AWS AmazonRDS documentation change
Summary
Added new error 1727 documentation for RPC failures and Kerberos configuration guidance for Multi-AZ/Single-AZ instances
Security assessment
The change adds documentation about firewall requirements (TCP ports 49152-65535) and Kerberos authentication reliability during failovers. While these relate to security configurations, there's no evidence of addressing a specific disclosed vulnerability. The guidance helps prevent authentication failures and service disruptions, which are security-adjacent but not direct vulnerability fixes.
Diff
diff --git a/AmazonRDS/latest/UserGuide/USER_SQLServer_SelfManagedActiveDirectory.TroubleshootingSelfManagedActiveDirectory.md b/AmazonRDS/latest/UserGuide/USER_SQLServer_SelfManagedActiveDirectory.TroubleshootingSelfManagedActiveDirectory.md index b91d79283..8d621f1d1 100644 --- a//AmazonRDS/latest/UserGuide/USER_SQLServer_SelfManagedActiveDirectory.TroubleshootingSelfManagedActiveDirectory.md +++ b//AmazonRDS/latest/UserGuide/USER_SQLServer_SelfManagedActiveDirectory.TroubleshootingSelfManagedActiveDirectory.md @@ -15 +15 @@ Error 234 / 0xEA | **`Specified Organizational Unit (OU) does not exist.`** | Th -Error 1326 / 0x52E | **`The user name or password is incorrect.`** | The domain service account credentials provided in AWS Secrets Manager contains an unknown username or bad password. The domain account may also be disabled in your self-managed AD. | Ensure the credentials provided in AWS Secrets Manager are correct and the domain account is enabled in your self-managed Active Directory. +Error 1326 / 0x52E | **`The user name or password is incorrect.`** | The domain service account credentials provided in AWS Secrets Manager contains an unknown username or bad password. The domain account may also be disabled in your self-managed AD. | Ensure the credentials provided in AWS Secrets Manager are correct and the domain account is enabled in your self-managed AD. @@ -17,0 +18 @@ Error 1722 / 0x6BA | **`The RPC server is unavailable.`** | There was an issue r +Error 1727 / 0x6BF | **`The remote procedure call failed and did not execute.`** | Network connectivity issue or firewall restriction blocking RPC communication to the domain controller. | If using Cross VPC domain join, validate Cross VPC communication is setup correctly with either VPC peering or Transit Gateway. Ensure TCP high ports `49152-65535` are reachable on your domain from your RDS for SQL Server DB instance, including any possible firewall restrictions. @@ -20,0 +22,11 @@ Error 2242 / 0x8c2 | **`The password of this user has expired.`** | The password +After joining your DB instance to a self-managed Active Directory domain, you might receive RDS events related to your domain health. + + + Unhealthy domain state detected while attempt to verify or + configure your Kerberos endpoint in your domain on + node node_n. message + +For Multi-AZ instances, you might notice the error reporting for both node1 and node2, which indicates your instance's Kerberos configuration is not ready for failover. In the event of a failover, you might experience authentication difficulties using Kerberos. Resolve the configuration issues to ensure Kerberos setup is valid and up to date. For Multi-AZ instances, no actions are required to use Kerberos authentication on the new primary host given all network and permission configurations are in place. + +For Single-AZ instances, node1 is the primary node. If your Kerberos authentication is not working as expected, check the instance events and resolve the configuration issues to ensure Kerberos setup is valid and up to date. +