AWS lake-formation documentation change
Summary
Added 'catalogs' to the list of Data Catalog resources requiring DATA_LOCATION_ACCESS permission and updated references to include catalogs in Data Catalog operations
Security assessment
The changes expand documentation about resource types covered by permissions but do not address security vulnerabilities or introduce new security features.
Diff
diff --git a/lake-formation/latest/dg/hybrid-access-prerequisites.md index fd8cef065..1040d02f5 100644 --- a/lake-formation/latest/dg/hybrid-access-prerequisites.md +++ b/lake-formation/latest/dg/hybrid-access-prerequisites.md @@ -15 +15 @@ We recommend that a Lake Formation administrator registers the Amazon S3 locatio - 1. Grant data location permission (`DATA_LOCATION_ACCESS`) to create Data Catalog resources that point to the Amazon S3 locations. Data location permissions control the ability to create Data Catalog databases and tables that point to particular Amazon S3 locations. + 1. Grant data location permission (`DATA_LOCATION_ACCESS`) to create Data Catalog resources that point to the Amazon S3 locations. Data location permissions control the ability to create Data Catalog catalogs, databases and tables that point to particular Amazon S3 locations. @@ -51 +51 @@ If you are not using the AWS managed policy for the grantor role, add the above -When you create a database or a table in the AWS Glue Data Catalog, you can specify the Amazon S3 bucket location of the underlying data and register it with Lake Formation. The tables below describe how permissions work for AWS Glue and Lake Formation users (principals) based on the Amazon S3 data location of the table or database. +When you create a catalog, database or a table in the AWS Glue Data Catalog, you can specify the Amazon S3 bucket location of the underlying data and register it with Lake Formation. The tables below describe how permissions work for AWS Glue and Lake Formation users (principals) based on the Amazon S3 data location of the table or database.