AWS odb medium security documentation change
Summary
Restructured resource sharing documentation with expanded limitations, added AWS RAM integration details, and clarified sharing constraints
Security assessment
Added explicit limitations about cross-account sharing constraints (same AWS organization only), enforced region-specific sharing, and immutable managed permissions. These changes clarify security boundaries and access control requirements for shared resources, preventing unintended cross-account access. The documentation now explicitly states that permissions are automatically enforced and cannot be modified, which is a security control.
Diff
diff --git a/odb/latest/UserGuide/resource-sharing.md b/odb/latest/UserGuide/resource-sharing.md index b74802933..1278fe016 100644 --- a//odb/latest/UserGuide/resource-sharing.md +++ b//odb/latest/UserGuide/resource-sharing.md @@ -5,3 +5 @@ -BenefitsHow resource sharing worksPermissions on shared resourcesConsiderations and limitations - -Oracle Database@AWS is in preview release and is subject to change. +AWS RAM integrationBenefitsHow resource sharing worksPermissions on shared resourcesLimitations @@ -23,0 +22,2 @@ When you share resources: +## Oracle Database@AWS integration with AWS RAM + @@ -25,0 +26,2 @@ Oracle Database@AWS uses AWS Resource Access Manager (AWS RAM) to enable secure, +With AWS RAM, you share resources that you own by creating a _resource share_. A resource share specifies the resources to share, and the AWS accounts with whom to share them. + @@ -64 +66 @@ Oracle Database@AWS shares the preceding resources through the following process - 5. After initialization, trusted accounts can create their own resources on the shared infrastructure, such as VM clusters on shared Exadata infrastructure and ODB network + 5. After initialization, trusted accounts can create their own resources on the shared infrastructure, such as VM clusters on shared Exadata infrastructure and ODB network. @@ -123 +125 @@ When a resource is unshared, trusted accounts lose the ability to create new res -## Considerations and limitations for Oracle Database@AWS resource sharing +## Limitations for Oracle Database@AWS resource sharing @@ -125 +127 @@ When a resource is unshared, trusted accounts lose the ability to create new res -When sharing Oracle Database@AWS resources, keep the following considerations in mind: +Before sharing resources, keep the following limitations in mind. @@ -127 +129 @@ When sharing Oracle Database@AWS resources, keep the following considerations in - * Resource sharing is supported only with AWS account IDs. +### Limitations for sharing resources @@ -129 +131 @@ When sharing Oracle Database@AWS resources, keep the following considerations in - * Resource shares are Region-specific. To share resources across Regions, you must create separate resource shares in each Region. +When sharing Oracle Database@AWS resources, keep in mind the following limitations: @@ -131 +133 @@ When sharing Oracle Database@AWS resources, keep the following considerations in - * Resource sharing is supported only within the same AWS organization. + * You can share resources only with AWS account IDs. @@ -133 +135,15 @@ When sharing Oracle Database@AWS resources, keep the following considerations in - * Only the buyer account (the account that accepts the Oracle Database@AWS private offer) can create Exadata infrastructure and ODB network resources. Trusted accounts can create resources only on shared infrastructure. + * You can share resources only for AWS accounts within the same AWS organization. + + * You share resources within a specific AWS Region. To share resources across Regions, you must create separate resource shares in each Region. + + * When you create a resource share, the actions (managed permissions) for each resource type are automatically selected and can't be modified. + + * You can't use Oracle Database@AWS as a resource and share with other AWS accounts. + + * A trusted account can use shared resources from only one buyer account (from one private offer). Thus, two buyer accounts can't share resources with the same trusted account. + + * A buyer account can't share resources with another buyer account. + + * The first resource shared with a trusted account must be shared by the buyer account in the US East (N. Virginia) Region. + + * When you unshare a resource, we recommend that you wait approximately 15 minutes before resharing the same resource with the same trusted account. @@ -135 +150,0 @@ When sharing Oracle Database@AWS resources, keep the following considerations in - * You can't delete Exadata infrastructure that has VM clusters created by trusted accounts until those VM clusters are removed. @@ -137 +151,0 @@ When sharing Oracle Database@AWS resources, keep the following considerations in - * You can't delete an ODB network that has an ODB peering connection created by a trusted account until the ODB peering connection has been removed. @@ -139 +152,0 @@ When sharing Oracle Database@AWS resources, keep the following considerations in - * The buyer account can't delete resources created by trusted accounts. @@ -141 +154,7 @@ When sharing Oracle Database@AWS resources, keep the following considerations in - * Trusted accounts can view shared resources but cannot modify or delete resources owned by the buyer account. +### Limitations for creating and using shared resources + +When creating or using Oracle Database@AWS resources, keep in mind the following limitations: + + * Only the buyer account can create Exadata infrastructure and ODB network resources. The buyer account is the one that accepts the Oracle Database@AWS private offer. + + * Trusted accounts can create resources only on Exadata infrastructure shared by the buyer account. @@ -145 +163,0 @@ When sharing Oracle Database@AWS resources, keep the following considerations in - * The specific actions (managed permissions) for each resource type are automatically selected during resource share creation and can't be modified. @@ -147 +165,11 @@ When sharing Oracle Database@AWS resources, keep the following considerations in - * You can't use Oracle Database@AWS as a resource and share with other accounts. + + +### Limitations for deleting shared resources + + * You can't delete Exadata infrastructure that has VM clusters created by trusted accounts until those VM clusters are removed. + + * You can't delete an ODB network that has an ODB peering connection created by a trusted account until the ODB peering connection has been removed. + + * The buyer account can't delete Oracle Database@AWS resources created by trusted accounts. + + * Trusted accounts can view shared resources but can't modify or delete Oracle Database@AWS resources owned by the buyer account.