AWS AmazonRDS documentation change
Summary
Updated IAM role parameter descriptions to include Aurora MySQL 8.4 and revised aws_default_logs_role functionality.
Security assessment
The changes clarify IAM role usage for S3/logs access which relates to security permissions, but don't address a specific vulnerability.
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.AddRoleToDBCluster.md b/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.AddRoleToDBCluster.md index 20dece809..90b0b801e 100644 --- a//AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.AddRoleToDBCluster.md +++ b//AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Authorizing.IAM.AddRoleToDBCluster.md @@ -24,4 +24,4 @@ Cluster-level parameter | Description -`aws_default_logs_role` | This parameter is no longer required for exporting log data from your DB cluster to Amazon CloudWatch Logs. Aurora MySQL now uses a service-linked role for the required permissions. For more information about service-linked roles, see [Using service-linked roles for Amazon Aurora](./UsingWithRDS.IAM.ServiceLinkedRoles.html). -`aws_default_s3_role` | Used when invoking the `LOAD DATA FROM S3`, `LOAD XML FROM S3`, or `SELECT INTO OUTFILE S3` statement from your DB cluster. In Aurora MySQL version 2, the IAM role specified in this parameter is used if an IAM role isn't specified for `aurora_load_from_s3_role` or `aurora_select_into_s3_role` for the appropriate statement. In Aurora MySQL version 3, the IAM role specified for this parameter is always used. -`aurora_load_from_s3_role` | Used when invoking the `LOAD DATA FROM S3` or `LOAD XML FROM S3` statement from your DB cluster. If an IAM role is not specified for this parameter, the IAM role specified in `aws_default_s3_role` is used. In Aurora MySQL version 3, this parameter isn't available. -`aurora_select_into_s3_role` | Used when invoking the `SELECT INTO OUTFILE S3` statement from your DB cluster. If an IAM role is not specified for this parameter, the IAM role specified in `aws_default_s3_role` is used. In Aurora MySQL version 3, this parameter isn't available. +`aws_default_logs_role` | Used when publishing log data from your DB cluster to Amazon CloudWatch Logs with the `server_audit_logs_upload` parameter. For more information about publishing log data to Amazon CloudWatch Logs, see [Publishing Amazon Aurora MySQL logs to Amazon CloudWatch Logs](./AuroraMySQL.Integrating.CloudWatch.html). +`aws_default_s3_role` | Used when invoking the `LOAD DATA FROM S3`, `LOAD XML FROM S3`, or `SELECT INTO OUTFILE S3` statement from your DB cluster. In Aurora MySQL version 2, the IAM role specified in this parameter is used if an IAM role isn't specified for `aurora_load_from_s3_role` or `aurora_select_into_s3_role` for the appropriate statement. In Aurora MySQL version 3 and version 8.4, the IAM role specified for this parameter is always used. +`aurora_load_from_s3_role` | Used when invoking the `LOAD DATA FROM S3` or `LOAD XML FROM S3` statement from your DB cluster. If an IAM role is not specified for this parameter, the IAM role specified in `aws_default_s3_role` is used. In Aurora MySQL version 3 and version 8.4, this parameter isn't available. +`aurora_select_into_s3_role` | Used when invoking the `SELECT INTO OUTFILE S3` statement from your DB cluster. If an IAM role is not specified for this parameter, the IAM role specified in `aws_default_s3_role` is used. In Aurora MySQL version 3 and version 8.4, this parameter isn't available.