AWS AmazonRDS documentation change
Summary
Updated references from 'AWS Directory Service' to 'Directory Service' throughout the document for terminology consistency
Security assessment
The changes are purely terminological updates to use the official service name 'Directory Service' instead of 'AWS Directory Service'. No security vulnerabilities, configurations, or features were added/modified. The existing security-related content about IAM roles, password storage, and Kerberos authentication remains unchanged in substance.
Diff
diff --git a/AmazonRDS/latest/UserGuide/db2-kerberos-setting-up.md b/AmazonRDS/latest/UserGuide/db2-kerberos-setting-up.md index 148bd1dc0..4d20dff6e 100644 --- a//AmazonRDS/latest/UserGuide/db2-kerberos-setting-up.md +++ b//AmazonRDS/latest/UserGuide/db2-kerberos-setting-up.md @@ -5 +5 @@ -Step 1: Create a directory using the AWS Managed Microsoft ADStep 2: Create a trustStep 3: Create an IAM role to access AWS Directory Service Step 4: Create and configure users Step 5: Create a Db2 admin group in AWS Managed Microsoft ADStep 6: Modify DB parameterStep 7: Create or modify a DB instanceStep 8: Retrieve Active Directory group SID in PowerShellStep 9: Add SID to GroupName mappings to your DB instanceStep 10: Configure a Db2 client +Step 1: Create a directory using the AWS Managed Microsoft ADStep 2: Create a trustStep 3: Create an IAM role to access Directory Service Step 4: Create and configure users Step 5: Create a Db2 admin group in AWS Managed Microsoft ADStep 6: Modify DB parameterStep 7: Create or modify a DB instanceStep 8: Retrieve Active Directory group SID in PowerShellStep 9: Add SID to GroupName mappings to your DB instanceStep 10: Configure a Db2 client @@ -17 +17 @@ You use AWS Directory Service for Microsoft Active Directory (AWS Managed Micros - * Step 3: Create an IAM role for Amazon RDS to access AWS Directory Service + * Step 3: Create an IAM role for Amazon RDS to access Directory Service @@ -38 +38 @@ You use AWS Directory Service for Microsoft Active Directory (AWS Managed Micros -AWS Directory Service creates a fully managed Active Directory in the AWS Cloud. When you create an AWS Managed Microsoft AD directory, AWS Directory Service creates two domain controllers and DNS servers for you. The directory servers are created in different subnets in a VPC. This redundancy helps ensure that your directory remains accessible even if a failure occurs. +Directory Service creates a fully managed Active Directory in the AWS Cloud. When you create an AWS Managed Microsoft AD directory, Directory Service creates two domain controllers and DNS servers for you. The directory servers are created in different subnets in a VPC. This redundancy helps ensure that your directory remains accessible even if a failure occurs. @@ -40 +40 @@ AWS Directory Service creates a fully managed Active Directory in the AWS Cloud. -When you create an AWS Managed Microsoft AD directory, AWS Directory Service performs the following tasks on your behalf: +When you create an AWS Managed Microsoft AD directory, Directory Service performs the following tasks on your behalf: @@ -48 +48 @@ When you create an AWS Managed Microsoft AD directory, AWS Directory Service per -Make sure to save this password. AWS Directory Service doesn't store this password, and it can't be retrieved or reset. +Make sure to save this password. Directory Service doesn't store this password, and it can't be retrieved or reset. @@ -69 +69 @@ The `Admin` account that was created with your AWS Managed Microsoft AD director - * Run Active Directory and Domain Name Service (DNS) modules for Windows PowerShell on the AWS Directory Service. + * Run Active Directory and Domain Name Service (DNS) modules for Windows PowerShell on the Directory Service. @@ -87 +87 @@ The `Admin` account also has rights to perform the following domain-wide activit - 1. Sign in to the AWS Management Console and open the AWS Directory Service console at [https://console.aws.amazon.com/directoryservicev2/](https://console.aws.amazon.com/directoryservicev2/). + 1. Sign in to the AWS Management Console and open the Directory Service console at [https://console.aws.amazon.com/directoryservicev2/](https://console.aws.amazon.com/directoryservicev2/). @@ -121 +121 @@ The directory administrator password can't include the word "admin." The passwor -Make sure that you save this password. AWS Directory Service doesn't store this password, and it can't be retrieved or reset. +Make sure that you save this password. Directory Service doesn't store this password, and it can't be retrieved or reset. @@ -135 +135 @@ Make sure that you save this password. AWS Directory Service doesn't store this - + @@ -144 +144 @@ To see information about your directory, choose the directory ID under **Directo - + @@ -148 +148 @@ To see information about your directory, choose the directory ID under **Directo -If you plan to use AWS Managed Microsoft AD only, skip to Step 3: Create an IAM role for Amazon RDS to access AWS Directory Service. +If you plan to use AWS Managed Microsoft AD only, skip to Step 3: Create an IAM role for Amazon RDS to access Directory Service. @@ -150 +150 @@ If you plan to use AWS Managed Microsoft AD only, skip to Step 3: Create an IAM -To enable Kerberos authentication using your self-managed Active Directory, you must create a forest trust relationship between your self-managed Active Directory and the . A forest trust is a trust relationship between a Microsoft AD and a self-managed Active Directory and the AWS Managed Microsoft AD created in the previous step. The trust can also be two-way, where both Active Directories trust each other. For more information about setting up forest trusts using AWS Directory Service, see [When to create a trust relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_setup_trust.html) in the _AWS Directory Service Administration Guide_. +To enable Kerberos authentication using your self-managed Active Directory, you must create a forest trust relationship between your self-managed Active Directory and the . A forest trust is a trust relationship between a Microsoft AD and a self-managed Active Directory and the AWS Managed Microsoft AD created in the previous step. The trust can also be two-way, where both Active Directories trust each other. For more information about setting up forest trusts using Directory Service, see [When to create a trust relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_setup_trust.html) in the _AWS Directory Service Administration Guide_. @@ -152 +152 @@ To enable Kerberos authentication using your self-managed Active Directory, you -## Step 3: Create an IAM role for Amazon RDS to access AWS Directory Service +## Step 3: Create an IAM role for Amazon RDS to access Directory Service @@ -154 +154 @@ To enable Kerberos authentication using your self-managed Active Directory, you -For Amazon RDS to call AWS Directory Service for you, your AWS account needs an IAM role that uses the managed IAM policy `AmazonRDSDirectoryServiceAccess`. This role allows Amazon RDS to make calls to AWS Directory Service. +For Amazon RDS to call Directory Service for you, your AWS account needs an IAM role that uses the managed IAM policy `AmazonRDSDirectoryServiceAccess`. This role allows Amazon RDS to make calls to Directory Service. @@ -221 +221 @@ You can create users by using the Active Directory Users and Computers tool. Thi -To create users in an AWS Directory Service directory, you must be connected to a Windows-based Amazon EC2 instance that's a member of the AWS Directory Service directory. At the same time, you must be signed in as a user that has privileges to create users. For more information, see [Create a user](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_manage_users_groups_create_user.html) in the _AWS Directory Service Administration Guide_. +To create users in an Directory Service directory, you must be connected to a Windows-based Amazon EC2 instance that's a member of the Directory Service directory. At the same time, you must be signed in as a user that has privileges to create users. For more information, see [Create a user](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_manage_users_groups_create_user.html) in the _AWS Directory Service Administration Guide_. @@ -322 +322 @@ For Windows operating systems, create a **C:\windows\krb5.ini** file. - 2. Verify that traffic can flow between the client host and AWS Directory Service. Use a network utility such as Netcat for the following tasks: + 2. Verify that traffic can flow between the client host and Directory Service. Use a network utility such as Netcat for the following tasks: @@ -326 +326 @@ For Windows operating systems, create a **C:\windows\krb5.ini** file. - 2. Verify traffic over TCP/UDP for port 53 and for Kerberos, which includes ports 88 and 464 for AWS Directory Service. + 2. Verify traffic over TCP/UDP for port 53 and for Kerberos, which includes ports 88 and 464 for Directory Service.