AWS aurora-dsql medium security documentation change
Summary
Removed S3 permission requirement, simplified prerequisites, and renumbered steps
Security assessment
Removed instruction to add S3 `get-object` permissions for cross-account access. This could prevent over-permissive policies if the permission was unnecessary, addressing a potential misconfiguration risk.
Diff
diff --git a/aurora-dsql/latest/userguide/SECTION_authentication-token.md b/aurora-dsql/latest/userguide/SECTION_authentication-token.md index d37e4739b..9e93553f4 100644 --- a//aurora-dsql/latest/userguide/SECTION_authentication-token.md +++ b//aurora-dsql/latest/userguide/SECTION_authentication-token.md @@ -53,8 +53 @@ To learn more about custom database roles and IAM in Aurora DSQL, see [Authentic -Before you can generate an authentication token using AWS CloudShell, make sure that you do the following: - - * [Create a Aurora DSQL cluster](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/getting-started.html#getting-started-quickstart). - - * Add a permission to run the Amazon S3 operation `get-object` to retrieve objects from an AWS account outside of your organization. For more information, see the [_Amazon S3 User Guide_](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example4.html). - - - +Before you can generate an authentication token using AWS CloudShell, make sure that you [Create an Aurora DSQL cluster](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/getting-started.html#getting-started-quickstart). @@ -68,5 +61 @@ Before you can generate an authentication token using AWS CloudShell, make sure - 3. Follow [Installing or updating to the latest verison of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) to install the AWS CLI. - - sudo ./aws/install --update - - 4. Run the following command to generate an authentication token for the `admin` role. Replace `us-east-1` with your Region and `your_cluster_endpoint` with the endpoint of your own cluster. + 3. Run the following command to generate an authentication token for the `admin` role. Replace `us-east-1` with your Region and `your_cluster_endpoint` with the endpoint of your own cluster. @@ -85 +74 @@ If you run into issues, see [Troubleshoot IAM](https://docs.aws.amazon.com/IAM/l - 5. Use the following command to use `psql` to start a connection to your cluster. + 4. Use the following command to use `psql` to start a connection to your cluster. @@ -92 +81 @@ If you run into issues, see [Troubleshoot IAM](https://docs.aws.amazon.com/IAM/l - 6. You should see a prompt to provide a password. Copy the token that you generated, and make sure you don't include any additional spaces or characters. Paste it into the following prompt from `psql`. + 5. You should see a prompt to provide a password. Copy the token that you generated, and make sure you don't include any additional spaces or characters. Paste it into the following prompt from `psql`. @@ -96 +85 @@ If you run into issues, see [Troubleshoot IAM](https://docs.aws.amazon.com/IAM/l - 7. Press **Enter**. You should see a PostgreSQL prompt. + 6. Press **Enter**. You should see a PostgreSQL prompt.