AWS lake-formation documentation change
Summary
Expanded LF-Tag-based access control coverage to include catalogs, views, and other Data Catalog objects. Fixed a typo in 'principals'.
Security assessment
The changes document extended security controls (tag-based access) to more resource types, but there's no indication this addresses a specific vulnerability.
Diff
diff --git a/lake-formation/latest/dg/managing-tags.md index 7a71ac785..d42c034e8 100644 --- a/lake-formation/latest/dg/managing-tags.md +++ b/lake-formation/latest/dg/managing-tags.md @@ -9 +9 @@ Life cycle of a LF-TagComparison of Lake Formation tag-based access control to I -To use the Lake Formation tag-based access control (LF-TBAC) method to secure Data Catalog resources (databases, tables, and columns), you create LF-Tags, assign them to resources, and grant LF-Tag permissions to principals. +To use the Lake Formation tag-based access control (LF-TBAC) method to secure Data Catalog objects such as catalogs, databases, tables, views, and columns, you create LF-Tags, assign them to resources, and grant LF-Tag permissions to principals. @@ -11 +11 @@ To use the Lake Formation tag-based access control (LF-TBAC) method to secure Da -Before you can assign LF-Tags to Data Catalog resources or grant permissions to principals, you need to define LF-Tags. Only a data lake administrator or a principal with LF-Tag creator permissions can create LF-Tags. +Before you can assign LF-Tags to Data Catalog objects or grant permissions to principals, you need to define LF-Tags. Only a data lake administrator or a principal with LF-Tag creator permissions can create LF-Tags. @@ -25 +25 @@ Data lake administrators and LF-Tag creators implicitly have these permissions o - * LF-Tag key-value pair permissions - `Assign`, `Describe`, and `Grant with LF-Tag expressions`. These permissions are required to assign LF-Tags to Data Catalog databases, tables, and columns, and to grant permissions on the resources to principals using Lake Formation tag-based access control. LF-Tag creators implicitly receive these permissions when creating LF-Tags. + * LF-Tag key-value pair permissions - `Assign`, `Describe`, and `Grant with LF-Tag expressions`. These permissions are required to assign LF-Tags to Data Catalog objects, and to grant permissions on the resources to principals using Lake Formation tag-based access control. LF-Tag creators implicitly receive these permissions when creating LF-Tags. @@ -30 +30 @@ Data lake administrators and LF-Tag creators implicitly have these permissions o -After receiving the `Create LF-Tag` permission and successfully creating LF-Tags, the LF-Tag creator can assign LF-Tags to resources and grant LF-Tag permissions (`Create LF-Tag`, `Alter`, `Drop`, and ) to other non-administrative princiapals to manage tags in the data lake. You can manage LF-Tags by using the Lake Formation console, the API, or the AWS Command Line Interface (AWS CLI). +After receiving the `Create LF-Tag` permission and successfully creating LF-Tags, the LF-Tag creator can assign LF-Tags to resources and grant LF-Tag permissions (`Create LF-Tag`, `Alter`, `Drop`, and ) to other non-administrative principals to manage tags in the data lake. You can manage LF-Tags by using the Lake Formation console, the API, or the AWS Command Line Interface (AWS CLI).