AWS redshift documentation change
Summary
Added support for AWS IAM Identity Center authorization method and clarified region specification
Security assessment
Added documentation for IAM Identity Center integration as a new authentication method, which is a security feature. No evidence of addressing a specific security vulnerability.
Diff
diff --git a/redshift/latest/mgmt/data-api.md index e4ebb8ab6..798c8e2b7 100644 --- a/redshift/latest/mgmt/data-api.md +++ b/redshift/latest/mgmt/data-api.md @@ -11 +11 @@ The Amazon Redshift Data API simplifies access to your Amazon Redshift data ware -The Data API doesn't require a persistent connection to your database. Instead, it provides a secure HTTP endpoint and integration with AWS SDKs. You can use the endpoint to run SQL statements without managing connections. Calls to the Data API are asynchronous. The Data API uses either credentials stored in AWS Secrets Manager or temporary database credentials. You don't need to pass passwords in the API calls with either authorization method. For more information about AWS Secrets Manager, see [What Is AWS Secrets Manager?](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html) in the _AWS Secrets Manager User Guide_. +The Data API doesn't require a persistent connection to your database. Instead, it provides a secure HTTP endpoint and integration with AWS SDKs. You can use the endpoint to run SQL statements without managing connections. Calls to the Data API are asynchronous. The Data API can use either credentials stored in AWS Secrets Manager or temporary database credentials. You don't need to pass passwords in the API calls with either authorization method. For more information about AWS Secrets Manager, see [What Is AWS Secrets Manager?](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html) in the _AWS Secrets Manager User Guide_. You can also use AWS IAM Identity Center for authorization. @@ -23 +23 @@ Before you use the Amazon Redshift Data API, review the following steps: - 2. Determine if you plan to call the Data API with authentication credentials from Secrets Manager or temporary credentials. For more information, see Choosing database authentication credentials when calling the Amazon Redshift Data API. + 2. Determine if you plan to call the Data API with authentication credentials from Secrets Manager, temporary credentials, or use AWS IAM Identity Center. For more information, see Choosing database authentication credentials when calling the Amazon Redshift Data API. @@ -91,0 +92,5 @@ When you call the Data API, you use one of the following authentication methods +**AWS IAM Identity Center** + + +The Data API can be accessed with a single sign-on user registered in AWS IAM Identity Center. For information about the steps to set up IAM Identity Center, see [Using Data API with trusted identity propagation](./data-api-trusted-identity-propagation.html). + @@ -96,0 +102,2 @@ With this method, provide the `secret-arn` of a secret stored in AWS Secrets Man +With this method, you can also supply a `region` value that specifies the AWS Region where your data is located. + @@ -111 +118 @@ With this method, choose one of the following options: -With these methods, you can also supply a `region` value that specifies the AWS Region where your data is located. +With this method, you can also supply a `region` value that specifies the AWS Region where your data is located.