af 100644 --- a//AmazonRDS/latest/UserGuide/custom-troubleshooting-sqlserver.md +++ b//AmazonRDS/latest/UserGuide/custom-troubleshooting-sqlserver.md @@ -257,0 +258,6 @@ To get the actual Allocated Volume Size: +`SP-S1011` | Event bus policy | **`The RDS Custom DB instance status is set to [Unsupported configuration] because of: The resource-based policy for your event bus arn:aws:events:region-1:123456789012:event-bus/default denies Amazon CloudWatch events:PutEvents actions. Resolve this by modifying your resource-based policy to allow events:PutEvents actions for EventBus %s.`** | +`SP-S1012` | CloudWatch VPC permissions | **`The RDS Custom DB instance status is set to [Unsupported configuration] because of: A VPC endpoint policy is missing permissions to access Amazon CloudWatch events. Resolve this by modifying your VPC endpoint policy to allow events:PutEvents on EventBus arn:aws:events:region-1:123456789012:event-bus/default.`** | +`SP-S1013` | Service control policy | **`The RDS Custom DB instance status is set to [Unsupported configuration] because of: A service control policy in your AWS Organizations is missing permissions to access Amazon CloudWatch events. Resolve this by modifying your service control policy to allow events:PutEvents on EventBus arn:aws:events:region-1:123456789012:event-bus/default.`** | +`SP-S1014` | IAM instance profile | **`The RDS Custom DB instance status is set to [Unsupported configuration] because of: Your IAM instance profile %s permissions deny Amazon CloudWatch events. Resolve this by setting ["events:PutEvents"] to 'Allow' and allowing events:PutEvents on EventBus arn:aws:events:region-1:123456789012:event-bus/default in your IAM profile associated with the instance.`** | +`SP-S1015` | IAM instance profile | **`The RDS Custom DB instance status is set to [Unsupported configuration] because of: Your IAM instance profile %s is missing Amazon CloudWatch event permissions. Resolve this by including the ["events:PutEvents"] permissions and allowing events:PutEvents on EventBus arn:aws:events:region-1:123456789012:event-bus/default in your IAM profile associated with the instance.`** | +`SP-S1016` | IAM permissions boundary | **`The RDS Custom DB instance status is set to [Unsupported configuration] because of: Your IAM instance profile %s has permissions boundary that deny Amazon CloudWatch events. Resolve this by setting ["events:PutEvents"] to 'Allow' for the EventBus arn:aws:events:region-1:123456789012:event-bus/default in your IAM instance profile permissions boundary.`** | @@ -261 +267 @@ To get the actual Allocated Volume Size: -Event Code | Configuration area | RDS event message | Validation proces +Event Code | Configuration area | RDS event message | Validation process @@ -304 +310 @@ For more information on modifying the EBS root volume, see [How](https://forums. -Event Code | Configuration area | RDS event message | Validation proces +Event Code | Configuration area | RDS event message | Validation process @@ -354,0 +361,7 @@ For more information, see [Modifying an RDS Custom for SQL Server DB instance](. +`SP-S3008` | Database Count Limit Exceeded | **`The RDS Custom DB instance status is set to [Unsupported configuration] because of: The total number of databases on the DB instance exceeds the maximum limit of 5000. To resolve this, reduce the number of databases below the maximum supported limit.`** | Use the following command to view total database count: + + + SELECT COUNT(name) as databaseCount + FROM sys.databases + WHERE name not in ('tempdb','master','model','msdb','DWDiagnostics','DWConfiguration','DWQueue'); +