AWS dms high security documentation change
Summary
Clarified S3 bucket ownership validation logic and cross-account requirements for ExpectedBucketOwner setting
Security assessment
Explicitly addresses spoofing prevention through bucket ownership validation. Documents critical cross-account security requirement (failure without proper config). Evidence: Direct security terms ('prevent spoofing', ownership validation) and failure scenario for cross-account access.
Diff
diff --git a/dms/latest/userguide/CHAP_Target.S3.md b/dms/latest/userguide/CHAP_Target.S3.md index 364abe71e..6f2b29592 100644 --- a//dms/latest/userguide/CHAP_Target.S3.md +++ b//dms/latest/userguide/CHAP_Target.S3.md @@ -28 +28 @@ You can specify the column delimiter, row delimiter, and other parameters using -You can specify a bucket owner and prevent sniping by using the `ExpectedBucketOwner` Amazon S3 endpoint setting, as shown following. Then, when you make a request to test a connection or perform a migration, S3 checks the account ID of the bucket owner against the specified parameter. +To prevent spoofing, AWS DMS validates bucket ownership before performing operations. By default, when the `ExpectedBucketOwner` Amazon S3 endpoint setting is not specified, AWS DMS uses the AWS account ID that owns the AWS DMS service role as the expected bucket owner. @@ -29,0 +30 @@ You can specify a bucket owner and prevent sniping by using the `ExpectedBucketO +To migrate data to an S3 bucket owned by a different AWS account, you must explicitly specify the actual bucket owner in the `ExpectedBucketOwner` Amazon S3 endpoint setting, as shown following. Otherwise, the cross-account replication task will fail. @@ -31 +32,2 @@ You can specify a bucket owner and prevent sniping by using the `ExpectedBucketO - --s3-settings='{"ExpectedBucketOwner": "_AWS_Account_ID_ "}' + + --s3-settings '{"ExpectedBucketOwner": "_AWS_Account_ID_ "}'