AWS redshift high security documentation change
Summary
Updated driver version to 2.2.0.0 and added package verification steps using OpenSSL signatures
Security assessment
The addition of cryptographic package verification (certificate.pem + signature.bin) directly addresses supply chain security risks by preventing installation of tampered drivers. This is concrete evidence of security improvement.
Diff
diff --git a/redshift/latest/mgmt/odbc20-install-linux.md b/redshift/latest/mgmt/odbc20-install-linux.md index c9588f322..b5d8b2ad0 100644 --- a//redshift/latest/mgmt/odbc20-install-linux.md +++ b//redshift/latest/mgmt/odbc20-install-linux.md @@ -15 +15 @@ To download and install the Amazon Redshift ODBC driver version 2.x for Linux: - * [x86 64-bit RPM driver version 2.1.17.0](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.1.17.0/AmazonRedshiftODBC-64-bit-2.1.17.0.x86_64.rpm) + * [x86 64-bit RPM driver version 2.2.0.0](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.x86_64.rpm) @@ -17 +17,21 @@ To download and install the Amazon Redshift ODBC driver version 2.x for Linux: - * [ARM 64-bit RPM driver version 2.1.17.0](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.1.17.0/AmazonRedshiftODBC-64-bit-2.1.17.0.aarch64.rpm) + * Linux artifact signature key: [Key](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.x86_64-certificate.pem) + + * Linux artifact signed hash: [Hash](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.x86_64-signature.bin) + + * [ARM 64-bit RPM driver version 2.2.0.0](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.aarch64.rpm) + + * Linux artifact signature key: [Key](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.aarch64-certificate.pem) + + * Linux artifact signed hash: [Hash](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.aarch64-signature.bin) + + * [x86 64-bit DEB driver version 2.2.0.0](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.amd64.deb) + + * Linux artifact signature key: [Key](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.amd64-certificate.pem) + + * Linux artifact signed hash: [Hash](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.amd64-signature.bin) + + * [ARM 64-bit DEB driver version 2.2.0.0](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.arm64.deb) + + * Linux artifact signature key: [Key](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.arm64-certificate.pem) + + * Linux artifact signed hash: [Hash](https://s3.amazonaws.com/redshift-downloads/drivers/odbc/2.2.0.0/AmazonRedshiftODBC-64-bit-2.2.0.0.arm64-signature.bin) @@ -23 +43 @@ To download and install the Amazon Redshift ODBC driver version 2.x for Linux: - 2. Go to the location where you downloaded the package, and then run one of the following commands. Use the command that corresponds to your Linux distribution. + 2. Before installing, verify that AWS signed the driver package. After downloading the package, its signature key (certificate), and its signed hash (detached signature), run the following commands: @@ -25 +45,4 @@ To download and install the Amazon Redshift ODBC driver version 2.x for Linux: -On RHEL and CentOS operating systems, run the following command: + openssl x509 -in SignatureKeyFile -pubkey -noout > redshift-odbc-pubkey.pem + openssl dgst -sha256 -verify redshift-odbc-pubkey.pem \ + -signature SignedHashFile \ + PackageFile @@ -27 +50,14 @@ On RHEL and CentOS operating systems, run the following command: - yum --nogpgcheck localinstall RPMFileName +If the package is authentic, `openssl` prints `Verified OK`. If the output is anything else, do not install the package. Re-download the files or contact AWS Support. + +For example, to verify the x86 64-bit RPM: + + openssl x509 -in AmazonRedshiftODBC-64-bit-2.2.0.0.x86_64-certificate.pem -pubkey -noout > redshift-odbc-pubkey.pem + openssl dgst -sha256 -verify redshift-odbc-pubkey.pem \ + -signature AmazonRedshiftODBC-64-bit-2.2.0.0.x86_64-signature.bin \ + AmazonRedshiftODBC-64-bit-2.2.0.0.x86_64.rpm + + 3. Go to the location where you downloaded the package, and then run one of the following commands. Use the command that corresponds to your Linux distribution. + +On RHEL and CentOS operating systems (RPM), run the following command: + + sudo yum --nogpgcheck localinstall RPMFileName @@ -31 +67,10 @@ Replace `RPMFileName` with the RPM package file name. For example, the following - yum --nogpgcheck localinstall AmazonRedshiftODBC-64-bit-2.x.xx.xxxx.x86_64.rpm + sudo yum --nogpgcheck localinstall AmazonRedshiftODBC-64-bit-2.x.xx.xxxx.x86_64.rpm + + +On Debian and Ubuntu operating systems (DEB), navigate to the directory containing the downloaded .deb file and run the following command: + + sudo apt install ./DEBFileName + +Replace `DEBFileName` with the DEB package file name. For example: + + sudo apt install ./AmazonRedshiftODBC-64-bit-2.x.xx.xxxx.amd64.deb