AWS athena documentation change
Summary
Added encryption recommendations section promoting SSE-KMS, updated encryption type table with recommendations, added migration guide link, and made minor wording improvements
Security assessment
Changes focus on recommending SSE-KMS encryption best practices and comparing encryption methods, but there is no evidence of addressing a specific security vulnerability. The updates enhance documentation about existing security features rather than patching issues.
Diff
diff --git a/athena/latest/ug/encryption.md index df237e590..9448b781c 100644 --- a/athena/latest/ug/encryption.md +++ b/athena/latest/ug/encryption.md @@ -30,0 +31 @@ However, if you use Athena to insert data into a table that has encrypted data, + * [Migrate from CSE-KMS to SSE-KMS](./migrating-csekms-ssekms.html) @@ -43,5 +44 @@ Encryption type | Description | Cross-Region support -[SSE-KMS](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html) | Server-side encryption (SSE) with a AWS Key Management Service customer managed key. - -###### Note - -With this encryption type, Athena does not require you to indicate that data is encrypted when you create a table. | Yes +[SSE-KMS](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html) (Recommended) | Server-side encryption (SSE) with an AWS Key Management Service customer managed key. | Yes @@ -51,0 +49,22 @@ For more information about AWS KMS encryption with Amazon S3, see [What is AWS K +### Encryption recommendations + +When you encrypt and decrypt table data and query results with customer-managed KMS keys, we recommend that you use SSE-KMS encryption over SSE-S3 or CSE-KMS encryption methods. SSE-KMS provides a balance of control, simplicity, and performance that makes it a recommended method when you use managed KMS keys for data encryption. + +**Benefits of SSE-KMS over SSE-S3** + + * SSE-KMS allows you to specify and manage your own keys, providing greater control. You can define key policies, oversee key life cycles, and monitor key usage. + + + + +**Benefits of SSE-KMS over CSE-KMS** + + * SSE-KMS eliminates the need for additional infrastructure to encrypt and decrypt data, unlike CSE-KMS which requires ongoing maintenance of an S3 encryption client. + + * CSE-KMS might face compatibility issues between newer and older S3 encryption clients due to evolving encryption algorithms, a problem SSE-KMS avoids. + + * SSE-KMS makes fewer API calls to the KMS service for key retrieval during the encryption and decryption processes, resulting in better performance compared to CSE-KMS. + + + + @@ -54 +73 @@ For more information about AWS KMS encryption with Amazon S3, see [What is AWS K -The following encryption options are not supported: +The following encryption options aren't supported: @@ -78 +97 @@ For client-side encryption, note that two tools are available: -These tools are not compatible, and data encrypted using one tool cannot be decrypted by the other. Athena only supports the Amazon S3 Encryption Client directly. If you use the SDK to encrypt your data, you can run queries from Athena, but the data is returned as encrypted text. +These tools aren't compatible, and data encrypted using one tool cannot be decrypted by the other. Athena only supports the Amazon S3 Encryption Client directly. If you use the SDK to encrypt your data, you can run queries from Athena, but the data is returned as encrypted text. @@ -84 +103 @@ If you want to use Athena to query data that has been encrypted with the AWS Enc -Depending on the type of encryption you use in Amazon S3, you may need to add permissions, also known as "Allow" actions, to your policies used in Athena: +Depending on the type of encryption you use in Amazon S3, you might need to add permissions, also known as "Allow" actions, to your policies used in Athena: @@ -94 +113 @@ Advanced key policy administrators can adjust key policies. `kms:Decrypt` is the -When using Athena to query datasets in Amazon S3 with a large number of objects that are encrypted with AWS KMS, AWS KMS may throttle query results. This is more likely when there are a large number of small objects. Athena backs off retry requests, but a throttling error might still occur. If you are working with a large number of encrypted objects and experience this issue, one option is to enable Amazon S3 bucket keys to reduce the number of calls to KMS. For more information, see [Reducing the cost of SSE-KMS with Amazon S3 Bucket keys](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html) in the _Amazon Simple Storage Service User Guide_. Another option is to increase your service quotas for AWS KMS. For more information, see [Quotas](https://docs.aws.amazon.com/kms/latest/developerguide/limits.html#requests-per-second) in the _AWS Key Management Service Developer Guide_. +When using Athena to query datasets in Amazon S3 with a large number of objects that are encrypted with AWS KMS, AWS KMS might throttle query results. This is more likely when there are a large number of small objects. Athena backs off retry requests, but a throttling error might still occur. If you are working with a large number of encrypted objects and experience this issue, one option is to enable Amazon S3 bucket keys to reduce the number of calls to KMS. For more information, see [Reducing the cost of SSE-KMS with Amazon S3 Bucket keys](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html) in the _Amazon Simple Storage Service User Guide_. Another option is to increase your service quotas for AWS KMS. For more information, see [Quotas](https://docs.aws.amazon.com/kms/latest/developerguide/limits.html#requests-per-second) in the _AWS Key Management Service Developer Guide_. @@ -113 +132 @@ Data protection -Encrypt Athena query results stored in Amazon S3 +Migrate from CSE-KMS to SSE-KMS