AWS AmazonRDS documentation change
Summary
Updated S3 bucket requirements to include directory buckets, restructured IAM permissions section for clarity, and added note about directory bucket limitations.
Security assessment
Changes clarify S3 bucket types and IAM permissions but contain no evidence of addressing security vulnerabilities. Modifications focus on operational documentation for backup/restore procedures without security implications.
Diff
diff --git a/AmazonRDS/latest/UserGuide/TDE.BackupRestoreRDS.md b/AmazonRDS/latest/UserGuide/TDE.BackupRestoreRDS.md index a122f9397..b0f5101fd 100644 --- a//AmazonRDS/latest/UserGuide/TDE.BackupRestoreRDS.md +++ b//AmazonRDS/latest/UserGuide/TDE.BackupRestoreRDS.md @@ -38 +38 @@ Before you can back up or restore TDE certificates on RDS for SQL Server, make s - 1. Create Amazon S3 buckets for storing files to back up and restore. + 1. Create Amazon S3 general purpose buckets or directory buckets for storing files to back up and restore. @@ -46 +46 @@ The IAM role must be both a user and an administrator for the AWS KMS key. -In addition to the permissions required for SQL Server native backup and restore, the IAM role also requires the following permissions: +When using directory buckets, no additional permissions are required other than the permissions required for [Manually creating an IAM role for native backup and restore](./SQLServer.Procedural.Importing.Native.Enabling.html#SQLServer.Procedural.Importing.Native.Enabling.IAM) with directory buckets. @@ -48 +48 @@ In addition to the permissions required for SQL Server native backup and restore - * `s3:GetBucketAcl`, `s3:GetBucketLocation`, and `s3:ListBucket` on the S3 bucket resource +When using S3 resources, the IAM role also requires the following permissions in addition to the permissions required for [Manually creating an IAM role for native backup and restore](./SQLServer.Procedural.Importing.Native.Enabling.html#SQLServer.Procedural.Importing.Native.Enabling.IAM): @@ -50 +50 @@ In addition to the permissions required for SQL Server native backup and restore - * `s3:ListAllMyBuckets` on the `*` resource + * `s3:GetBucketAcl`, `s3:GetBucketLocation`, and `s3:ListBucket` on the S3 bucket resource @@ -65,0 +66,2 @@ For more information on enabling Amazon S3 integration, see [Integrating an Amaz +Note that directory buckets are not supported for S3 integration. This step is only required for [Backing up and restoring TDE certificates for on-premises databases](./TDE.BackupRestoreOnPrem.html). +