AWS AmazonRDS: Shared plan cache now also excludes pg_columnmask-masked queries
Summary
Updates the Aurora PostgreSQL shared plan cache limitation list so that queries depending on pg_columnmask masking, in addition to Row-Level Security, are not cached.
Security assessment
The edit specifies that plan caching is skipped for queries relying on column masking as well as RLS, which prevents cached plans from bypassing column-level data masking. This is security-relevant behavior documentation rather than evidence of a specific exploited vulnerability.
Evidence
* Doesn't cache a query that depends on RLS (Row-Level Security) or `pg_columnmask` masking
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/apg-shared-plan-cache.md b/AmazonRDS/latest/AuroraUserGuide/apg-shared-plan-cache.md index 4638e05..b7d68cc 100644 --- a//AmazonRDS/latest/AuroraUserGuide/apg-shared-plan-cache.md +++ b//AmazonRDS/latest/AuroraUserGuide/apg-shared-plan-cache.md @@ -71 +71 @@ You can modify all parameters without restarting. - * Doesn't cache a query that depends on RLS (Row-Level Security) + * Doesn't cache a query that depends on RLS (Row-Level Security) or `pg_columnmask` masking