AWS sql-server-ec2 medium security documentation change
Summary
Added validation for Source Database Name, clarified IAM role usage, and added detailed instructions for identifying and cleaning unused EBS volumes after database restoration.
Security assessment
The change explicitly addresses security risks by adding cleanup procedures for unused EBS volumes which could contain sensitive data. The added volume mapping metadata check prevents accidental exposure of unattached volumes containing database artifacts.
Diff
diff --git a/sql-server-ec2/latest/userguide/ms-ssdb-ec2-vss-restore-from-snap.md b/sql-server-ec2/latest/userguide/ms-ssdb-ec2-vss-restore-from-snap.md index 4e41dd37a..8eb62422b 100644 --- a//sql-server-ec2/latest/userguide/ms-ssdb-ec2-vss-restore-from-snap.md +++ b//sql-server-ec2/latest/userguide/ms-ssdb-ec2-vss-restore-from-snap.md @@ -17 +17 @@ The `AWSEC2-RestoreSqlServerDatabaseWithVss` process consists of several key ste - 2. The next step invokes `AWSEC2-PrepareVssRestore` to verify that prerequisites are met and that the input parameters include a valid value for the VSS Snapshot Set ID. + 2. The next step invokes `AWSEC2-PrepareVssRestore` to verify that prerequisites are met and that the input parameters include a valid value for the VSS Snapshot Set ID and Source Database Name. @@ -81,8 +81 @@ The fully qualified path to the directory where the VSS metadata files are store -The ARN of the IAM role for the automation to assume. - - * _Console:_ If this parameter is not specified, the restore process uses the IAM role for the current console session. - - * _Command line:_ If this parameter is not specified, the restore process uses the IAM role for your current session. - - - +The ARN of the IAM role that the automation assumes during execution. If not specified, the automation uses the IAM role that initiated the execution. For example, when starting the automation from the AWS Console without specifying this parameter, the automation uses your current console session's IAM role to interact with Amazon EC2 and SSM. @@ -169 +162,5 @@ To get the status of the automation execution and the status of each action step - 3. ###### Clean up unused EBS volumes after the automation execution succeeds + 3. ###### (Optional) Clean up unused EBS volumes after the automation execution succeeds + +When volume mapping metadata is used, the `AWSEC2-RestoreSqlServerDatabaseWithVss` automation creates new EBS volumes only from volume snapshots that contain files of the database to be restored. However, when this metadata is not used, the automation creates a new EBS volume for each volume snapshot within the VSS snapshot set and attaches them to the target instance. + +To determine if volume mapping metadata was used for your database restore operation, check the automation execution steps. In the automation execution details, examine the `PrepareForVolumeCreation` step output. If `ExecutionLog` in the `OutputPayload` says `No volume mapping found - using all snapshots`, volume mapping metadata was not used during the restore operation. @@ -171 +168 @@ To get the status of the automation execution and the status of each action step -The `AWSEC2-RestoreSqlServerDatabaseWithVss` automation creates a new EBS volume for each volume snapshot within a VSS snapshot set. These volumes are then attached to the target instance. The database files may not be located on all volumes, so you can detach and delete the unused ones. +If volume mapping metadata was not used for your restore operation, follow these steps to identify and clean up volumes that don't contain restored database files: