AWS cli documentation change
Summary
Added documentation for new parameters --enable-vpc-networking and --enable-internet-access-gateway to restore Aurora PostgreSQL clusters without VPC networking and with internet-based connectivity, requiring IAM database authentication.
Security assessment
This change documents a new feature that allows restoring Aurora PostgreSQL clusters without VPC networking and with internet access gateway connectivity. It explicitly requires IAM database authentication, which is a security feature. The change introduces security considerations about exposing database clusters to the internet and mandates authentication controls, but there's no evidence of addressing a specific security vulnerability.
Diff
diff --git a/cli/latest/reference/rds/restore-db-cluster-to-point-in-time.md b/cli/latest/reference/rds/restore-db-cluster-to-point-in-time.md index 20df85ff0..ecca3f8f0 100644 --- a//cli/latest/reference/rds/restore-db-cluster-to-point-in-time.md +++ b//cli/latest/reference/rds/restore-db-cluster-to-point-in-time.md @@ -15 +15 @@ - * [AWS CLI 2.34.14 Command Reference](../../index.html) » + * [AWS CLI 2.34.16 Command Reference](../../index.html) » @@ -61,0 +62,2 @@ Restores a DB cluster to an arbitrary point in time. Users can restore to any po +You can use the `EnableVPCNetworking` and `EnableInternetAccessGateway` parameters together to restore an Aurora PostgreSQL cluster without VPC networking and with internet-based connectivity. These two parameters must always be specified together. Set `EnableVPCNetworking` to `false` to disable the VPC network interface (ENI) for the cluster. `EnableInternetAccessGateway` enables internet-based connectivity through an internet access gateway. IAM database authentication is required and must be enabled using `EnableIAMDatabaseAuthentication` . Once the cluster is restored, you need to modify the DB cluster to update `MasterUserAuthenticationType` to `iam-db-auth` . + @@ -113,0 +116,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rds-20 + [--enable-vpc-networking | --no-enable-vpc-networking] + [--enable-internet-access-gateway | --no-enable-internet-access-gateway] @@ -802,0 +807,16 @@ JSON Syntax: +`--enable-vpc-networking` | `--no-enable-vpc-networking` (boolean) + +> Specifies whether to enable VPC networking for the restored DB cluster. Set this parameter to `false` to create a cluster without the VPC network interface (ENI). +> +> This parameter must be used together with `EnableInternetAccessGateway` . When both parameters are specified, IAM database authentication is required. You must also specify `EnableIAMDatabaseAuthentication` . +> +> Valid for Cluster Type: Aurora PostgreSQL clusters + +`--enable-internet-access-gateway` | `--no-enable-internet-access-gateway` (boolean) + +> Specifies that the restored DB cluster should use internet-based connectivity through an internet access gateway. This allows clients to connect to the cluster over the internet without requiring a VPC. +> +> This parameter must be used together with `EnableVPCNetworking` set to `false` . When both parameters are specified, IAM database authentication is required. You must also specify `EnableIAMDatabaseAuthentication` . +> +> Valid for Cluster Type: Aurora PostgreSQL clusters + @@ -1854,0 +1875,12 @@ DBCluster -> (structure) +> +> VPCNetworkingEnabled -> (boolean) +> +>> Indicates whether the DB cluster uses VPC-based networking. +>> +>> This setting is applicable only for Aurora PostgreSQL clusters created through express configuration. +> +> InternetAccessGatewayEnabled -> (boolean) +> +>> Indicates whether the DB cluster has internet-based connectivity enabled through an internet access gateway. +>> +>> This setting is applicable only for Aurora PostgreSQL clusters created through express configuration. @@ -1866 +1898 @@ DBCluster -> (structure) - * [AWS CLI 2.34.14 Command Reference](../../index.html) » + * [AWS CLI 2.34.16 Command Reference](../../index.html) »