AWS AmazonRDS documentation change

Service: AmazonRDS · 2026-06-22 · Documentation low

File: AmazonRDS/latest/AuroraUserGuide/aurora-mysql-kerberos-setting-up.md

Summary

Added region-specific service principal configurations for Kerberos authentication in newer AWS regions

Security assessment

The change provides updated authentication configuration details for secure Kerberos integration, ensuring proper IAM role trust policies for newer regions. This maintains secure authentication but doesn't fix a specific vulnerability.

Diff

diff --git a/AmazonRDS/latest/AuroraUserGuide/aurora-mysql-kerberos-setting-up.md b/AmazonRDS/latest/AuroraUserGuide/aurora-mysql-kerberos-setting-up.md
index d39faa9c0..24b274df2 100644
--- a//AmazonRDS/latest/AuroraUserGuide/aurora-mysql-kerberos-setting-up.md
+++ b//AmazonRDS/latest/AuroraUserGuide/aurora-mysql-kerberos-setting-up.md
@@ -240,0 +241,40 @@ JSON
+For opt-in AWS Regions, use Region-specific service principals in IAM role trust policies. When you create a trust policy for services in these Regions, specify the Region code in the service principal.
+
+The following example shows a trust policy that includes Region-specific service principals:
+    
+    
+    {
+      "Version":"2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Principal": {
+            "Service": [
+              "directoryservice.rds.REGION-CODE.amazonaws.com",
+              "rds.REGION-CODE.amazonaws.com"
+            ]
+          },
+          "Action": "sts:AssumeRole"
+        }
+      ]
+    }
+    
+
+Replace REGION-CODE with the code for your specific Region. For example, use the following service principals for the Asia Pacific (Melbourne) Region:
+    
+    
+    "Service": [
+      "directoryservice.rds.ap-southeast-4.amazonaws.com",
+      "rds.ap-southeast-4.amazonaws.com"
+    ]
+    
+
+For AWS Regions launched after Israel (Tel Aviv), starting with Canada West (Calgary), use the engine-specific service principal `directoryservice-`engine`.rds.`region-code`.amazonaws.com`, where `engine` is `aurora-mysql`. For example, for Canada West (Calgary) Region:
+    
+    
+    "Service": [
+      "directoryservice-aurora-mysql.rds.ca-west-1.amazonaws.com",
+      "rds.ca-west-1.amazonaws.com"
+    ]
+    
+