AWS AmazonRDS documentation change
Summary
Added an Important note clarifying that for Amazon RDS for Oracle DB instances, the SupportsCertificateRotationWithoutRestart flag is marked as FALSE but the database does not require restart, though the listener restarts. Also added a CLI command for manual rotation.
Security assessment
The change provides clarification on the behavior of SSL certificate rotation for Oracle DB instances, which is a security feature. However, there is no indication that this change is in response to a security vulnerability or incident.
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.md b/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.md index 65754d809..59789ef71 100644 --- a//AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.md +++ b//AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL-certificate-rotation.md @@ -211,0 +212,4 @@ Use the [ describe-db-engine-versions](https://docs.aws.amazon.com/cli/latest/re +###### Important + +For Amazon RDS for Oracle DB instances, you will see the `SupportsCertificateRotationWithoutRestart` flag of the DB engine versions marked as `FALSE`. However, Amazon RDS for Oracle DB instances do NOT require restart, but the database listener is restarted during the server certificate rotation. Existing database connections are unaffected, but new connections will encounter errors for a brief period while the listener is restarted. If you want to manually rotate the server certificate, use the [ apply-pending-maintenance-action](https://docs.aws.amazon.com/cli/latest/reference/rds/apply-pending-maintenance-action.html) AWS CLI command. +