AWS AmazonRDS high security documentation change
Summary
Updated documentation for OEM Management Agent configuration, including TLS version requirements and added 'Securing the Management Agent' section
Security assessment
Added explicit requirement to set MINIMUM_TLS_VERSION to TLSv1.2 for connecting to OMS 24.1 hosts, addressing potential vulnerabilities from older TLS versions. Added new 'Securing the Management Agent' section with secure_oem_agent procedure, which directly documents security hardening steps.
Diff
diff --git a/AmazonRDS/latest/UserGuide/Oracle.Options.OEMAgent.md b/AmazonRDS/latest/UserGuide/Oracle.Options.OEMAgent.md index 108797511..9fff8cef6 100644 --- a//AmazonRDS/latest/UserGuide/Oracle.Options.OEMAgent.md +++ b//AmazonRDS/latest/UserGuide/Oracle.Options.OEMAgent.md @@ -5 +5 @@ -RequirementsHost prerequisitesLimitationsOption settingsAdding the optionStep 2: Unlocking the DBSNMP user accountStep 3: Adding your targets to the Management Agent consolePerforming database tasks with the Management AgentRemoving the option +RequirementsHost prerequisitesLimitationsOption settingsEnabling the optionRemoving the optionPerforming DB tasks @@ -23,7 +23 @@ For more information, see [Overview of Oracle Enterprise Manager cloud control 1 - * Step1: Adding the Management Agent option to your DB instance - - * Step 2: Unlocking the DBSNMP user account - - * Step 3: Adding your targets to the Management Agent console - - * Administering the Management Agent + * Enabling the Management Agent option for your DB instance @@ -32,0 +27,2 @@ For more information, see [Overview of Oracle Enterprise Manager cloud control 1 + * Performing database tasks with the Management Agent + @@ -44 +40 @@ Following are general requirements for using Management Agent: - * Management Agent versions 13.5.0.0.v2 and 13.5.0.0.v3 require OMS version 13.5.0.23. + * Management Agent versions 13.5.0.0.v2 and 13.5.0.0.v3 require OMS version 13.5.0.23 or 24.1. @@ -46 +42 @@ Following are general requirements for using Management Agent: - * Management Agent version 13.5.0.0.v1 requires OMS version 13.5.0.0. + * Management Agent version 13.5.0.0.v1 requires OMS version 13.5.0.0 or 24.1. @@ -62 +58 @@ Following are general requirements for using Management Agent: - * At least 4.5 GiB OEM 13c Release 1 + * At least 4.5 GiB for OEM 13c Release 1 @@ -81 +77 @@ Make sure that your OMS host and your Amazon RDS DB instance can communicate. Do -From the OMS host to your DB instance +_From the OMS host to your DB instance_ @@ -98,0 +95,2 @@ Configure a one-way firewall rule that allows traffic from the DB instance to th + * To connect OEM Management Agent version 13.5.0.0 (v1-v3) to a 24.1 OMS host, set `MINIMUM_TLS_VERSION` to use the TLS 1.2 protocol `TLSv1.2` in your configuration options. + @@ -140 +138 @@ In the AWS GovCloud (US) Regions, 13.1 versions aren't available. -**MINIMUM_TLS_VERSION** | No | `TLSv1` (default), `TLSv1.2` | A value that specifies the minimum TLS version supported by the OEM Agent while the agent listens as a server. Desupported agent versions only support the `TLSv1` setting. +**MINIMUM_TLS_VERSION** | No | `TLSv1` (default), `TLSv1.2` | A value that specifies the minimum TLS version supported by the OEM Agent while the agent listens as a server. Desupported agent versions only support the `TLSv1` setting. To connect 13.5.0.0 (v1-v3) to a 24.1 OMS host, set this to `TLSv1.2`. @@ -156 +154,16 @@ TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | 13.2.0.0.v3 and higher | Yes -## Step1: Adding the Management Agent option to your DB instance +## Enabling the Management Agent option for your DB instance + +To enable the Management Agent option, use the following steps: + +###### Topics + + * Step 1: Adding the Management Agent option to your DB instance + + * Step 2: Unlocking the DBSNMP user account + + * Step 3: Adding your targets to the Management Agent console + + + + +### Step 1: Adding the Management Agent option to your DB instance @@ -220 +233 @@ For Windows: -## Step 2: Unlocking the DBSNMP user account +### Step 2: Unlocking the DBSNMP user account @@ -249 +262 @@ If you receive an error stating that the procedure doesn't exist, reboot your CD -## Step 3: Adding your targets to the Management Agent console +### Step 3: Adding your targets to the Management Agent console @@ -294 +307,14 @@ To add a DB instance as a target, make sure you know the endpoint and port. For -## Administering the Management Agent +## Removing the Management Agent option + +You can remove the OEM Agent from a DB instance. After you remove the OEM Agent, you don't need to restart your DB instance. + +To remove the OEM Agent from a DB instance, do one of the following: + + * Remove the OEM Agent option from the option group it belongs to. This change affects all DB instances that use the option group. For more information, see [Removing an option from an option group](./USER_WorkingWithOptionGroups.html#USER_WorkingWithOptionGroups.RemoveOption). + + * Modify the DB instance and specify a different option group that doesn't include the OEM Agent option. This change affects a single DB instance. You can specify the default (empty) option group, or a different custom option group. For more information, see [Modifying an Amazon RDS DB instance](./Overview.DBInstance.Modifying.html). + + + + +## Performing database tasks with the Management Agent @@ -303,0 +330,2 @@ Tasks are executed asynchronously. + * Securing the Management Agent + @@ -322,0 +351,11 @@ Tasks are executed asynchronously. +### Securing the Management Agent + +To secure the Management Agent, run the Amazon RDS procedure `rdsadmin.rdsadmin_oem_agent_tasks.secure_oem_agent`. This procedure is equivalent to running the `emctl secure agent` command. + +The following procedure creates a task to secure the Management Agent and returns the ID of the task: + + + SELECT rdsadmin.rdsadmin_oem_agent_tasks.secure_oem_agent as TASK_ID from DUAL; + +To display the output file for the task and view the result, see Viewing the status of an ongoing task. + @@ -332 +371 @@ The following procedure creates a task to get the Management Agent's status and -To view the result by displaying the task's output file, see Viewing the status of an ongoing task. +To display the output file for the task and view the result, see Viewing the status of an ongoing task. @@ -343 +382 @@ The following procedure creates a task to restart the Management Agent and retur -To view the result by displaying the task's output file, see Viewing the status of an ongoing task. +To display the output file for the task and view the result, see Viewing the status of an ongoing task. @@ -354 +393 @@ The following procedure creates a task to list the targets monitored by the Mana -To view the result by displaying the task's output file, see Viewing the status of an ongoing task. +To display the output file for the task and view the result, see Viewing the status of an ongoing task. @@ -365 +404 @@ The following procedure creates a task to list the collection threads and return -To view the result by displaying the task's output file, see Viewing the status of an ongoing task. +To display the output file for the task and view the result, see Viewing the status of an ongoing task. @@ -376 +415 @@ The following procedure creates a task that clears the Management Agent's state -To view the result by displaying the task's output file, see Viewing the status of an ongoing task. +To display the output file for the task and view the result, see Viewing the status of an ongoing task. @@ -387 +426 @@ The following procedure creates a task that makes the Management Agent upload it -To view the result by displaying the task's output file, see Viewing the status of an ongoing task. +To display the output file for the task and view the result, see Viewing the status of an ongoing task. @@ -398 +437 @@ The following procedure creates a task that pings the Management Agent's OMS and -To view the result by displaying the task's output file, see Viewing the status of an ongoing task. +To display the output file for the task and view the result, see Viewing the status of an ongoing task. @@ -416,13 +454,0 @@ For more information about the Amazon RDS procedure `rdsadmin.rds_file_util.read -## Removing the Management Agent option - -You can remove the OEM Agent from a DB instance. After you remove the OEM Agent, you don't need to restart your DB instance. - -To remove the OEM Agent from a DB instance, do one of the following: - - * Remove the OEM Agent option from the option group it belongs to. This change affects all DB instances that use the option group. For more information, see [Removing an option from an option group](./USER_WorkingWithOptionGroups.html#USER_WorkingWithOptionGroups.RemoveOption). - - * Modify the DB instance and specify a different option group that doesn't include the OEM Agent option. This change affects a single DB instance. You can specify the default (empty) option group, or a different custom option group. For more information, see [Modifying an Amazon RDS DB instance](./Overview.DBInstance.Modifying.html). - - - -