AWS AmazonRDS medium security documentation change
Summary
Added @enable_bucket_default_encryption parameter to control S3 bucket default encryption usage, clarified SSE-S3 encryption by default, added access point support examples, and documented KEEP_CDC retention during restores
Security assessment
The change introduces explicit control over server-side encryption (SSE-S3 vs bucket default encryption) and documents encryption configuration options. This provides guidance on securing backup files in S3 through encryption settings. The KEEP_CDC parameter documentation helps maintain security auditing capabilities during restores.
Diff
diff --git a/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md b/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md index e398b8bb5..98f7b00b6 100644 --- a//AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md +++ b//AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md @@ -17 +17 @@ If you also provide an optional KMS key, the format for the ARN of the key is `a -Whether or not you use a KMS key, the native backup and restore tasks enable server-side Advanced Encryption Standard (AES) 256-bit encryption by default for files uploaded to S3. +Whether or not you use a KMS key, the native backup and restore tasks enable server-side Advanced Encryption Standard (AES) 256-bit encryption through SSE-S3 by default for files uploaded to S3. Passing in `@enable_bucket_default_encryption=1` to the backup stored procedure uses your S3 bucket's configured default encryption key. @@ -58 +58,2 @@ You can't back up a database during the maintenance window, or while Amazon RDS - [@number_of_files=n]; + [@number_of_files=n], + [@enable_bucket_default_encryption=0|1]; @@ -64 +65 @@ The following parameters are required: - * `@s3_arn_to_backup_to` – The ARN indicating the Amazon S3 bucket to use for the backup, plus the name of the backup file. + * `@s3_arn_to_backup_to` – The ARN indicating the Amazon S3 bucket or access point to use for the backup, plus the name of the backup file. @@ -66 +67 @@ The following parameters are required: -The file can have any extension, but `.bak` is usually used. +The file can have any extension, but `.bak` is usually used. Note that access point ARNs must be of the format `arn:aws:s3:`us-east-1`:`111122223333`:`access-point-name/object/key``. @@ -131,0 +133,6 @@ For example, if the file names in the S3 ARN are `backup*.bak` and you set `@num + * `@enable_bucket_default_encryption` – A value that indicates whether to use the S3 buckets default encryption configuration for server-side encryption in S3. + + * `0` – Server-side encryption uses Advanced Encryption Standard (AES) 256-bit encryption through SSE-S3. + + * `1` – Server-side encryption uses your S3 bucket’s configured [default encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html). + @@ -146 +153 @@ For example, if the file names in the S3 ARN are `backup*.bak` and you set `@num -###### Example of full backup with encryption +###### Example of full backup with client-side encryption @@ -218,0 +226,19 @@ This example generates a backup file named `backup*.bak`. +###### Example of full backup with server-side encryption + + + exec msdb.dbo.rds_backup_database + @source_db_name='mydatabase', + @s3_arn_to_backup_to='arn:aws:s3:::mybucket/backup*.bak', + @overwrite_s3_backup_file=1, + @type='FULL', + @enable_bucket_default_encryption=1; + +###### Example of full backup using an access point + + + exec msdb.dbo.rds_backup_database + @source_db_name='mydatabase', + @s3_arn_to_backup_to='arn:aws:s3:us-east-1:111122223333:accesspoint/my-access-point/object/backup1.bak', + @overwrite_s3_backup_file=1, + @type='FULL'; + @@ -229,0 +256 @@ To restore your database, call the `rds_restore_database` stored procedure. Amaz + [@keep_cdc=0|1], @@ -267,0 +295,2 @@ The following parameters are optional: + * `@keep_cdc` – Indicates whether to retain Change Data Capture (CDC) configuration on the restored database. Set to `1` to enable KEEP_CDC, `0` to disable. The default value is `0`. + @@ -292,0 +322,2 @@ Full restores with NORECOVERY aren't supported on Multi-AZ instances or instance +Full restores with both NORECOVERY and KEEP_CDC aren’t supported. + @@ -390,0 +422,16 @@ The following three examples perform the same task, full restore with RECOVERY. +###### Example of full database restore with RECOVERY using an access point + + + exec msdb.dbo.rds_restore_database + @restore_db_name='mydatabase', + @s3_arn_to_backup_to='arn:aws:s3:us-east-1:111122223333:accesspoint/my-access-point/object/backup1.bak', + @with_norecovery=0; + +###### Example of full database restore with KEEP_CDC + + + exec msdb.dbo.rds_restore_database + @restore_db_name='mydatabase', + @s3_arn_to_restore_from='arn:aws:s3:::mybucket/backup1.bak', + @keep_cdc=1; + @@ -402,0 +450 @@ To restore your log, call the `rds_restore_log` stored procedure. + [@keep_cdc=0|1], @@ -420,0 +469,2 @@ The following parameters are optional: + * `@keep_cdc` – Indicates whether to retain Change Data Capture (CDC) configuration on the restored database. Set to 1 to enable KEEP_CDC, 0 to disable. The default value is 0. + @@ -451,0 +502,2 @@ Log restores aren't supported on Multi-AZ instances. +Full restores with both NORECOVERY and KEEP_CDC aren’t supported. + @@ -508,0 +561,8 @@ The following two examples perform the same task, log restore with NORECOVERY. +###### Example of log restore with KEEP_CDC + + + exec msdb.dbo.rds_restore_database + @restore_db_name='mydatabase', + @s3_arn_to_restore_from='arn:aws:s3:::mybucket/backup1.bak', + @keep_cdc=1; +