AWS lake-formation documentation change
Summary
Expanded hybrid access mode documentation to include Data Catalog objects (including catalogs) instead of just databases/tables, and updated terminology consistency
Security assessment
Changes update terminology to include catalogs as part of managed resources but do not address security vulnerabilities or introduce new security features. Focus is on documentation accuracy and scope clarification.
Diff
diff --git a/lake-formation/latest/dg/hybrid-access-mode.md index b655a8b1e..2713b8170 100644 --- a/lake-formation/latest/dg/hybrid-access-mode.md +++ b/lake-formation/latest/dg/hybrid-access-mode.md @@ -9 +9 @@ Common hybrid access mode use cases -AWS Lake Formation _hybrid access mode_ supports two permission pathways to the same AWS Glue Data Catalog databases, tables, and views. In the first pathway, Lake Formation allows you to select specific principals, and grant them Lake Formation permissions to access databases and tables by opting in. The second pathway allows all other principals to access these resources through the default IAM principal policies for Amazon S3 and AWS Glue actions. +AWS Lake Formation _hybrid access mode_ supports two permission pathways to the same AWS Glue Data Catalog objects. In the first pathway, Lake Formation allows you to select specific principals, and grant them Lake Formation permissions to access catalogs, databases, tables, and views by opting in. The second pathway allows all other principals to access these resources through the default IAM principal policies for Amazon S3 and AWS Glue actions. @@ -11 +11 @@ AWS Lake Formation _hybrid access mode_ supports two permission pathways to the -When registering an Amazon S3 location with Lake Formation, you have the option to either enforce Lake Formation permissions for all resources at this location or use hybrid access mode. The hybrid access mode enforces only `CREATE_TABLE`, `CREATE_PARTITION`, `UPDATE_TABLE` permissions by default. When an Amazon S3 location is in the hybrid mode, you can enable Lake Formation permissions by opting in principals for databases and tables under that location. +When registering an Amazon S3 location with Lake Formation, you have the option to either enforce Lake Formation permissions for all resources at this location or use hybrid access mode. The hybrid access mode enforces only `CREATE_TABLE`, `CREATE_PARTITION`, `UPDATE_TABLE` permissions by default. When an Amazon S3 location is in the hybrid mode, you can enable Lake Formation permissions by opting in principals for the Data Catalog objects under that location. @@ -46 +46 @@ You can use hybrid access mode to provide access in single account and cross-acc - * **Convert an AWS Glue resource to a hybrid resource** – In this scenario, you are not currently using Lake Formation but want to adopt Lake Formation permissions for Data Catalog databases and tables. When you register the Amazon S3 location in hybrid access mode, you can grant Lake Formation permissions to users who opt in specific databases and tables pointing to that location. + * **Convert an AWS Glue resource to a hybrid resource** – In this scenario, you are not currently using Lake Formation but want to adopt Lake Formation permissions for Data Catalog objects. When you register the Amazon S3 location in hybrid access mode, you can grant Lake Formation permissions to users who opt in specific databases and tables pointing to that location.