AWS amazondynamodb high security documentation change
Summary
Updated DynamoDB Local documentation to reflect v3.x release, migration guidance, and dependency changes. Removed active download links and added SDK migration notes.
Security assessment
The removal of valid CloudFront download links (replaced with empty placeholders) introduces a security risk, as users might download software from unofficial/insecure sources. Missing valid checksum links further exacerbates verification concerns. However, there is no explicit mention of addressing a specific vulnerability.
Diff
diff --git a/amazondynamodb/latest/developerguide/DynamoDBLocal.DownloadingAndRunning.md b/amazondynamodb/latest/developerguide/DynamoDBLocal.DownloadingAndRunning.md index ba952d367..5b7b42058 100644 --- a//amazondynamodb/latest/developerguide/DynamoDBLocal.DownloadingAndRunning.md +++ b//amazondynamodb/latest/developerguide/DynamoDBLocal.DownloadingAndRunning.md @@ -7 +7 @@ -###### Important +###### Note @@ -9 +9 @@ -DynamoDB local jar can be downloaded from our AWS CloudFront distribution links referenced here. Starting January 1, 2025, the old S3 distribution buckets will no longer be active and DynamoDB local will be distributed through CloudFront distribution links only. + * DynamoDB local is available in three versions: v3.x (Current), v2.x (Legacy), and v1.x (Deprecated). @@ -11 +11 @@ DynamoDB local jar can be downloaded from our AWS CloudFront distribution links -###### Note + * DynamoDB v3.x is recommended for your local testing and development use. @@ -13 +13 @@ DynamoDB local jar can be downloaded from our AWS CloudFront distribution links - * There are two major versions of DynamoDB local available: DynamoDB local v2.x (Current) and DynamoDB local v1.x (Legacy). Customers should use version 2.x (Current) when possible, as it supports the latest versions of the Java Runtime Environment and is compatible with the jakarta.* namespace for Maven project. DynamoDB local v1.x will reach end of standard support starting on January 1, 2025. After this date, v1.x will no longer receive updates or bug fixes. + * Migration from DynamoDB local V2.x to V3.x requires updating import statements from `com.amazonaws.services.dynamodbv2` to `software.amazon.dynamodb` and updating Maven dependencies for Maven users. @@ -15 +15 @@ DynamoDB local jar can be downloaded from our AWS CloudFront distribution links - * DynamoDB local `AWS_ACCESS_KEY_ID` can contain only letters (A–Z, a–z) and numbers (0–9). + * If you're migrating an application that uses the SDK for Java v1.x to the SDK for Java 2.x, follow the steps for [AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/migration.html). @@ -28 +28 @@ Download Links | Checksums -[.tar.gz](https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_latest.tar.gz) | [.zip](https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_latest.zip) | [.tar.gz.sha256](https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_latest.tar.gz.sha256) | [.zip.sha256](https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_latest.zip.sha256) +[.tar.gz]() | [.zip]() | [.tar.gz.sha256]() | [.zip.sha256]() @@ -158,0 +159,4 @@ The YAML scripts require that you specify an AWS access key and an AWS secret ke +###### Note + +If you're migrating an application that uses the SDK for Java v1.x to the SDK for Java 2.x, follow the steps for [AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/migration.html). + @@ -170 +174 @@ Follow these steps to use Amazon DynamoDB in your application as a dependency. - <groupId>com.amazonaws</groupId> + <groupId>software.amazon.dynamodb</groupId> @@ -172 +176 @@ Follow these steps to use Amazon DynamoDB in your application as a dependency. - <version>2.6.0</version> + <version>3.0</version> @@ -203 +207 @@ Example template for use with Spring Boot 3 and/or Spring Framework 6: - <groupId>com.amazonaws</groupId> + <groupId>software.amazon.dynamodb</groupId> @@ -205 +209 @@ Example template for use with Spring Boot 3 and/or Spring Framework 6: - <version>2.6.0</version> + <version>3.0</version>