AWS AmazonRDS documentation change

Service: AmazonRDS · 2026-03-13 · Documentation low

File: AmazonRDS/latest/UserGuide/TDE.Disabling.md

Summary

Added a step to drop a user TDE certificate if it was restored (imported) as part of the procedure to turn off TDE for an RDS for SQL Server DB instance.

Security assessment

This change clarifies a procedural step for disabling Transparent Data Encryption (TDE), a security feature. It ensures the process is complete by removing user-managed certificates, which is a security best practice. However, it does not indicate a response to a specific security vulnerability or incident.

Diff

diff --git a/AmazonRDS/latest/UserGuide/TDE.Disabling.md b/AmazonRDS/latest/UserGuide/TDE.Disabling.md
index 00f6151d4..9b0775b14 100644
--- a//AmazonRDS/latest/UserGuide/TDE.Disabling.md
+++ b//AmazonRDS/latest/UserGuide/TDE.Disabling.md
@@ -7 +7 @@
-To turn off TDE for an RDS for SQL Server DB instance, first make sure that there are no encrypted objects left on the DB instance. To do so, either decrypt the objects or drop them. If any encrypted objects exist on the DB instance, you can't turn off TDE for the DB instance. When you use the console to remove the TDE option from an option group, the console indicates that it's processing. In addition, an error event is created if the option group is associated with an encrypted DB instance or DB snapshot.
+To turn off TDE for an RDS for SQL Server DB instance, first make sure that there are no encrypted objects left on the DB instance. To do so, either decrypt the objects or drop them. If any encrypted objects exist on the DB instance, you can't turn off TDE for the DB instance. If a user TDE certificate for encryption was restored (imported), then it should be dropped. When you use the console to remove the TDE option from an option group, the console indicates that it's processing. In addition, an error event is created if the option group is associated with an encrypted DB instance or DB snapshot.
@@ -29,0 +30,3 @@ The following example removes the TDE encryption from a database called `custome
+    -- Drop a user TDE certificate if it was restored (imported)
+    EXECUTE msdb.dbo.rds_drop_tde_certificate @certificate_name='UserTDECertificate_certificate_name';
+