AWS aurora-dsql documentation change
Summary
Expanded documentation on IAM roles and users for authentication, including temporary credentials and usage methods
Security assessment
Adds detailed explanations of IAM authentication mechanisms, enhancing security documentation but not directly resolving a security issue.
Diff
diff --git a/aurora-dsql/latest/userguide/using-database-and-iam-roles.md b/aurora-dsql/latest/userguide/using-database-and-iam-roles.md index 57c279e17..d71b19397 100644 --- a//aurora-dsql/latest/userguide/using-database-and-iam-roles.md +++ b//aurora-dsql/latest/userguide/using-database-and-iam-roles.md @@ -5 +5 @@ -Authorizing database roles to connect to your clusterAuthorizing database roles to use SQL in your databaseRevoking database authorization from an IAM role +IAM rolesIAM usersConnectQuery Revoke @@ -7 +7 @@ Authorizing database roles to connect to your clusterAuthorizing database roles -# Using database roles with IAM roles +# Using database roles and IAM authentication @@ -9 +9,24 @@ Authorizing database roles to connect to your clusterAuthorizing database roles -In the following sections, learn how to use database roles from PostgreSQL with IAM roles in Aurora DSQL. +Aurora DSQL supports authentication using both IAM roles and IAM users. You can use either method to authenticate and access Aurora DSQL databases. + +## IAM roles + +An IAM role is an identity within your AWS account that has specific permissions but is not associated with a specific person. Using IAM roles provide temporary security credentials. You can temporarily assume an IAM role in several ways: + + * By switching roles in the AWS Management Console + + * By calling an AWS CLI or AWS API operation + + * By using a custom URL + + + + +After assuming a role, you can access Aurora DSQL using the role's temporary credentials. For more information about methods for using roles, see [IAM Identities](https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html) in the _IAM user guide_. + +## IAM users + +An IAM user is an identity within your AWS account that has specific permissions and is associated with a single person or application. IAM users have long-term credentials such as passwords and access keys that can be used to access Aurora DSQL. + +###### Note + +To run SQL commands with IAM authentication, you can use either IAM role ARNs or IAM user ARNs in the examples below. @@ -15 +38 @@ Create an IAM role and grant connection authorization with the IAM policy action -The IAM policy must also grant permission to access the cluster resources. Use a wildcard (`*`) or follow the instructions in [How to restrict access to cluster ARNs](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/using-iam-condition-keys.html#using-iam-condition-keys-create-cluster). +The IAM policy must also grant permission to access the cluster resources. Use a wildcard (`*`) or follow the instructions in [Using IAM condition keys with Amazon Aurora DSQL](./using-iam-condition-keys.html#using-iam-condition-keys-create-cluster).