AWS odb high security documentation change
Summary
Added documentation about specifying peer network CIDR ranges during ODB peering connection creation/updates to limit network access and enable granular segmentation. Added CLI examples and update procedures for CIDR management.
Security assessment
The changes explicitly describe security-focused network controls (CIDR restrictions) to reduce attack surface and improve compliance. Mentions reducing potential attack targets and enabling segmentation, which directly addresses security posture improvements.
Diff
diff --git a/odb/latest/UserGuide/configuring.md b/odb/latest/UserGuide/configuring.md index 00ea65129..daef3d8bf 100644 --- a//odb/latest/UserGuide/configuring.md +++ b//odb/latest/UserGuide/configuring.md @@ -13 +13,3 @@ Setting up ODB peeringConfiguring VPC route tables for ODB peeringConfiguring DN -With ODB peering connections, you can establish private network connectivity between your Oracle Exadata infrastructure and applications running in your Amazon VPCs. Each ODB peering connection is a separate resource that you can create, view, and delete independently of the ODB network. +With ODB peering connections, you can establish private network connectivity between your Oracle Exadata infrastructure and the applications running in your Amazon VPCs. Each ODB peering connection is a separate resource that you can create, view, and delete independently of the ODB network. + +When creating an ODB peering connection, you can specify peer network CIDR ranges. This technique limits network access to the required subnets, reduces potential targets for attacks, and enables more granular network segmentation for compliance requirements. @@ -25 +27 @@ You can create an ODB peering connection between an ODB network and an Amazon VP -You can create an ODB peering connection between an ODB network in one account and an Amazon VPC in a different account, after the ODB network has been shared using AWS RAM. +You can create an ODB peering connection between an ODB network in one account and an Amazon VPC in a different account, after the ODB network has been shared using AWS RAM. VPC owner accounts can manage CIDR ranges specified in the peering connection without also owning the ODB network. @@ -41 +43,3 @@ There is a 1:1 relationship between a VPC and an ODB network. You can't create a - 7. (Optional) In **Tags** , add a key and value pair. + 7. (Optional) For **Peer network CIDRs** , specify additional CIDR blocks from the peer VPC that can access the ODB network. If you don't specify CIDRs, all CIDRs from the peer VPC are allowed access. + + 8. (Optional) In **Tags** , add a key and value pair. @@ -43 +47 @@ There is a 1:1 relationship between a VPC and an ODB network. You can't create a - 8. Choose **Create ODB peering connection**. + 9. Choose **Create ODB peering connection**. @@ -56,0 +61,8 @@ To create an ODB peering connection, use the `create-odb-peering-connection` com +To limit access to the ODB network to specific CIDR ranges, use the `--peer-network-cidrs-to-be-added` parameter. If you don't specify CIDR ranges, all ranges have access. + + + aws odb create-odb-peering-connection \ + --odb-network-id odbnet-1234567890abcdef \ + --peer-network-id vpc-abcdef1234567890 \ + --peer-network-cidrs-to-be-added "10.0.1.0/24,10.0.2.0/24" + @@ -67,0 +80,37 @@ To get details about a specific ODB peering connection, use the `get-odb-peering +### Updating an ODB peering connection + +You can update an existing ODB peering connection to add or remove peer network CIDRs. You control which subnets in the peer VPC have access to your ODB network. + + 1. Sign in to the AWS Management Console and open the Oracle Database@AWS console at [https://console.aws.amazon.com/odb/](https://console.aws.amazon.com/odb/). + + 2. In the navigation pane, choose **ODB peering connections**. + + 3. Select the ODB peering connection that you want to update. + + 4. Choose **Actions** , and then choose **Update peering connection**. + + 5. In the **Peer network CIDRs** section, add or remove CIDR blocks as needed: + + * To add CIDRs, choose **Add CIDR** and enter the CIDR block. + + * To remove CIDRs, choose the **X** next to the CIDR block you want to remove. + + 6. Choose **Update peering connection**. + + + + +To add peer network CIDRs to an ODB peering connection, specify the parameter `--peer-network-cidrs-to-be-added` in the `update-odb-peering-connection` command. + + + aws odb update-odb-peering-connection \ + --odb-peering-connection-id odbpcx-1234567890abcdef \ + --peer-network-cidrs-to-be-added "10.0.1.0/24,10.0.3.0/24" + +To remove peer network CIDRs from an ODB peering connection, specify the parameter `--peer-network-cidrs-to-be-removed` in the `update-odb-peering-connection` command. + + + aws odb update-odb-peering-connection \ + --odb-peering-connection-id odbpcx-1234567890abcdef \ + --peer-network-cidrs-to-be-removed "10.0.1.0/24,10.0.3.0/24" + @@ -80 +129 @@ To update a route table, use the AWS CLI `ec2 create-route` command. The followi -The ODB network route tables are automatically updated with the VPC CIDRs. To allow access to the ODB network for only specific subnet CIDRs rather than all CIDRs in the VPC, update the ODB network by adding or removing peered CIDR ranges. For more information, see [Updating an ODB network in Oracle Database@AWS](./managing.html#managing.updating). +The ODB network route tables are automatically updated with the VPC CIDRs. To allow access to the ODB network for only specific subnet CIDRs rather than all CIDRs in the VPC, you can specify peer network CIDRs when creating an ODB peering connection or update an existing ODB peering connection to add or remove peered CIDR ranges. For more information, see Creating an ODB peering connection in Oracle Database@AWS and Updating an ODB peering connection.