AWS AmazonRDS documentation change
Summary
Added important note clarifying that Amazon RDS for Oracle DB instances don't require restart during server certificate rotation despite the SupportsCertificateRotationWithoutRestart flag being FALSE, and provided guidance for manual rotation.
Security assessment
This change provides clarification about SSL/TLS certificate rotation behavior for Oracle DB instances, which is a security feature. It documents operational details and provides guidance for manual certificate rotation but doesn't indicate a specific security vulnerability.
Diff
diff --git a/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.md b/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.md index 08818864e..02051d5a1 100644 --- a//AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.md +++ b//AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.md @@ -237,0 +238,4 @@ Use the [ describe-db-engine-versions](https://docs.aws.amazon.com/cli/latest/re +###### Important + +For Amazon RDS for Oracle DB instances, you will see the `SupportsCertificateRotationWithoutRestart` flag of the DB engine versions marked as `FALSE`. However, Amazon RDS for Oracle DB instances do NOT require restart, but the database listener is restarted during the server certificate rotation. Existing database connections are unaffected, but new connections will encounter errors for a brief period while the listener is restarted. If you want to manually rotate the server certificate, use the [ apply-pending-maintenance-action](https://docs.aws.amazon.com/cli/latest/reference/rds/apply-pending-maintenance-action.html) AWS CLI command. +