AWS AmazonRDS medium security documentation change
Summary
Expanded native backup/restore parameters to support directory buckets, added encryption behavior clarification, usage examples, and ARN formatting requirements.
Security assessment
Documents mandatory encryption enforcement for directory buckets ('@enable_bucket_default_encryption' is always on), which is a security feature. Also adds security-relevant ARN formatting requirements to prevent operational failures.
Diff
diff --git a/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md b/AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md index f6e72faf0..f344bce78 100644 --- a//AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md +++ b//AmazonRDS/latest/UserGuide/SQLServer.Procedural.Importing.Native.Using.md @@ -65 +65 @@ The following parameters are required: - * `@s3_arn_to_backup_to` – The ARN indicating the Amazon S3 bucket or access point to use for the backup, plus the name of the backup file. + * `@s3_arn_to_backup_to` – The ARN indicating the Amazon S3 bucket, access point, directory bucket, or access point for directory bucket to use for the backup, plus the name of the backup file. @@ -133 +133 @@ For example, if the file names in the S3 ARN are `backup*.bak` and you set `@num - * `@enable_bucket_default_encryption` – A value that indicates whether to use the S3 buckets default encryption configuration for server-side encryption in S3. + * `@enable_bucket_default_encryption` – A value that indicates whether to use the S3 bucket's default encryption configuration for server-side encryption in S3. Directory buckets always use the bucket's default encryption configuration regardless of this setting. @@ -244,0 +245,9 @@ This example generates a backup file named `backup*.bak`. +###### Example of full backup using an access point for a directory bucket + + + exec msdb.dbo.rds_backup_database + @source_db_name='mydatabase', + @s3_arn_to_backup_to='arn:aws:s3express:us-east-1:123456789012:accesspoint/my-access-point--use1-az6--xa-s3/object/backup1.bak', + @overwrite_s3_backup_file=1, + @type='FULL'; + @@ -270,0 +280,2 @@ The following parameters are required: + * If using a directory bucket, the ARN must end with `/*` due to [differences for directory buckets](https://docs.aws.amazon.com//AmazonS3/latest/userguide/s3-express-differences.html). +