AWS AmazonRDS low security documentation change
Summary
Updated documentation to standardize references from 'AWS Glue catalog' to 'AWS Glue managed catalog', added region placeholders in ARN examples, and corrected cross-account setup instructions.
Security assessment
The changes enforce more precise terminology around AWS Glue managed services and standardize security configurations by using region placeholders in ARNs. While not directly addressing a disclosed vulnerability, the explicit requirement to configure resource policies with proper region/account context and cross-account IAM roles improves security posture by reducing misconfiguration risks.
Diff
diff --git a/AmazonRDS/latest/UserGuide/zero-etl.creating-smlh.md b/AmazonRDS/latest/UserGuide/zero-etl.creating-smlh.md index 463ae9080..4e9bd6938 100644 --- a//AmazonRDS/latest/UserGuide/zero-etl.creating-smlh.md +++ b//AmazonRDS/latest/UserGuide/zero-etl.creating-smlh.md @@ -9 +9 @@ PrerequisitesRequired permissionsCreating zero-ETL integrations with an Amazon S -When you create an Amazon RDS zero-ETL integration with an Amazon SageMaker lakehouse, you specify the source RDS database and the target Amazon SageMaker lakehouse. You can also customize encryption settings and add tags. Amazon RDS creates an integration between the source database and its target. Once the integration is active, any data that you insert into the source database will be replicated into the configured AWS Glue target. +When you create an Amazon RDS zero-ETL integration with an Amazon SageMaker lakehouse, you specify the source RDS database and the target AWS Glue managed catalog. You can also customize encryption settings and add tags. Amazon RDS creates an integration between the source database and its target. Once the integration is active, any data that you insert into the source database will be replicated into the configured target. @@ -13 +13 @@ When you create an Amazon RDS zero-ETL integration with an Amazon SageMaker lake -Before you create a zero-ETL integration with an Amazon SageMaker lakehouse, you must create a source database and a target AWS Glue catalog. You also must allow replication into the catalog by adding the database as an authorized integration source. +Before you create a zero-ETL integration with an Amazon SageMaker lakehouse, you must create a source database and a target AWS Glue managed catalog. You also must allow replication into the catalog by adding the database as an authorized integration source. @@ -25 +25 @@ Certain IAM permissions are required to create a zero-ETL integration with an Am - * Create inbound integrations into the target AWS Glue catalog. + * Create inbound integrations into the target AWS Glue managed catalog. @@ -27 +27 @@ Certain IAM permissions are required to create a zero-ETL integration with an Am - * Access Amazon S3 buckets used by the AWS Glue catalog. + * Access Amazon S3 buckets used by the AWS Glue managed catalog. @@ -33 +33 @@ Certain IAM permissions are required to create a zero-ETL integration with an Am - * Put resource policy on the AWS Glue catalog to authorize inbound integrations. + * Put resource policy on the AWS Glue managed catalog to authorize inbound integrations. @@ -40 +40 @@ The following sample policy demonstrates the [least privilege permissions](https -Additionally, you must configure a resource policy on the target AWS Glue catalog to authorize inbound integrations. Use the following AWS CLI command to apply the resource policy. +Additionally, you must configure a resource policy on the target AWS Glue managed catalog to authorize inbound integrations. Use the following AWS CLI command to apply the resource policy. @@ -54 +54 @@ Additionally, you must configure a resource policy on the target AWS Glue catalo - "Resource": ["arn:aws:glue:us-east-1:account_id:catalog/catalog_name"], + "Resource": ["arn:aws:glue:region:account_id:catalog/catalog_name"], @@ -57 +57 @@ Additionally, you must configure a resource policy on the target AWS Glue catalo - "aws:SourceArn": "arn:aws:rds:us-east-1:account_id:db:source_name" + "aws:SourceArn": "arn:aws:rds:region:account_id:db:source_name" @@ -67 +67 @@ Additionally, you must configure a resource policy on the target AWS Glue catalo - "Resource": ["arn:aws:glue:sa-east-1:account_id:catalog/catalog_name"] + "Resource": ["arn:aws:glue:region:account_id:catalog/catalog_name"] @@ -71 +71 @@ Additionally, you must configure a resource policy on the target AWS Glue catalo - --region sa-east-1 + --region region @@ -82 +82 @@ Glue catalog Amazon Resource Names (ARNs) have the following format: -### Choosing a target AWS Glue catalog in a different account +### Choosing a target AWS Glue managed catalog in a different account @@ -84 +84 @@ Glue catalog Amazon Resource Names (ARNs) have the following format: -If you plan to specify a target AWS Glue catalog that's in another AWS account, you must create a role that allows users in the current account to access resources in the target account. For more information, see [Providing access to an IAM user in another AWS account that you own](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html). +If you plan to specify a target AWS Glue managed catalog that's in another AWS account, you must create a role that allows users in the current account to access resources in the target account. For more information, see [Providing access to an IAM user in another AWS account that you own](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html). @@ -156 +156 @@ Modifying DB parameters requires a reboot. Before you can create the integration - 1. (Optional) To use a different AWS account for the Amazon SageMaker lakehouse target, choose **Specify a different account**. Then, enter the ARN of an IAM role with permissions to display your AWS Glue catalogs. For instructions to create the IAM role, see Choosing a target AWS Glue catalog in a different account. + 1. (Optional) To use a different AWS account for the Amazon SageMaker lakehouse target, choose **Specify a different account**. Then, enter the ARN of an IAM role with permissions to display your AWS Glue catalogs. For instructions to create the IAM role, see Choosing a target AWS Glue managed catalog in a different account. @@ -158 +158 @@ Modifying DB parameters requires a reboot. Before you can create the integration - 2. For **AWS Glue catalog** , select the target for replicated data from the source database. You can choose an existing AWS Glue catalog as the target. + 2. For **AWS Glue catalog** , select the target for replicated data from the source database. You can choose an existing AWS Glue managed catalog as the target. @@ -192 +192 @@ The target IAM role must have the following trust relationship: - 4. You must grant the target IAM role describe permissions for the target AWS Glue catalog with the Lake Formation administrator role created in [Step 3b: Create a target Amazon SageMaker lakehouse](./zero-etl.setting-up.html#zero-etl-setting-up.sagemaker). + 4. You must grant the target IAM role describe permissions for the target AWS Glue managed catalog with the Lake Formation administrator role created in [Step 3b: Create an AWS Glue catalog for Amazon SageMaker zero-ETL integration](./zero-etl.setting-up.html#zero-etl-setting-up.sagemaker). @@ -196 +196 @@ The target IAM role must have the following trust relationship: -RDS notifies you if the resource policy or configuration settings for the specified AWS Glue catalog aren't configured correctly. If you receive this message, you can either choose **Fix it for me** , or configure them manually. +RDS notifies you if the resource policy or configuration settings for the specified AWS Glue managed catalog aren't configured correctly. If you receive this message, you can either choose **Fix it for me** , or configure them manually. @@ -200 +200 @@ If your selected source and target are in different AWS accounts, then Amazon RD - 9. Once your target AWS Glue catalog is configured correctly, choose **Next**. + 9. Once your target AWS Glue managed catalog is configured correctly, choose **Next**. @@ -231 +231 @@ When the integration is successfully created, the status of the integration and -To prepare a target AWS Glue catalog for zero-ETL integration using the AWS CLI, you must first use the [create-integration-resource-property](https://docs.aws.amazon.com/cli/latest/reference/rds/create-integration.html) command with the following options: +To prepare a target AWS Glue managed catalog for zero-ETL integration using the AWS CLI, you must first use the [create-integration-resource-property](https://docs.aws.amazon.com/cli/latest/reference/rds/create-integration.html) command with the following options: @@ -233 +233 @@ To prepare a target AWS Glue catalog for zero-ETL integration using the AWS CLI, - * `--resource-arn` – Specify the ARN of the AWS Glue catalog that will be the target for the integration. + * `--resource-arn` – Specify the ARN of the AWS Glue managed catalog that will be the target for the integration. @@ -235 +235 @@ To prepare a target AWS Glue catalog for zero-ETL integration using the AWS CLI, - * `--target-processing-properties` – Specify the ARN of the IAM role to access the target AWS Glue catalog + * `--target-processing-properties` – Specify the ARN of the IAM role to access the target AWS Glue managed catalog @@ -251 +251 @@ To create a zero-ETL integration with an Amazon SageMaker lakehouse using the AW - * `--target-arn` – Specify the ARN of the AWS Glue catalog that will be the target for the integration. + * `--target-arn` – Specify the ARN of the AWS Glue managed catalog that will be the target for the integration. @@ -282 +282 @@ Catalog names are limited to 19 characters. Ensure your IntegrationName paramete - * `TargetArn` – Specify the ARN of the AWS Glue catalog that will be the target for the integration. + * `TargetArn` – Specify the ARN of the AWS Glue managed catalog that will be the target for the integration.