AWS dms documentation change
Summary
Expanded documentation for AWS DMS service-linked role to include DMS Schema Conversion usage for accessing Amazon S3 resources and added trigger for role creation during migration project setup.
Security assessment
The change documents how the service-linked role is used by DMS Schema Conversion to access S3 resources, which is a security-related feature (IAM permissions). However, there's no evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/dms/latest/userguide/slr-services-sl.md b/dms/latest/userguide/slr-services-sl.md index 44e859725..8e97d67a1 100644 --- a//dms/latest/userguide/slr-services-sl.md +++ b//dms/latest/userguide/slr-services-sl.md @@ -11 +11 @@ Creating a service-linked role for AWS DMSEditing a service-linked role for AWS -AWS DMS uses the service-linked role named **AWSServiceRoleForDMSServerless**. AWS DMS uses this service-linked role to create and manage AWS DMS resources on your behalf. AWS DMS uses this role for automatic instance management so that you only have to manage replications. +AWS DMS uses the service-linked role named **AWSServiceRoleForDMSServerless**. AWS DMS uses this service-linked role to create and manage AWS DMS resources on your behalf. AWS DMS uses this role for automatic instance management so that you only have to manage replications. DMS Schema Conversion also uses this role to access designated Amazon S3 resources on your behalf. @@ -24 +24 @@ You must configure permissions to allow an IAM entity, such as a user, group, or -When you start a replication task, or start a premigration assessment, AWS DMS programmatically creates a AWS DMS service linked role. You can view this role in the IAM console. You can also choose to create this role manually. To create the role manually, use the IAM console to create a service-linked role with the **DMS** use case. In the AWS CLI or the AWS API, create a service-linked role using `dms.amazonaws.com` for the service name. For more information, see [ Creating a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role) in the _IAM User Guide_. If you delete this service-linked role, you can use this same process to create the role again. +AWS DMS programmatically creates a AWS DMS service-linked role when you start a replication task, start a premigration assessment, or create a migration project with a virtual data provider within DMS Schema Conversion. You can view this role in the IAM console. You can also choose to create this role manually. To create the role manually, use the IAM console to create a service-linked role with the **DMS** use case. In the AWS CLI or the AWS API, create a service-linked role using `dms.amazonaws.com` for the service name. For more information, see [ Creating a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role) in the _IAM User Guide_. If you delete this service-linked role, you can use this same process to create the role again.