AWS AmazonRDS high security documentation change
Summary
Updated Aurora PostgreSQL 18 release notes from preview to production-ready version 18.3, added new security features, fixed multiple CVEs, and updated extension versions.
Security assessment
The change documents fixes for 15 PostgreSQL community CVEs (CVE-2026-2003 through CVE-2026-6638) and adds new security features including TLS v1.3 cipher configuration via ssl_tls13_ciphers and updated default cipher lists for FIPS compliance. These changes directly address security vulnerabilities and enhance cryptographic protections.
Diff
diff --git a/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.md b/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.md index 04fb42217..c216eb2a6 100644 --- a//AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.md +++ b//AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.md @@ -7 +7 @@ -PostgreSQL 18.1PostgreSQL 17 versionsPostgreSQL 16 versionsPostgreSQL 15 versions (includes some deprecated versions)PostgreSQL 14 versions (includes some deprecated versions)PostgreSQL 13 versions (includes some deprecated versions)PostgreSQL 12 versions (includes some deprecated versions)PostgreSQL 11 versions (includes some deprecated versions)PostgreSQL 10 versions (Deprecated)PostgreSQL 9.6 versions (Deprecated) +PostgreSQL 18 versionsPostgreSQL 17 versionsPostgreSQL 16 versionsPostgreSQL 15 versions (includes some deprecated versions)PostgreSQL 14 versions (includes some deprecated versions)PostgreSQL 13 versions (includes some deprecated versions)PostgreSQL 12 versions (includes some deprecated versions)PostgreSQL 11 versions (includes some deprecated versions)PostgreSQL 10 versions (Deprecated)PostgreSQL 9.6 versions (Deprecated) @@ -17 +17 @@ To determine the version number of your Aurora PostgreSQL database, see [Identif -For information about extensions and modules, see [Extension versions for Amazon Aurora PostgreSQL](./AuroraPostgreSQL.Extensions.html). +For information about extensions and modules, see [Extensions supported for Amazon Aurora PostgreSQL](./AuroraPostgreSQL.Extensions.html). @@ -30 +30 @@ For a list of AWS Regions, see [ Aurora PostgreSQL Region availability](https:// - * PostgreSQL 18.1 + * PostgreSQL 18 versions @@ -53 +53 @@ For a list of AWS Regions, see [ Aurora PostgreSQL Region availability](https:// -## PostgreSQL 18.1 +## PostgreSQL 18 versions @@ -55,9 +55 @@ For a list of AWS Regions, see [ Aurora PostgreSQL Region availability](https:// -The PostgreSQL community releases new Major versions of PostgreSQL annually. The Amazon RDS Database Preview Environment allows you to test beta, release candidate, and early production versions of Amazon Aurora releases. This allows customers to create DB Clusters on an early release of Aurora PostgreSQL 18 in the Preview environment and test its features. - -The following limitations apply to Aurora PostgreSQL Clusters in the Preview environment: - - 1. All DB instances/clusters are deleted 60 days after you create them, along with any backups and snapshots. - - 2. You can't copy a snapshot of a DB instance from Preview to a production environment. - - 3. The following options are supported by the Preview. +###### Version updates @@ -65 +57 @@ The following limitations apply to Aurora PostgreSQL Clusters in the Preview env - 1. You can create DB instances using r6g, r6i, r7g, r7i, r8g, x2g, t3 and t4g instance types only. For more information about RDS Aurora instance classes, see DB instance classes. + * PostgreSQL 18.3 @@ -67 +58,0 @@ The following limitations apply to Aurora PostgreSQL Clusters in the Preview env - 2. You can use both single-AZ and multi-AZ deployments. @@ -69 +59,0 @@ The following limitations apply to Aurora PostgreSQL Clusters in the Preview env - 3. You can use standard PostgreSQL dump and load functions to export databases from or import databases to the Database Preview Environment. @@ -71,0 +62 @@ The following limitations apply to Aurora PostgreSQL Clusters in the Preview env +### PostgreSQL 18.3 @@ -72,0 +64 @@ The following limitations apply to Aurora PostgreSQL Clusters in the Preview env +This release of Aurora PostgreSQL is compatible with PostgreSQL 18.3. For more information about the improvements in PostgreSQL 18.3, see [PostgreSQL release 18.3](https://www.postgresql.org/docs/18/release-18-3.html). @@ -74 +66 @@ The following limitations apply to Aurora PostgreSQL Clusters in the Preview env -Some of the Features that are not supported for APG18.1 Preview: +###### Releases and patches @@ -76 +68 @@ Some of the Features that are not supported for APG18.1 Preview: - 1. Serverless v1/v2 + * Aurora PostgreSQL 18.3 @@ -78 +69,0 @@ Some of the Features that are not supported for APG18.1 Preview: - 2. Major Version Upgrades i.e. MVU @@ -80 +70,0 @@ Some of the Features that are not supported for APG18.1 Preview: - 3. No new minors will be released in preview region i.e. APG17.1 will not be released in preview region @@ -82 +71,0 @@ Some of the Features that are not supported for APG18.1 Preview: - 4. RDS PostgreSQL to Aurora PostgreSQL Inbound replication @@ -84 +73 @@ Some of the Features that are not supported for APG18.1 Preview: - 5. Amazon RDS Blue/Green deployment +#### Aurora PostgreSQL 18.3 @@ -86 +75 @@ Some of the Features that are not supported for APG18.1 Preview: - 6. Cross-Region snapshot copy +**New features** @@ -88 +77 @@ Some of the Features that are not supported for APG18.1 Preview: - 7. Global DB + * The `ssl_tls13_ciphers` parameter is now available for configuring TLS v1.3 ciphers. @@ -90 +79 @@ Some of the Features that are not supported for APG18.1 Preview: - 8. Database Activity Streams (DAS), RDS Proxy and Data Migration Service (DMS) + * PostgreSQL 18 introduces the `ssl_groups` parameter (formerly `ssl_ecdh_curve` in previous major versions) for configuring TLS key exchange curves. @@ -92 +81 @@ Some of the Features that are not supported for APG18.1 Preview: - 9. Auto Scaling Read Replicas + * Default and allowed cipher lists have been updated to improve security posture and FIPS compliance. @@ -94 +83 @@ Some of the Features that are not supported for APG18.1 Preview: - 10. 11. RDS Export + * Note that `io_method`, `io_workers` and `io_max_concurrency` are community AIO GUCs and are not available in Aurora PostgreSQL. Aurora PostgreSQL uses its own async I/O implementation. @@ -96 +85 @@ Some of the Features that are not supported for APG18.1 Preview: - 12. Performance Insights + * Added support for Eager aggregation, which pushes aggregation before joins to improve query performance. Controlled by GUCs `enable_eager_aggregate` (default: OFF) and `min_eager_agg_group_size` to set the minimum average group size required to consider applying Eager aggregation (default: 8). @@ -98 +86,0 @@ Some of the Features that are not supported for APG18.1 Preview: - 13. Custom Endpoints @@ -100 +87,0 @@ Some of the Features that are not supported for APG18.1 Preview: - 14. Snapshot Copy @@ -102 +88,0 @@ Some of the Features that are not supported for APG18.1 Preview: - 15. zero-ETL @@ -104 +90 @@ Some of the Features that are not supported for APG18.1 Preview: - 16. Babelfish +**Critical stability enhancements** @@ -106 +92 @@ Some of the Features that are not supported for APG18.1 Preview: - 17. PostGis Topology module is not supported because of a community regression: [https://trac.osgeo.org/postgis/ticket/5983](https://trac.osgeo.org/postgis/ticket/5983) + * Fixed an issue which can lead to an unnecessary storage checkpoint during database startup leading to prolonged database startup time. @@ -107,0 +94 @@ Some of the Features that are not supported for APG18.1 Preview: + * Fixed a race condition that could prevents failovers from completing to intended failover target. @@ -111 +97,0 @@ Some of the Features that are not supported for APG18.1 Preview: -### Creating a new DB Cluster in the preview environment @@ -113 +99 @@ Some of the Features that are not supported for APG18.1 Preview: -Use the following procedure to create a DB Cluster in the preview environment. +**High priority enhancements** @@ -115 +101 @@ Use the following procedure to create a DB Cluster in the preview environment. -###### To create a DB Cluster in the preview environment + * Back-ported fixes for the following PostgreSQL community security issues: @@ -117 +103 @@ Use the following procedure to create a DB Cluster in the preview environment. - 1. Sign in to the AWS Management Console and open the Amazon RDS console at [https://console.aws.amazon.com/rds/](https://console.aws.amazon.com/rds/). + * [CVE-2026-2003](https://www.postgresql.org/support/security/CVE-2026-2003/) @@ -119 +105 @@ Use the following procedure to create a DB Cluster in the preview environment. - 2. Choose Dashboard from the navigation pane. + * [CVE-2026-2004](https://www.postgresql.org/support/security/CVE-2026-2004/) @@ -121 +107 @@ Use the following procedure to create a DB Cluster in the preview environment. - 3. In the Dashboard page, locate the Database Preview Environment section on the Dashboard page, as shown in the following image. + * [CVE-2026-2005](https://www.postgresql.org/support/security/CVE-2026-2005/) @@ -123 +109 @@ Use the following procedure to create a DB Cluster in the preview environment. - 4. You can navigate directly to the Database preview environment. Before you can proceed, you must acknowledge and accept the limitations. + * [CVE-2026-2006](https://www.postgresql.org/support/security/CVE-2026-2006/) @@ -125 +111 @@ Use the following procedure to create a DB Cluster in the preview environment. - 5. To create the Aurora PostgreSQL DB instance, follow the same process as that for creating any Amazon Aurora PostgreSQL DB Cluster. For more information, see the Console procedure in Creating an Amazon Aurora PostgreSQL DB cluster. + * [CVE-2026-2007](https://www.postgresql.org/support/security/CVE-2026-2007/) @@ -127 +113 @@ Use the following procedure to create a DB Cluster in the preview environment. - 6. To create an Cluster in the Database Preview Environment using the RDS API or the AWS CLI, use the following endpoint. + * [CVE-2026-6472](https://www.postgresql.org/support/security/CVE-2026-6472/) @@ -129 +115 @@ Use the following procedure to create a DB Cluster in the preview environment. -`rds-preview.us-east-2.amazonaws.com` + * [CVE-2026-6473](https://www.postgresql.org/support/security/CVE-2026-6473/) @@ -130,0 +117 @@ Use the following procedure to create a DB Cluster in the preview environment. + * [CVE-2026-6474](https://www.postgresql.org/support/security/CVE-2026-6474/) @@ -131,0 +119 @@ Use the following procedure to create a DB Cluster in the preview environment. + * [CVE-2026-6475](https://www.postgresql.org/support/security/CVE-2026-6475/) @@ -132,0 +121 @@ Use the following procedure to create a DB Cluster in the preview environment. + * [CVE-2026-6476](https://www.postgresql.org/support/security/CVE-2026-6476/) @@ -134 +123 @@ Use the following procedure to create a DB Cluster in the preview environment. -###### Releases and patches + * [CVE-2026-6477](https://www.postgresql.org/support/security/CVE-2026-6477/) @@ -136 +125 @@ Use the following procedure to create a DB Cluster in the preview environment. - * Aurora PostgreSQL 18.1 in the Amazon RDS Preview environment + * [CVE-2026-6478](https://www.postgresql.org/support/security/CVE-2026-6478/) @@ -137,0 +127 @@ Use the following procedure to create a DB Cluster in the preview environment. + * [CVE-2026-6479](https://www.postgresql.org/support/security/CVE-2026-6479/) @@ -138,0 +129 @@ Use the following procedure to create a DB Cluster in the preview environment. + * [CVE-2026-6575](https://www.postgresql.org/support/security/CVE-2026-6575/) @@ -139,0 +131 @@ Use the following procedure to create a DB Cluster in the preview environment. + * [CVE-2026-6637](https://www.postgresql.org/support/security/CVE-2026-6637/) @@ -141 +133 @@ Use the following procedure to create a DB Cluster in the preview environment. -### Aurora PostgreSQL 18.1 in the Amazon RDS Preview environment + * [CVE-2026-6638](https://www.postgresql.org/support/security/CVE-2026-6638/) @@ -143 +135 @@ Use the following procedure to create a DB Cluster in the preview environment. -_**This is preview documentation for Amazon Aurora PostgreSQL version 18.1. It is subject to change.**_ + * Fixed an issue in cache initialization that could cause a crash during database startup. @@ -145 +137 @@ _**This is preview documentation for Amazon Aurora PostgreSQL version 18.1. It i -This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more information about the improvements in PostgreSQL 18.1, see [PostgreSQL release 18.0](https://www.postgresql.org/docs/18/release-18.html) and [PostgreSQL release 18.1](https://www.postgresql.org/docs/18/release-18-1.html). + * Fixed an issue in global databases planned switchover that would cause the switchover to be stuck waiting for a volume growth. @@ -147 +139 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i -###### Parameter updates + * Added the following new extensions: @@ -149 +141 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * `track_cost_delay_timing` default is set to on + * pg_roaringbitmap version 1.1.0 @@ -151 +143 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * `max_active_replication_origins` default is set to 20 + * Updated the following extensions: @@ -153 +145 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * `client_connection_check_interval` default is set to 60000 + * aws_s3 to version 2.0. @@ -155 +147 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * `log_connections` was updated to reflect the new PostgreSQL 18 behavior. The old default value of 0 is equivalent to the new default empty value, and the old value of 1 is equivalent to specifying all three values of receipt, authentication, and authorization + * aws_lambda to version 2.1. @@ -157 +149 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * `autovacuum_worker_slots`, `io_workers`, `io_max_concurrency` + * pg_bigm to version 1.2_20250903. @@ -158,0 +151 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i + * pg_hint_plan to version 1.8.0. @@ -159,0 +153 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i + * tds_fdw to version 2.0.5. @@ -160,0 +155 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i + * mysql_fdw to version REL-2_9_3. @@ -162 +157 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i -###### Extension updates + * pg_cron to version 1.6.7. @@ -164 +159 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Added new extension pg_roaringbitmap version 0.5.5 + * orafce to version 4.16.3. @@ -166 +161 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Updated h3-pg to version 4.2.3 + * hypopg to version 1.4.2. @@ -168 +163 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Updated PostGIS to version 3.6.0 + * pglogical to version 2.4.6. @@ -170 +165 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Updated pg_hint_plan to version 1.8.0 + * pgvector to version 0.8.1. @@ -172 +167 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Updated pg_cron to version 1.6.7 + * pgrouting to version 3.8.0. @@ -174 +169 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Updated hypopg to version 1.4.2 + * pg_repack to version 1.5.3. @@ -176 +171 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Updated MySQL FDW to version REL-2_9_3 + * oracle_fdw to version 2.8.0. @@ -178 +173 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Updated pglogical to version 2.4.6 + * h3-pg to version 4.2.3. @@ -180 +175 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Updated pgvector to version 0.8.1 + * PLv8 to version 3.2.4. @@ -182 +177 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Updated PLv8 to version 3.2.4 + * pg_tle to version 1.5.2. @@ -184 +179 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.1. For more i - * Updated TDS FDW to version 2.0.5