AWS AmazonRDS documentation change
Summary
Added new parameters and updated existing parameters for Aurora MySQL 8.4, including password policies, authentication policy, memory management, and validate_password component settings. Enhanced documentation for version-specific behaviors.
Security assessment
The changes add documentation for security features like password policies (password_history, password_reuse_interval), authentication_policy, and validate_password component parameters. These improve security posture but aren't linked to a specific vulnerability. No evidence of patching a security flaw exists.
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Reference.ParameterGroups.md b/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Reference.ParameterGroups.md index aed6baad8..d8b93bd1e 100644 --- a//AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Reference.ParameterGroups.md +++ b//AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Reference.ParameterGroups.md @@ -48,0 +49 @@ Parameter name | Modifiable | Notes +`aurora_enable_memory_management` | Yes | Available in Aurora MySQL version 8.4 and higher. When set to `ON` (the default), Aurora automatically manages memory recovery actions and the `aurora_oom_response` parameter is ignored. When set to `OFF`, Aurora uses the `aurora_oom_response` parameter to determine which recovery actions to take. For more information, see [Troubleshooting out-of-memory issues for Aurora MySQL databases](./AuroraMySQLOOM.html). @@ -52,0 +54 @@ Parameter name | Modifiable | Notes +`aurora_enable_validate_password_component` | Yes | This parameter is available in Aurora MySQL version 8.4.7 and higher. The default value is `0` (`false`). When set to `1` (or `true`), Aurora enables the `validate_password` component. When set to `0` (or `false`), Aurora disables the component. The component is managed through this parameter instead of the `INSTALL COMPONENT` and `UNINSTALL COMPONENT` commands. For more information, see [Using the validate_password component](./AuroraMySQL.PasswordPolicies.html#AuroraMySQL.PasswordPolicies.validate-password). @@ -62,0 +65 @@ Parameter name | Modifiable | Notes +`authentication_policy` | Yes | This parameter is available in Aurora MySQL version 8.4.7 and higher. Supported values are `*:caching_sha2_password` (default) and `*:mysql_native_password`. For more information, see [Authentication policy (new in 8.4)](./AuroraMySQL.Upgrade-v3-v84-security.html#AuroraMySQL.Upgrade-v3-v84-security.auth-policy). @@ -82 +85 @@ Parameter name | Modifiable | Notes -`binlog_transaction_dependency_tracking` | Yes | This parameter applies to Aurora MySQL version 3. +`binlog_transaction_dependency_tracking` | Yes | This parameter only applies to Aurora MySQL version 3. In Aurora MySQL version 8.4.7, the server uses the WRITESET behavior by default. @@ -154,0 +158,3 @@ For more information, see [Column Operations](https://dev.mysql.com/doc/refman/8 +`password_history` | Yes | Available in Aurora MySQL version 8.4 and higher. +`password_require_current` | Yes | Available in Aurora MySQL version 8.4 and higher. +`password_reuse_interval` | Yes | Available in Aurora MySQL version 8.4 and higher. @@ -198,0 +205,7 @@ In Aurora MySQL version 3, this parameter doesn't apply for users who have the ` +`validate_password.check_user_name` | Yes | Available in Aurora MySQL version 8.4 and higher. +`validate_password.dictionary_file` | No | This parameter is not supported in Aurora MySQL version 8.4. The parameter is visible in the parameter group but cannot be modified. +`validate_password.length` | Yes | Available in Aurora MySQL version 8.4 and higher. +`validate_password.mixed_case_count` | Yes | Available in Aurora MySQL version 8.4 and higher. +`validate_password.number_count` | Yes | Available in Aurora MySQL version 8.4 and higher. +`validate_password.policy` | Yes | Available in Aurora MySQL version 8.4.7 and higher. Only LOW and MEDIUM levels are supported by Aurora MySQL. +`validate_password.special_char_count` | Yes | Available in Aurora MySQL version 8.4 and higher. @@ -210 +223 @@ Parameter name | Modifiable | Notes -`aurora_oom_response` | Yes | This parameter is supported for Aurora MySQL versions 2 and 3. For more information, see [Troubleshooting out-of-memory issues for Aurora MySQL databases](./AuroraMySQLOOM.html). +`aurora_oom_response` | Yes | This parameter is supported for Aurora MySQL versions 2 and 3. Also available in Aurora MySQL 8.4 but only considered when `aurora_enable_memory_management` is set to `OFF`. For more information, see [Troubleshooting out-of-memory issues for Aurora MySQL databases](./AuroraMySQLOOM.html). @@ -231,0 +245 @@ Parameter name | Modifiable | Notes +`default_password_lifetime` | Yes | Available in Aurora MySQL version 8.4 and higher. @@ -235,0 +250 @@ Parameter name | Modifiable | Notes +`disconnect_on_expired_password` | Yes | Available in Aurora MySQL version 8.4 and higher. @@ -302 +317 @@ In Aurora MySQL version 3, this parameter doesn't apply for users who have the ` -`innodb_read_io_threads` | No | None +`innodb_read_io_threads` | No | Aurora MySQL manages the value of this parameter automatically based on the DB instance class. The value scales with the number of vCPUs on the instance. @@ -508 +523 @@ Reader instances are always read only, because Aurora MySQL sets `innodb_read_on -`temptable_max_mmap` | Yes | This parameter applies to Aurora MySQL version 3. For details, see [New temporary table behavior in Aurora MySQL version 3](./ams3-temptable-behavior.html). +`temptable_max_mmap` | Yes | This parameter applies to Aurora MySQL version 3. For details, see [New temporary table behavior in Aurora MySQL version 3](./ams3-temptable-behavior.html). In Aurora MySQL version 8.4.7 and higher, the default value is calculated as `LEAST(4294967296, {AllocatedStorage*3/100})`. This formula sets the default to 3% of allocated storage, capped at a maximum of 4 GiB, and replaces the fixed 1 GiB default used in Aurora MySQL version 3. @@ -522,7 +537,7 @@ Reader instances are always read only, because Aurora MySQL sets `innodb_read_on -`validate-password` | No | None -`validate_password_dictionary_file` | No | None -`validate_password_length` | No | None -`validate_password_mixed_case_count` | No | None -`validate_password_number_count` | No | None -`validate_password_policy` | No | None -`validate_password_special_char_count` | No | None +`validate-password` | No | Removed from Aurora MySQL version 8.4. +`validate_password_dictionary_file` | No | Removed from Aurora MySQL version 8.4. +`validate_password_length` | No | Removed from Aurora MySQL version 8.4. +`validate_password_mixed_case_count` | No | Removed from Aurora MySQL version 8.4. +`validate_password_number_count` | No | Removed from Aurora MySQL version 8.4. +`validate_password_policy` | No | Removed from Aurora MySQL version 8.4. +`validate_password_special_char_count` | No | Removed from Aurora MySQL version 8.4.