AWS Security ChangesHomeSearch

AWS AmazonRDS medium security documentation change

Service: AmazonRDS · 2025-10-25 · Security-related medium

File: AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md

Summary

Added @enable_bucket_default_encryption parameter to control S3 bucket default encryption usage, clarified SSE-S3 encryption by default, added access point support examples, and documented KEEP_CDC retention during restores

Security assessment

The change introduces explicit control over server-side encryption (SSE-S3 vs bucket default encryption) and documents encryption configuration options. This provides guidance on securing backup files in S3 through encryption settings. The KEEP_CDC parameter documentation helps maintain security auditing capabilities during restores.

Diff

diff --git a/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md b/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md
index e398b8bb5..98f7b00b6 100644
--- a//AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md
+++ b//AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md
@@ -17 +17 @@ If you also provide an optional KMS key, the format for the ARN of the key is `a
-Whether or not you use a KMS key, the native backup and restore tasks enable server-side Advanced Encryption Standard (AES) 256-bit encryption by default for files uploaded to S3.
+Whether or not you use a KMS key, the native backup and restore tasks enable server-side Advanced Encryption Standard (AES) 256-bit encryption through SSE-S3 by default for files uploaded to S3. Passing in `@enable_bucket_default_encryption=1` to the backup stored procedure uses your S3 bucket's configured default encryption key.
@@ -58 +58,2 @@ You can't back up a database during the maintenance window, or while Amazon RDS
-    	[@number_of_files=n];
+    	[@number_of_files=n],
+    	[@enable_bucket_default_encryption=0|1];
@@ -64 +65 @@ The following parameters are required:
-  * `@s3_arn_to_backup_to` – The ARN indicating the Amazon S3 bucket to use for the backup, plus the name of the backup file.
+  * `@s3_arn_to_backup_to` – The ARN indicating the Amazon S3 bucket or access point to use for the backup, plus the name of the backup file.
@@ -66 +67 @@ The following parameters are required:
-The file can have any extension, but `.bak` is usually used. 
+The file can have any extension, but `.bak` is usually used. Note that access point ARNs must be of the format `arn:aws:s3:`us-east-1`:`111122223333`:`access-point-name/object/key``.
@@ -131,0 +133,6 @@ For example, if the file names in the S3 ARN are `backup*.bak` and you set `@num
+  * `@enable_bucket_default_encryption` – A value that indicates whether to use the S3 buckets default encryption configuration for server-side encryption in S3.
+
+    * `0` – Server-side encryption uses Advanced Encryption Standard (AES) 256-bit encryption through SSE-S3.
+
+    * `1` – Server-side encryption uses your S3 bucket’s configured [default encryption](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html). 
+
@@ -146 +153 @@ For example, if the file names in the S3 ARN are `backup*.bak` and you set `@num
-###### Example of full backup with encryption
+###### Example of full backup with client-side encryption
@@ -218,0 +226,19 @@ This example generates a backup file named `backup*.bak`.
+###### Example of full backup with server-side encryption
+    
+    
+    exec msdb.dbo.rds_backup_database
+    @source_db_name='mydatabase',
+    @s3_arn_to_backup_to='arn:aws:s3:::mybucket/backup*.bak',
+    @overwrite_s3_backup_file=1,
+    @type='FULL',
+    @enable_bucket_default_encryption=1;
+
+###### Example of full backup using an access point
+    
+    
+    exec msdb.dbo.rds_backup_database
+    @source_db_name='mydatabase',
+    @s3_arn_to_backup_to='arn:aws:s3:us-east-1:111122223333:accesspoint/my-access-point/object/backup1.bak',
+    @overwrite_s3_backup_file=1,
+    @type='FULL';
+
@@ -229,0 +256 @@ To restore your database, call the `rds_restore_database` stored procedure. Amaz
+    	[@keep_cdc=0|1],
@@ -267,0 +295,2 @@ The following parameters are optional:
+  * `@keep_cdc` – Indicates whether to retain Change Data Capture (CDC) configuration on the restored database. Set to `1` to enable KEEP_CDC, `0` to disable. The default value is `0`.
+
@@ -292,0 +322,2 @@ Full restores with NORECOVERY aren't supported on Multi-AZ instances or instance
+Full restores with both NORECOVERY and KEEP_CDC aren’t supported.
+
@@ -390,0 +422,16 @@ The following three examples perform the same task, full restore with RECOVERY.
+###### Example of full database restore with RECOVERY using an access point
+    
+    
+    exec msdb.dbo.rds_restore_database
+    @restore_db_name='mydatabase',
+    @s3_arn_to_backup_to='arn:aws:s3:us-east-1:111122223333:accesspoint/my-access-point/object/backup1.bak',
+    @with_norecovery=0;
+
+###### Example of full database restore with KEEP_CDC
+    
+    
+    exec msdb.dbo.rds_restore_database
+    @restore_db_name='mydatabase',
+    @s3_arn_to_restore_from='arn:aws:s3:::mybucket/backup1.bak',
+    @keep_cdc=1;
+
@@ -402,0 +450 @@ To restore your log, call the `rds_restore_log` stored procedure.
+    	[@keep_cdc=0|1],
@@ -420,0 +469,2 @@ The following parameters are optional:
+  * `@keep_cdc` – Indicates whether to retain Change Data Capture (CDC) configuration on the restored database. Set to 1 to enable KEEP_CDC, 0 to disable. The default value is 0.
+
@@ -451,0 +502,2 @@ Log restores aren't supported on Multi-AZ instances.
+Full restores with both NORECOVERY and KEEP_CDC aren’t supported.
+
@@ -508,0 +561,8 @@ The following two examples perform the same task, log restore with NORECOVERY.
+###### Example of log restore with KEEP_CDC
+    
+    
+    exec msdb.dbo.rds_restore_database
+    @restore_db_name='mydatabase',
+    @s3_arn_to_restore_from='arn:aws:s3:::mybucket/backup1.bak',
+    @keep_cdc=1;
+