AWS AmazonRDS high security documentation change
Summary
Added documentation about the critical IAM role `rds-directoryservice-access-role` required for domain-connected SQL Server instances, including consequences of deleting the role and remediation steps.
Security assessment
The change highlights security implications of IAM role deletion, including loss of management capabilities and potential operational risks. It explicitly warns about permission requirements and troubleshooting challenges due to missing CloudTrail logs, which are security-related operational concerns.
Diff
diff --git a/AmazonRDS/latest/UserGuide/USER_SQLServerWinAuth.md b/AmazonRDS/latest/UserGuide/USER_SQLServerWinAuth.md index dd3970724..abc52d467 100644 --- a//AmazonRDS/latest/UserGuide/USER_SQLServerWinAuth.md +++ b//AmazonRDS/latest/UserGuide/USER_SQLServerWinAuth.md @@ -48,0 +49,19 @@ For the role to allow access, the AWS Security Token Service (AWS STS) endpoint +When you create a domain-connected RDS for SQL Server DB instance using the Amazon RDS console, AWS automatically creates the `rds-directoryservice-access-role` IAM role. This role is essential for managing domain-connected instances and is required for the following operations: + + * Making configuration changes to domain-connected SQL Server instances + + * Managing Active Directory integration settings + + * Performing maintenance operations on domain-joined instances + + + + +###### Important + +If you delete the `rds-directoryservice-access-role` IAM role, you can't make changes to your domain-connected SQL Server instance through the Amazon RDS console or API. Attempting to modify the instance results in an error message stating: **`You don't have permission to iam:CreateRole. To request access, copy the following text and send it to your AWS administrator.`** + +This error occurs because Amazon RDS needs to recreate the role to manage the domain connection, but lacks the necessary permissions. Additionally, this error is not logged in CloudTrail, which can make troubleshooting more difficult. + +If you accidentally delete the `rds-directoryservice-access-role`, you must have `iam:CreateRole` permissions to recreate it before you can make any changes to your domain-connected SQL Server instance. To recreate the role manually, ensure it has the `AmazonRDSDirectoryServiceAccess` managed policy attached and the appropriate trust relationship that allows the RDS service to assume the role. +