AWS dms documentation change
Summary
Added 8 new premigration assessment checks including: validating existence of selected source objects, target generated columns, materialized views, REPLICA IDENTITY FULL conflicts, secondary constraints, CHAR/VARCHAR compatibility for Oracle, idle_in_transaction_session_timeout setting, and DMS user roles for AWS-managed PostgreSQL.
Security assessment
The change adds documentation for security best practices including validating the idle_in_transaction_session_timeout setting (prevents resource exhaustion attacks) and verifying proper DMS user roles (access control). However, there's no evidence of addressing a specific security vulnerability. These are proactive security validations.
Diff
diff --git a/dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md b/dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md index 4dfaf8f84..3859b8d6b 100644 --- a//dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md +++ b//dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md @@ -5 +5 @@ -Validate if DDL event trigger is set to ENABLE ALWAYSValidate if PostGIS columns exist in the source databaseValidate if foreign key constraint is disabled on the target tables during the full-load processValidate if tables with similar names existValidate if there are tables with ARRAY data type without a primary keyValidate if primary keys or unique indexes exist on the target tables when BatchApplyEnabled is enabledValidate if any table of the target database has secondary indexes for the full-load migration taskValidate that limited LOB mode only is used when BatchApplyEnabled is set to trueValidate if source database version is supported by DMS for migrationValidate the logical_decoding_work_mem parameter on the source databaseValidate whether the source database has any long running transactionsValidate the source database parameter max_slot_wal_keep_sizeCheck if the source database parameter postgres-check-maxwalsenders is set to support CDC.Check if the source database is configured for PGLOGICALValidate if the source table primary key is of LOB DatatypeValidate if the source table has a primary keyValidate if prepared transactions are present on the source databaseValidate if wal_sender_timeout is set to a minimum required value to support DMS CDCValidate if wal_level is set to logical on the source databaseValidate if both Primary Key and Unique index exist on target for Batch ApplyRecommend Max LOB setting when LOB objects are foundValidate if table has primary key or unique index and its state is well when DMS validation is enabledValidate if AWS DMS user has necessary privileges to the targetValidates availability of free replication slots for CDCVerify DMS User Full Load PermissionsCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing maskVerify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneously +Validate if DDL event trigger is set to ENABLE ALWAYSValidate if PostGIS columns exist in the source databaseValidate if foreign key constraint is disabled on the target tables during the full-load processValidate if tables with similar names existValidate if there are tables with ARRAY data type without a primary keyValidate if primary keys or unique indexes exist on the target tables when BatchApplyEnabled is enabledValidate if any table of the target database has secondary indexes for the full-load migration taskValidate that limited LOB mode only is used when BatchApplyEnabled is set to trueValidate if source database version is supported by DMS for migrationValidate the logical_decoding_work_mem parameter on the source databaseValidate whether the source database has any long running transactionsValidate the source database parameter max_slot_wal_keep_sizeCheck if the source database parameter postgres-check-maxwalsenders is set to support CDC.Check if the source database is configured for PGLOGICALValidate if the source table primary key is of LOB DatatypeValidate if the source table has a primary keyValidate if prepared transactions are present on the source databaseValidate if wal_sender_timeout is set to a minimum required value to support DMS CDCValidate if wal_level is set to logical on the source databaseValidate if both Primary Key and Unique index exist on target for Batch ApplyRecommend Max LOB setting when LOB objects are foundValidate if table has primary key or unique index and its state is well when DMS validation is enabledValidate if AWS DMS user has necessary privileges to the targetValidates availability of free replication slots for CDCVerify DMS User Full Load PermissionsCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing maskVerify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneouslyValidate that at least one selected object exists in the source databaseValidate that target PostgreSQL database contains generated columnsValidate that materialized views exist in homogeneous PostgreSQL migrationsValidate that REPLICA IDENTITY FULL conflicts with pglogical plugin usageValidate that secondary constraints and indexes (non-primary) are present in the source databaseValidate CHAR/VARCHAR columns compatibility for migration to OracleValidate that idle_in_transaction_session_timeout setting is configured on the source databaseValidate that AWS DMS user has required roles for AWS-managed PostgreSQL databases @@ -74,0 +75,16 @@ This section describes individual premigration assessments for migration tasks t + * Validate that at least one selected object exists in the source database + + * Validate that target PostgreSQL database contains generated columns + + * Validate that materialized views exist in homogeneous PostgreSQL migrations + + * Validate that REPLICA IDENTITY FULL conflicts with pglogical plugin usage + + * Validate that secondary constraints and indexes (non-primary) are present in the source database + + * Validate CHAR/VARCHAR columns compatibility for migration to Oracle + + * Validate that idle_in_transaction_session_timeout setting is configured on the source database + + * Validate that AWS DMS user has required roles for AWS-managed PostgreSQL databases + @@ -290,0 +307,52 @@ This premigration assessment verifies that Data Validation setting and Data Mask +## Validate that at least one selected object exists in the source database + +**API key** : `all-check-source-selection-rules` + +This premigration assessment verifies that at least one object specified in the selection rules exists in the source database, including pattern matching for wildcard-based rules. + +## Validate that target PostgreSQL database contains generated columns + +**API key** : `postgres-check-target-generated-cols` + +This premigration assessment validates whether the target PostgreSQL database contains any generated columns (including both STORED and VIRTUAL types) that may require special handling during migration. Generated columns, which compute their values from other columns, need specific verification to ensure compatibility with the target PostgreSQL version and proper data consistency after migration. + +## Validate that materialized views exist in homogeneous PostgreSQL migrations + +**API key** : `postgres-check-materialized-views` + +When migrating between PostgreSQL databases, AWS DMS cannot migrate materialized views. Materialized views must be manually created on your target database after migration. + +For more information, see [Limitations on using a PostgreSQL database as a DMS source](./CHAP_Source.PostgreSQL.html#CHAP_Source.PostgreSQL.Limitations). + +## Validate that REPLICA IDENTITY FULL conflicts with pglogical plugin usage + +**API key** : `postgres-check-pglogical-replica-identity-full` + +This premigration assessment detects tables using REPLICA IDENTITY FULL. While REPLICA IDENTITY FULL is supported using the test_decoding plugin, using it with pglogical will prevent updates from being replicated correctly. Either change the REPLICA IDENTITY setting to DEFAULT/INDEX, or switch to a test_decoding plugin to maintain REPLICA IDENTITY FULL + +For more information, see [Enabling change data capture (CDC) using logical replication](./CHAP_Source.PostgreSQL.html#CHAP_Source.PostgreSQL.Security). + +## Validate that secondary constraints and indexes (non-primary) are present in the source database + +**API key** : `all-check-secondary-constraints` + +This premigration assessment verifies that secondary constraints and indexes (foreign keys, check constraints, non-clustered indexes) are present in the source database. + +## Validate CHAR/VARCHAR columns compatibility for migration to Oracle + +**API key** : `postgres-to-oracle-check-varchar-columns` + +This premigration assessment verifies that NCHAR/NVARCHAR2 data type columns used in the target database are compatible with CHAR/VARCHAR columns in the source database. + +## Validate that `idle_in_transaction_session_timeout` setting is configured on the source database + +**API key** : `postgres-check-idle-in-transaction-session-timeout` + +This premigration assessment verifies that the `idle_in_transaction_session_timeout` parameter is not set to 0 on the source database. + +## Validate that AWS DMS user has required roles for AWS-managed PostgreSQL databases + +**API key** : `postgres-check-rds-roles` + +This premigration assessment verifies that the AWS DMS user has been configured with all required roles for AWS-managed PostgreSQL databases. Insufficient roles can cause migration task failures. +