AWS AmazonRDS documentation change
Summary
Updated terminology from 'AWS Directory Service' to 'Directory Service' throughout the document. Changed console references and adjusted descriptions of directory management, trust relationships, IAM roles, and client configurations.
Security assessment
The changes are purely terminological updates (branding consistency) without modifying security procedures. Password handling instructions, trust relationship setups, IAM role requirements, and network verification steps remain unchanged. No vulnerabilities or security enhancements are addressed.
Diff
diff --git a/AmazonRDS/latest/UserGuide/postgresql-kerberos-setting-up.md b/AmazonRDS/latest/UserGuide/postgresql-kerberos-setting-up.md index b0bf5d375..26721f9ab 100644 --- a//AmazonRDS/latest/UserGuide/postgresql-kerberos-setting-up.md +++ b//AmazonRDS/latest/UserGuide/postgresql-kerberos-setting-up.md @@ -5 +5 @@ -Step 1: Create a directory using the AWS Managed Microsoft ADStep 2: (Optional) create a trust relationship for an on-premises Active Directory Step 3: Create an IAM role to access AWS Directory Service Step 4: Create and configure users Step 5: Enable cross-VPC traffic Step 6: Create or modify a PostgreSQL DB instance Step 7: Create PostgreSQL users for your Kerberos principals Step 8: Configure a PostgreSQL client +Step 1: Create a directory using the AWS Managed Microsoft ADStep 2: (Optional) create a trust relationship for an on-premises Active Directory Step 3: Create an IAM role to access Directory Service Step 4: Create and configure users Step 5: Enable cross-VPC traffic Step 6: Create or modify a PostgreSQL DB instance Step 7: Create PostgreSQL users for your Kerberos principals Step 8: Configure a PostgreSQL client @@ -15 +15 @@ You use AWS Directory Service for Microsoft Active Directory (AWS Managed Micros - * Step 2: (Optional) Create a trust relationship between your on-premises Active Directory and AWS Directory Service + * Step 2: (Optional) Create a trust relationship between your on-premises Active Directory and Directory Service @@ -17 +17 @@ You use AWS Directory Service for Microsoft Active Directory (AWS Managed Micros - * Step 3: Create an IAM role for Amazon RDS to access the AWS Directory Service + * Step 3: Create an IAM role for Amazon RDS to access the Directory Service @@ -34 +34 @@ You use AWS Directory Service for Microsoft Active Directory (AWS Managed Micros -AWS Directory Service creates a fully managed Active Directory in the AWS Cloud. When you create an AWS Managed Microsoft AD directory, AWS Directory Service creates two domain controllers and DNS servers for you. The directory servers are created in different subnets in a VPC. This redundancy helps make sure that your directory remains accessible even if a failure occurs. +Directory Service creates a fully managed Active Directory in the AWS Cloud. When you create an AWS Managed Microsoft AD directory, Directory Service creates two domain controllers and DNS servers for you. The directory servers are created in different subnets in a VPC. This redundancy helps make sure that your directory remains accessible even if a failure occurs. @@ -44 +44 @@ When you create an AWS Managed Microsoft AD directory, AWS Directory Service per -Make sure to save this password. AWS Directory Service doesn't store this password, and it can't be retrieved or reset. +Make sure to save this password. Directory Service doesn't store this password, and it can't be retrieved or reset. @@ -83 +83 @@ The `Admin` account also has rights to perform the following domain-wide activit - 1. In the [AWS Directory Service console](https://console.aws.amazon.com/directoryservicev2/) navigation pane, choose **Directories** , and then choose **Set up directory**. + 1. In the [Directory Service console](https://console.aws.amazon.com/directoryservicev2/) navigation pane, choose **Directories** , and then choose **Set up directory**. @@ -133 +133 @@ Retype the administrator password. -Make sure that you save this password. AWS Directory Service doesn't store this password, and it can't be retrieved or reset. +Make sure that you save this password. Directory Service doesn't store this password, and it can't be retrieved or reset. @@ -164 +164 @@ To see information about your directory, choose the directory ID in the director -## Step 2: (Optional) Create a trust relationship between your on-premises Active Directory and AWS Directory Service +## Step 2: (Optional) Create a trust relationship between your on-premises Active Directory and Directory Service @@ -166 +166 @@ To see information about your directory, choose the directory ID in the director -If you don't plan to use your own on-premises Microsoft Active Directory, skip to Step 3: Create an IAM role for Amazon RDS to access the AWS Directory Service. +If you don't plan to use your own on-premises Microsoft Active Directory, skip to Step 3: Create an IAM role for Amazon RDS to access the Directory Service. @@ -168 +168 @@ If you don't plan to use your own on-premises Microsoft Active Directory, skip t -To get Kerberos authentication using your on-premises Active Directory, you need to create a trusting domain relationship using a forest trust between your on-premises Microsoft Active Directory and the AWS Managed Microsoft AD directory (created in Step 1: Create a directory using AWS Managed Microsoft AD). The trust can be one-way, where the AWS Managed Microsoft AD directory trusts the on-premises Microsoft Active Directory. The trust can also be two-way, where both Active Directories trust each other. For more information about setting up trusts using AWS Directory Service, see [When to create a trust relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_setup_trust.html) in the _AWS Directory Service Administration Guide_. +To get Kerberos authentication using your on-premises Active Directory, you need to create a trusting domain relationship using a forest trust between your on-premises Microsoft Active Directory and the AWS Managed Microsoft AD directory (created in Step 1: Create a directory using AWS Managed Microsoft AD). The trust can be one-way, where the AWS Managed Microsoft AD directory trusts the on-premises Microsoft Active Directory. The trust can also be two-way, where both Active Directories trust each other. For more information about setting up trusts using Directory Service, see [When to create a trust relationship](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_setup_trust.html) in the _AWS Directory Service Administration Guide_. @@ -172 +172 @@ To get Kerberos authentication using your on-premises Active Directory, you need -If you use an on-premises Microsoft Active Directory, Windows clients connect using the domain name of the AWS Directory Service in the endpoint rather than rds.amazonaws.com. To learn more, see [Connecting to PostgreSQL with Kerberos authentication](./postgresql-kerberos-connecting.html). +If you use an on-premises Microsoft Active Directory, Windows clients connect using the domain name of the Directory Service in the endpoint rather than rds.amazonaws.com. To learn more, see [Connecting to PostgreSQL with Kerberos authentication](./postgresql-kerberos-connecting.html). @@ -178 +178 @@ Make sure that your on-premises Microsoft Active Directory domain name includes -## Step 3: Create an IAM role for Amazon RDS to access the AWS Directory Service +## Step 3: Create an IAM role for Amazon RDS to access the Directory Service @@ -180 +180 @@ Make sure that your on-premises Microsoft Active Directory domain name includes -For Amazon RDS to call AWS Directory Service for you, your AWS account needs an IAM role that uses the managed IAM policy `AmazonRDSDirectoryServiceAccess`. This role allows Amazon RDS to make calls to AWS Directory Service. +For Amazon RDS to call Directory Service for you, your AWS account needs an IAM role that uses the managed IAM policy `AmazonRDSDirectoryServiceAccess`. This role allows Amazon RDS to make calls to Directory Service. @@ -285 +285 @@ You can create users by using the Active Directory Users and Computers tool. Thi -To create users in an AWS Directory Service directory, you must be connected to a Windows-based Amazon EC2 instance that's a member of the AWS Directory Service directory. At the same time, you must be logged in as a user that has privileges to create users. For more information, see [Create a user](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_manage_users_groups_create_user.html) in the _AWS Directory Service Administration Guide_. +To create users in an Directory Service directory, you must be connected to a Windows-based Amazon EC2 instance that's a member of the Directory Service directory. At the same time, you must be logged in as a user that has privileges to create users. For more information, see [Create a user](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_manage_users_groups_create_user.html) in the _AWS Directory Service Administration Guide_. @@ -310 +310 @@ If a different AWS account owns the directory, you must share the directory. - 1. Start sharing the directory with the AWS account that the DB instance will be created in by following the instructions in [Tutorial: Sharing your AWS Managed Microsoft AD directory for seamless EC2 Domain-join](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_directory_sharing.html) in the _AWS Directory Service Administration Guide_. + 1. Start sharing the directory with the AWS account that the DB instance will be created in by following the instructions in [Tutorial: Sharing your AWS Managed Microsoft AD directory for seamless EC2 Domain-join](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_directory_sharing.html) in the _Directory Service Administration Guide_. @@ -312 +312 @@ If a different AWS account owns the directory, you must share the directory. - 2. Sign in to the AWS Directory Service console using the account for the DB instance, and ensure that the domain has the `SHARED` status before proceeding. + 2. Sign in to the Directory Service console using the account for the DB instance, and ensure that the domain has the `SHARED` status before proceeding. @@ -314 +314 @@ If a different AWS account owns the directory, you must share the directory. - 3. While signed into the AWS Directory Service console using the account for the DB instance, note the **Directory ID** value. You use this directory ID to join the DB instance to the domain. + 3. While signed into the Directory Service console using the account for the DB instance, note the **Directory ID** value. You use this directory ID to join the DB instance to the domain. @@ -393 +393 @@ To configure a PostgreSQL client, take the following steps: - * Verify that traffic can flow between the client host and AWS Directory Service. Use a network utility such as Netcat for the following: + * Verify that traffic can flow between the client host and Directory Service. Use a network utility such as Netcat for the following: @@ -397 +397 @@ To configure a PostgreSQL client, take the following steps: - * Verify traffic over TCP/UDP for port 53 and for Kerberos, which includes ports 88 and 464 for AWS Directory Service. + * Verify traffic over TCP/UDP for port 53 and for Kerberos, which includes ports 88 and 464 for Directory Service.