AWS AmazonRDS medium security documentation change

Service: AmazonRDS · 2026-02-25 · Security-related medium

File: AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Enabling.md

Summary

Added new example IAM policy for directory buckets using access points, including security note about network origin configuration and VPC traffic routing.

Security assessment

Explicitly addresses security configuration by requiring 'Internet' network origin for access points while clarifying traffic remains within private VPCs. Prevents misconfiguration that could block RDS-S3 connectivity.

Diff

diff --git a/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Enabling.md b/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Enabling.md
index 52cdcc100..bb0c922f7 100644
--- a//AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Enabling.md
+++ b//AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Enabling.md
@@ -224,0 +225,32 @@ JSON
+###### Example permissions policy for native backup and restore using access points for directory buckets without encryption support
+
+Directory buckets use a different, [session-based authorization mechanism](https://docs.aws.amazon.com//AmazonS3/latest/userguide/s3-express-authenticating-authorizing.html) than general purpose buckets, so the only required permission for native backup restore is the bucket-level “s3express:CreateSession” permission. To configure object-level access, you must use [access points for directory buckets](https://docs.aws.amazon.com//AmazonS3/latest/userguide/access-points-directory-buckets-policies.html).
+
+###### Note
+
+Access points must be configured to use **Network origin: Internet** as RDS does not publish private VPCs. S3 traffic from RDS instances does not go through the public internet since it goes through private VPCs.
+
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",		 	 	 
+        "Statement":
+        [
+            {
+            "Effect": "Allow",
+            "Action": "s3express:CreateSession",
+            "Resource": 
+                [
+                    "arn:aws:s3express:us-east-1:111122223333:accesspoint/amzn-s3-demo-accesspoint--use1-az6--xa-s3",
+                    "arn:aws:s3express:us-east-1:111122223333:bucket/amzn-s3-demo-bucket--use1-az6--x-s3"
+                ]
+            }
+        ]
+    }
+    
+