AWS AmazonRDS documentation change
Summary
Updated references from 'AWS Directory Service' to 'Directory Service' throughout the document for consistency in naming.
Security assessment
The changes are purely cosmetic, replacing the full service name with a shortened version. No security configurations, permissions, or vulnerabilities were modified. The technical content about Kerberos setup, IAM roles, security groups, and trust relationships remains unchanged. There's no evidence of addressing a security vulnerability.
Diff
diff --git a/AmazonRDS/latest/UserGuide/oracle-kerberos-setting-up.md b/AmazonRDS/latest/UserGuide/oracle-kerberos-setting-up.md index d2009d677..d259b68bb 100644 --- a//AmazonRDS/latest/UserGuide/oracle-kerberos-setting-up.md +++ b//AmazonRDS/latest/UserGuide/oracle-kerberos-setting-up.md @@ -36 +36 @@ During the setup, RDS creates an Oracle database user named `managed_service_use -AWS Directory Service creates a fully managed Active Directory in the AWS Cloud. When you create an AWS Managed Microsoft AD directory, AWS Directory Service creates two domain controllers and Domain Name System (DNS) servers on your behalf. The directory servers are created in different subnets in a VPC. This redundancy helps make sure that your directory remains accessible even if a failure occurs. +Directory Service creates a fully managed Active Directory in the AWS Cloud. When you create an AWS Managed Microsoft AD directory, Directory Service creates two domain controllers and Domain Name System (DNS) servers on your behalf. The directory servers are created in different subnets in a VPC. This redundancy helps make sure that your directory remains accessible even if a failure occurs. @@ -38 +38 @@ AWS Directory Service creates a fully managed Active Directory in the AWS Cloud. -When you create an AWS Managed Microsoft AD directory, AWS Directory Service performs the following tasks on your behalf: +When you create an AWS Managed Microsoft AD directory, Directory Service performs the following tasks on your behalf: @@ -46 +46 @@ When you create an AWS Managed Microsoft AD directory, AWS Directory Service per -Be sure to save this password. AWS Directory Service doesn't store it. You can reset it, but you can't retrieve it. +Be sure to save this password. Directory Service doesn't store it. You can reset it, but you can't retrieve it. @@ -83 +83 @@ The Admin account also has rights to perform the following domain-wide activitie -To create the directory, use the AWS Management Console, the AWS CLI, or the AWS Directory Service API. Make sure to open the relevant outbound ports on the directory security group so that the directory can communicate with the Oracle DB instance. +To create the directory, use the AWS Management Console, the AWS CLI, or the Directory Service API. Make sure to open the relevant outbound ports on the directory security group so that the directory can communicate with the Oracle DB instance. @@ -87 +87 @@ To create the directory, use the AWS Management Console, the AWS CLI, or the AWS - 1. Sign in to the AWS Management Console and open the AWS Directory Service console at [https://console.aws.amazon.com/directoryservicev2/](https://console.aws.amazon.com/directoryservicev2/). + 1. Sign in to the AWS Management Console and open the Directory Service console at [https://console.aws.amazon.com/directoryservicev2/](https://console.aws.amazon.com/directoryservicev2/). @@ -161 +161 @@ If you plan to use AWS Managed Microsoft AD only, move on to Step 3: Configure I -To enable Kerberos authentication using your self-managed Active Directory, you must create a forest trust relationship between your self-managed Active Directory and the AWS Managed Microsoft AD created in the previous step. The trust can be one-way, where the AWS Managed Microsoft AD trusts the self-managed Active Directory. The trust can also be two-way, where both Active Directories trust each other. For more information about setting up forest trusts using AWS Directory Service, see [When to create a trust relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_setup_trust.html) in the _AWS Directory Service Administration Guide_. +To enable Kerberos authentication using your self-managed Active Directory, you must create a forest trust relationship between your self-managed Active Directory and the AWS Managed Microsoft AD created in the previous step. The trust can be one-way, where the AWS Managed Microsoft AD trusts the self-managed Active Directory. The trust can also be two-way, where both Active Directories trust each other. For more information about setting up forest trusts using Directory Service, see [When to create a trust relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_setup_trust.html) in the _Directory Service Administration Guide_. @@ -165 +165 @@ To enable Kerberos authentication using your self-managed Active Directory, you -To call AWS Directory Service for you, Amazon RDS requires an IAM role that uses the managed IAM policy `AmazonRDSDirectoryServiceAccess`. This role allows Amazon RDS to make calls to the AWS Directory Service. +To call Directory Service for you, Amazon RDS requires an IAM role that uses the managed IAM policy `AmazonRDSDirectoryServiceAccess`. This role allows Amazon RDS to make calls to the Directory Service. @@ -288 +288 @@ You can create users with the Active Directory Users and Computers tool, which i -To create users in an AWS Directory Service directory, you must be connected to a Windows-based Amazon EC2 instance that is a member of the AWS Directory Service directory. At the same time, you must be logged in as a user that has privileges to create users. For more information about creating users in your Microsoft Active Directory, see [Manage users and groups in AWS Managed Microsoft AD](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_manage_users_groups.html) in the _AWS Directory Service Administration Guide_. +To create users in an Directory Service directory, you must be connected to a Windows-based Amazon EC2 instance that is a member of the Directory Service directory. At the same time, you must be logged in as a user that has privileges to create users. For more information about creating users in your Microsoft Active Directory, see [Manage users and groups in AWS Managed Microsoft AD](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_manage_users_groups.html) in the _Directory Service Administration Guide_. @@ -300 +300 @@ If you plan to locate the directory and the DB instance in different AWS account - 2. Ensure that the DB instance's security group can receive inbound traffic from the directory's security group. For more information, see [ Best practices for AWS Managed Microsoft AD](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_best_practices.html) in the _AWS Directory Service Administration Guide_. + 2. Ensure that the DB instance's security group can receive inbound traffic from the directory's security group. For more information, see [ Best practices for AWS Managed Microsoft AD](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_best_practices.html) in the _Directory Service Administration Guide_. @@ -311 +311 @@ If a different AWS account owns the directory, you must share the directory. - 1. Start sharing the directory with the AWS account that the DB instance will be created in by following the instructions in [Tutorial: Sharing your AWS Managed Microsoft AD directory for seamless EC2 Domain-join](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_directory_sharing.html) in the _AWS Directory Service Administration Guide_. + 1. Start sharing the directory with the AWS account that the DB instance will be created in by following the instructions in [Tutorial: Sharing your AWS Managed Microsoft AD directory for seamless EC2 Domain-join](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_directory_sharing.html) in the _Directory Service Administration Guide_. @@ -313 +313 @@ If a different AWS account owns the directory, you must share the directory. - 2. Sign in to the AWS Directory Service console using the account for the DB instance, and ensure that the domain has the `SHARED` status before proceeding. + 2. Sign in to the Directory Service console using the account for the DB instance, and ensure that the domain has the `SHARED` status before proceeding. @@ -315 +315 @@ If a different AWS account owns the directory, you must share the directory. - 3. While signed into the AWS Directory Service console using the account for the DB instance, note the **Directory ID** value. You use this directory ID to join the DB instance to the domain. + 3. While signed into the Directory Service console using the account for the DB instance, note the **Directory ID** value. You use this directory ID to join the DB instance to the domain. @@ -423 +423 @@ To configure an Oracle client, meet the following requirements: - * Verify that traffic can flow between the client host and AWS Directory Service over DNS port 53 over TCP/UDP, Kerberos ports (88 and 464 for managed AWS Directory Service) over TCP, and LDAP port 389 over TCP. + * Verify that traffic can flow between the client host and Directory Service over DNS port 53 over TCP/UDP, Kerberos ports (88 and 464 for managed Directory Service) over TCP, and LDAP port 389 over TCP.