AWS aurora-dsql high security documentation change
Summary
Added warning about root user bypassing resource-based policy restrictions
Security assessment
Change addresses a critical security consideration where root credentials bypass VPC restrictions, with specific recommendation to avoid root access
Diff
diff --git a/aurora-dsql/latest/userguide/resource-based-policies.md b/aurora-dsql/latest/userguide/resource-based-policies.md index 1657feaf0..d6953c3e0 100644 --- a//aurora-dsql/latest/userguide/resource-based-policies.md +++ b//aurora-dsql/latest/userguide/resource-based-policies.md @@ -22,0 +23,4 @@ For more information about the differences between identity-based and resource-b +###### Warning + +The AWS account root user of the account that owns the cluster always retains full access to its own resources, regardless of resource-based policy conditions, including VPC source restrictions. Resource-based policies don't restrict access for the root user. To limit root user access to your clusters, use IAM identity-based policies or avoid using root credentials for database connections. For more information, see [Root user best practices for your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html). +