AWS AmazonRDS high security documentation change
Summary
Added LDAPS configuration requirements, updated AD domain service account permissions (SPN/DNS), and emphasized secure communication
Security assessment
The addition of 'Configuring secure communication over LDAPS' section explicitly recommends encrypted LDAPS to prevent insecure LDAP traffic. The requirement for a valid SSL certificate to enable LDAPS addresses a security gap where unencrypted directory service queries could expose sensitive AD data. This is a direct security improvement.
Diff
diff --git a/AmazonRDS/latest/UserGuide/USER_SQLServer_SelfManagedActiveDirectory.Requirements.md b/AmazonRDS/latest/UserGuide/USER_SQLServer_SelfManagedActiveDirectory.Requirements.md index 359050288..5808bf8ca 100644 --- a//AmazonRDS/latest/UserGuide/USER_SQLServer_SelfManagedActiveDirectory.Requirements.md +++ b//AmazonRDS/latest/UserGuide/USER_SQLServer_SelfManagedActiveDirectory.Requirements.md @@ -5 +5 @@ -Configure your on-premises ADConfigure your network connectivityConfigure your AD domain service account +Configure your on-premises ADConfigure your network connectivityConfigure your AD domain service accountLDAPS @@ -18,0 +19,2 @@ Make sure you've met the following requirements before joining an RDS for SQL Se + * Configuring secure communication over LDAPS + @@ -26 +28 @@ Make sure that you have an on-premises or other self-managed Microsoft AD that y - * If you have Active Directory sites defined, make sure the subnets in the VPC associated with your RDS for SQL Server DB instance are defined in your Active Directory site. Confirm there aren't any conflicts between the subnets in your VPC and the subnets in your other AD sites. + * If you have AD sites defined, make sure the subnets in the VPC associated with your RDS for SQL Server DB instance are defined in your AD site. Confirm there aren't any conflicts between the subnets in your VPC and the subnets in your other AD sites. @@ -41 +43 @@ Make sure that you have met the following network configurations: - * Connectivity configured between the Amazon VPC where you want to create the RDS for SQL Server DB instance and your self-managed Active Directory. You can set up connectivity using AWS Direct Connect, AWS VPN, VPC peering, or AWS Transit Gateway. + * Configure connectivity between the Amazon VPC where you want to create the RDS for SQL Server DB instance and your self-managed AD. You can set up connectivity using AWS Direct Connect, AWS VPN, VPC peering, or AWS Transit Gateway. @@ -45 +47 @@ Make sure that you have met the following network configurations: - + @@ -75 +77 @@ Make sure that you have met the following requirements for an AD domain service - * Make sure that you have a service account in your self-managed AD domain with delegated permissions to join computers to the domain. A domain service account is a user account in your self-managed AD that has been delegated permission to perform certain tasks. + * Make sure that you have a domain service account in your self-managed AD domain with delegated permissions to join computers to the domain. A domain service account is a user account in your self-managed AD that has been delegated permission to perform certain tasks. @@ -85 +87,13 @@ Make sure that you have met the following requirements for an AD domain service -These represent the minimum set of permissions that are required to join computer objects to your self-managed Active Directory. For more information, see [Errors when attempting to join computers to a domain](https://learn.microsoft.com/en-US/troubleshoot/windows-server/identity/access-denied-when-joining-computers) in the Microsoft Windows Server documentation. +These represent the minimum set of permissions that are required to join computer objects to your self-managed AD. For more information, see [Errors when attempting to join computers to a domain](https://learn.microsoft.com/en-US/troubleshoot/windows-server/identity/access-denied-when-joining-computers) in the Microsoft Windows Server documentation. + + * To use Kerberos authentication, you need to provide Service Principal Names (SPNs) and DNS permissions to your AD domain service account: + + * **Write SPN** : Delegate the **Write SPN** permission to the AD domain service account in the OU where you need to join the RDS for SQL Server DB instance. This permissions is different from the validated write SPN. + + * **DNS permissions** : Provide the following permissions to the AD domain service account in the DNS manager at the server level for your domain controller: + + * List contents + + * Read all properties + + * Read permissions @@ -93,0 +108,4 @@ Do not move computer objects that RDS for SQL Server creates in the Organization +## Configuring secure communication over LDAPS + +Communication over LDAPS is recommended for RDS to query and access computer objects as well as SPNs in the domain controller. To use secure LDAP, use a valid SSL certificate on your domain controller that meets the requirements for secure LDAPS. If a valid SSL certificate does not exist on the domain controller, the RDS for SQL Server DB instance defaults to using LDAP. For more information on certificate validity, see [ Requirements for an LDAPS certificate](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/enable-ldap-over-ssl-3rd-certification-authority#requirements-for-an-ldaps-certificate). + @@ -100 +118 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Working with Self Managed Active Directory with a SQL Server DB instance +Working with self-managed Active Directory @@ -102 +120 @@ Working with Self Managed Active Directory with a SQL Server DB instance -Setting up Self Managed Active Directory +Setting up self-managed Active Directory