AWS cli: RDS read replica: add DB capacity reservation and clarify KMS encryption
Summary
Adds the --db-capacity-reservation-identifier parameter and its constraints, and updates the KmsKeyId description to state that a read replica in the same Region can now be encrypted with a different KMS key than the source, or inherits the source key if unspecified.
Security assessment
The change documents encryption key behavior for read replicas (KMS key selection), which is security-relevant guidance but does not fix a specific vulnerability or incident. The capacity reservation parameter is operational, not security.
Evidence
> For a read replica in the same Amazon Web Services Region as the source DB instance or Multi-AZ DB cluster, specifying this parameter is optional. If you specify a KMS key identifier, the read replica is encrypted with that KMS key, which can be different from the KMS key of the source.
Diff
diff --git a/cli/latest/reference/rds/create-db-instance-read-replica.md b/cli/latest/reference/rds/create-db-instance-read-replica.md index 3d9bde8..c3dd8c1 100644 --- a//cli/latest/reference/rds/create-db-instance-read-replica.md +++ b//cli/latest/reference/rds/create-db-instance-read-replica.md @@ -15 +15 @@ - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) » @@ -124,0 +125 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rds-20 + [--db-capacity-reservation-identifier <value>] @@ -377 +378,3 @@ Syntax: -> If you create an encrypted read replica in the same Amazon Web Services Region as the source DB instance or Multi-AZ DB cluster, don’t specify a value for this parameter. A read replica in the same Amazon Web Services Region is always encrypted with the same KMS key as the source DB instance or cluster. +> For a read replica in the same Amazon Web Services Region as the source DB instance or Multi-AZ DB cluster, specifying this parameter is optional. If you specify a KMS key identifier, the read replica is encrypted with that KMS key, which can be different from the KMS key of the source. +> +> If you don’t specify a value for this parameter, the read replica is encrypted with the same KMS key as the source DB instance or Multi-AZ DB cluster. @@ -877,0 +881,27 @@ JSON Syntax: +`--db-capacity-reservation-identifier` (string) + +> The identifier or the name of the DB capacity reservation to associate with this read replica. You can specify the identifier, which has the prefix `dbcr-` , or the reservation name. When you specify this parameter, the read replica uses reserved capacity from the specified reservation. A read replica uses one unit of reserved capacity, in the same way as any other DB instance. +> +> If you specify `AvailabilityZone` , Amazon RDS places the DB instance in that Availability Zone, and the reservation must cover it. +> +> Constraints: +> +> * The reservation must reserve capacity for the DB instance class and the database engine of the DB instance. +> * If the reservation reserves capacity for a specific license model, the license model of the source DB instance must match it. A read replica inherits its license model from the source DB instance. +> * The reservation must be in the `active` state, and it must not be past its end date. +> * If you specify `AvailabilityZone` , it must be one of the Availability Zones of the reservation. +> * For a Multi-AZ DB instance, the reservation must cover two or more Availability Zones. A Multi-AZ DB instance uses one unit of reserved capacity in each of two Availability Zones. If the reservation covers more than two Availability Zones, Amazon RDS chooses the two that the DB instance uses. +> * The reservation must have available capacity in each Availability Zone that the DB instance uses. +> * The DB subnet group must be in a VPC with default tenancy. +> * The DB subnet group must cover each Availability Zone that the DB instance uses. +> + +> +> Constraints: +> +> * min: `1` +> * max: `63` +> * pattern: `[a-z](?:-?[a-z0-9]+){0,15}` +> + + @@ -1468,0 +1499,12 @@ DBInstance -> (structure) +>> +>> DBCapacityReservationIdentifier -> (string) +>> +>>> The identifier of the DB capacity reservation that the DB instance uses after a pending modification completes. Amazon RDS returns this value when a `ModifyDBInstance` request changes the DB capacity reservation, and the change hasn’t been applied yet. +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `63` +>>> * pattern: `[a-z](?:-?[a-z0-9]+){0,15}` +>>> + @@ -2145,0 +2188,12 @@ DBInstance -> (structure) +> +> DBCapacityReservationIdentifier -> (string) +> +>> The identifier of the DB capacity reservation associated with this DB instance. Amazon RDS doesn’t return this value if the DB instance doesn’t use a DB capacity reservation. +>> +>> Constraints: +>> +>> * min: `1` +>> * max: `63` +>> * pattern: `[a-z](?:-?[a-z0-9]+){0,15}` +>> + @@ -2157 +2211 @@ DBInstance -> (structure) - * [AWS CLI 2.38.2 Command Reference](../../index.html) » + * [AWS CLI 2.38.3 Command Reference](../../index.html) »