AWS dms documentation change
Summary
Added note about Service Control Policies (SCPs) potentially restricting IAM role permissions for CloudWatch logs
Security assessment
Highlights how security policies (SCPs) can affect operational permissions. While not fixing a vulnerability, it adds documentation about security policy interactions.
Diff
diff --git a/dms/latest/userguide/CHAP_Troubleshooting.md b/dms/latest/userguide/CHAP_Troubleshooting.md index 2ece1ed98..f32fbc96a 100644 --- a//dms/latest/userguide/CHAP_Troubleshooting.md +++ b//dms/latest/userguide/CHAP_Troubleshooting.md @@ -5 +5 @@ -Migration tasks run slowlyTask status bar doesn't moveTask completes but nothing was migratedForeign keys and secondary indexes are missingAWS DMS does not create CloudWatch logsIssues occur with connecting to Amazon RDSNetworking issues occurCDC is stuck after full loadPrimary key violation errors occur when you restart a taskInitial load of a schema failsTasks fail with an unknown errorTask restart loads tables from the beginningNumber of tables per task causes issuesTasks fail when a primary key is created on a LOB columnDuplicate records occur on a target table without a primary keySource endpoints fall in the reserved IP rangeTimestamps are garbled in Amazon Athena queriesTroubleshooting issues with OracleTroubleshooting issues with MySQLTroubleshooting issues with PostgreSQLTroubleshooting issues with Microsoft SQL ServerTroubleshooting issues with Amazon RedshiftTroubleshooting issues with Amazon Aurora MySQL Troubleshooting issues with SAP ASETroubleshooting issues with IBM Db2 +Migration tasks run slowlyTask status bar doesn't moveTask completes but nothing was migratedForeign keys and secondary indexes are missingAWS DMS does not create CloudWatch logsIssues occur with connecting to Amazon RDSNetworking issues occurCDC is stuck after full loadPrimary key violation errors occur when you restart a taskInitial load of a schema failsTasks fail with an unknown errorTask restart loads tables from the beginningNumber of tables per task causes issuesTasks fail when a primary key is created on a LOB columnDuplicate records occur on a target table without a primary keySource endpoints fall in the reserved IP rangeTimestamps are garbled in Amazon Athena queriesTroubleshooting issues with OracleTroubleshooting issues with MySQLTroubleshooting issues with PostgreSQLTroubleshooting issues with Microsoft SQL ServerTroubleshooting issues with Amazon RedshiftTroubleshooting issues with Amazon Aurora MySQL Troubleshooting issues with SAP ASETroubleshooting issues with IBM Db2Table suspended a table with error "Failed to build 'where' statement" @@ -66,0 +67,2 @@ For troubleshooting purposes, AWS DMS collects trace and dump files in the repli + * Table suspended a table with error "Failed to build 'where' statement" + @@ -146,0 +149,4 @@ If your replication task doesn't create CloudWatch logs, make sure that your acc +###### Note + +If your account is part of AWS Organizations, verify that Service Control Policies (SCPs) are not restricting your IAM role permissions. SCPs can override and limit IAM role permissions even when they are properly configured. + @@ -1114,0 +1121,24 @@ For ongoing replication (CDC), if you plan to start replication from a specific +## Table suspended a table with error "Failed to build 'where' statement" + +In DMS when you try to update a record in a table that does not have a primary key, the system is unable to construct a WHERE condition and displays the following error: + + + [TARGET_APPLY ]E: Failed to build 'where' statement + +This can occur due to multiple known issues or limitations, They are: + + * Primary key column is removed using the `remove-column` transformation rule. + + * Table structure has a mismatch between your source and target databases, that is primary key column existing on source but not on the target or may have been removed. + + * Known limitations or missing prerequisites: + + * Supplemental logging not properly enabled on Oracle tables. + + * Oracle table created with long object names (over 30 bytes) , Hence object names could be table or column name. + + * Replication from Oracle application containers PDB. + + + +