AWS dms documentation change
Summary
Added three new premigration assessment checks: validating target endpoint is not a read replica, verifying source Aurora PostgreSQL read replica version, and verifying source PostgreSQL read replica version.
Security assessment
The changes add new validation checks for AWS Database Migration Service (DMS) premigration assessments. These checks are focused on ensuring proper configuration and compatibility for migration tasks (e.g., preventing writes to read replicas, verifying CDC support on read replicas). There is no evidence in the diff of addressing a specific security vulnerability, incident, or weakness. The changes are operational and compatibility-related, not security-focused.
Diff
diff --git a/dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md b/dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md index 3859b8d6b..1952fb52c 100644 --- a//dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md +++ b//dms/latest/userguide/CHAP_Tasks.AssessmentReport.PG.md @@ -5 +5 @@ -Validate if DDL event trigger is set to ENABLE ALWAYSValidate if PostGIS columns exist in the source databaseValidate if foreign key constraint is disabled on the target tables during the full-load processValidate if tables with similar names existValidate if there are tables with ARRAY data type without a primary keyValidate if primary keys or unique indexes exist on the target tables when BatchApplyEnabled is enabledValidate if any table of the target database has secondary indexes for the full-load migration taskValidate that limited LOB mode only is used when BatchApplyEnabled is set to trueValidate if source database version is supported by DMS for migrationValidate the logical_decoding_work_mem parameter on the source databaseValidate whether the source database has any long running transactionsValidate the source database parameter max_slot_wal_keep_sizeCheck if the source database parameter postgres-check-maxwalsenders is set to support CDC.Check if the source database is configured for PGLOGICALValidate if the source table primary key is of LOB DatatypeValidate if the source table has a primary keyValidate if prepared transactions are present on the source databaseValidate if wal_sender_timeout is set to a minimum required value to support DMS CDCValidate if wal_level is set to logical on the source databaseValidate if both Primary Key and Unique index exist on target for Batch ApplyRecommend Max LOB setting when LOB objects are foundValidate if table has primary key or unique index and its state is well when DMS validation is enabledValidate if AWS DMS user has necessary privileges to the targetValidates availability of free replication slots for CDCVerify DMS User Full Load PermissionsCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing maskVerify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneouslyValidate that at least one selected object exists in the source databaseValidate that target PostgreSQL database contains generated columnsValidate that materialized views exist in homogeneous PostgreSQL migrationsValidate that REPLICA IDENTITY FULL conflicts with pglogical plugin usageValidate that secondary constraints and indexes (non-primary) are present in the source databaseValidate CHAR/VARCHAR columns compatibility for migration to OracleValidate that idle_in_transaction_session_timeout setting is configured on the source databaseValidate that AWS DMS user has required roles for AWS-managed PostgreSQL databases +Validate if DDL event trigger is set to ENABLE ALWAYSValidate if PostGIS columns exist in the source databaseValidate if foreign key constraint is disabled on the target tables during the full-load processValidate if tables with similar names existValidate if there are tables with ARRAY data type without a primary keyValidate if primary keys or unique indexes exist on the target tables when BatchApplyEnabled is enabledValidate if any table of the target database has secondary indexes for the full-load migration taskValidate that limited LOB mode only is used when BatchApplyEnabled is set to trueValidate if source database version is supported by DMS for migrationValidate the logical_decoding_work_mem parameter on the source databaseValidate whether the source database has any long running transactionsValidate the source database parameter max_slot_wal_keep_sizeCheck if the source database parameter postgres-check-maxwalsenders is set to support CDC.Check if the source database is configured for PGLOGICALValidate if the source table primary key is of LOB DatatypeValidate if the source table has a primary keyValidate if prepared transactions are present on the source databaseValidate if wal_sender_timeout is set to a minimum required value to support DMS CDCValidate if wal_level is set to logical on the source databaseValidate if both Primary Key and Unique index exist on target for Batch ApplyRecommend Max LOB setting when LOB objects are foundValidate if table has primary key or unique index and its state is well when DMS validation is enabledValidate if AWS DMS user has necessary privileges to the targetValidates availability of free replication slots for CDCVerify DMS User Full Load PermissionsCheck Transformation Rule for Digits RandomizeCheck Transformation Rule for Digits maskCheck Transformation Rule for Hashing maskVerify that Data Validation task settings and Data Masking Digit randomization are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Hashing mask are not enabled simultaneouslyVerify that Data Validation task settings and Data Masking Digit mask are not enabled simultaneouslyValidate that at least one selected object exists in the source databaseValidate that target PostgreSQL database contains generated columnsValidate that materialized views exist in homogeneous PostgreSQL migrationsValidate that REPLICA IDENTITY FULL conflicts with pglogical plugin usageValidate that secondary constraints and indexes (non-primary) are present in the source databaseValidate CHAR/VARCHAR columns compatibility for migration to OracleValidate that idle_in_transaction_session_timeout setting is configured on the source databaseValidate that AWS DMS user has required roles for AWS-managed PostgreSQL databasesValidate that the target endpoint is not a read replicaVerify source Aurora PostgreSQL read replica versionVerify source PostgreSQL read replica version @@ -90,0 +91,6 @@ This section describes individual premigration assessments for migration tasks t + * Validate that the target endpoint is not a read replica + + * Verify source Aurora PostgreSQL read replica version + + * Verify source PostgreSQL read replica version + @@ -358,0 +365,22 @@ This premigration assessment verifies that the AWS DMS user has been configured +## Validate that the target endpoint is not a read replica + +**API key** : `all-check-target-read-replica` + +This premigration assessment verifies that the target endpoint is not configured as a read replica. AWS DMS requires write access to the target database and cannot replicate to read-only replicas. + +## Verify source Aurora PostgreSQL read replica version + +**API key** : `postgres-aurora-check-source-replica-role-cdc` + +This premigration assessment verifies that the source endpoint uses an Aurora PostgreSQL read replica running version 16 or later. CDC operations require replication slots, which Aurora PostgreSQL does not support on read-only nodes in versions earlier than 16. + +For more information, see [Read replica as a source for PostgreSQL](./CHAP_Source.PostgreSQL.html#CHAP_Source.PostgreSQL.ReadReplica). + +## Verify source PostgreSQL read replica version + +**API key** : `postgres-check-source-replica-role-cdc` + +This premigration assessment verifies that the source endpoint uses a PostgreSQL read replica running version 16 or later. CDC operations require replication slots, which PostgreSQL does not support on read-only nodes in versions earlier than 16. + +For more information, see [Read replica as a source for PostgreSQL](./CHAP_Source.PostgreSQL.html#CHAP_Source.PostgreSQL.ReadReplica). +