AWS glue medium security documentation change
Summary
Updated warnings about secret management in workflow runs, replacing 'Job arguments' with 'Run properties' and clarifying context
Security assessment
The changes explicitly warn against passing plaintext secrets in run properties and recommend secure secret management solutions. This addresses potential security risks of credential exposure through logging.
Diff
diff --git a/glue/latest/dg/aws-glue-api-workflow.md b/glue/latest/dg/aws-glue-api-workflow.md index bb338881c..11f95421e 100644 --- a/glue/latest/dg/aws-glue-api-workflow.md +++ b/glue/latest/dg/aws-glue-api-workflow.md @@ -582 +582 @@ A collection of properties to be used as part of each execution of the workflow. -Job arguments may be logged. Do not pass plaintext secrets as arguments. Retrieve secrets from a AWS Glue Connection, AWS Secrets Manager or other secret management mechanism if you intend to keep them within the Job. +Run properties may be logged. Do not pass plaintext secrets as properties. Retrieve secrets from a AWS Glue Connection, AWS Secrets Manager or other secret management mechanism if you intend to use them within the workflow run. @@ -647 +647 @@ A collection of properties to be used as part of each execution of the workflow. -Job arguments may be logged. Do not pass plaintext secrets as arguments. Retrieve secrets from a AWS Glue Connection, AWS Secrets Manager or other secret management mechanism if you intend to keep them within the Job. +Run properties may be logged. Do not pass plaintext secrets as properties. Retrieve secrets from a AWS Glue Connection, AWS Secrets Manager or other secret management mechanism if you intend to use them within the workflow run. @@ -995 +995 @@ The properties to put for the specified run. -Job arguments may be logged. Do not pass plaintext secrets as arguments. Retrieve secrets from a AWS Glue Connection, AWS Secrets Manager or other secret management mechanism if you intend to keep them within the Job. +Run properties may be logged. Do not pass plaintext secrets as properties. Retrieve secrets from a AWS Glue Connection, AWS Secrets Manager or other secret management mechanism if you intend to use them within the workflow run. @@ -1402 +1402 @@ The workflow run properties for the new workflow run. -Job arguments may be logged. Do not pass plaintext secrets as arguments. Retrieve secrets from a AWS Glue Connection, AWS Secrets Manager or other secret management mechanism if you intend to keep them within the Job. +Run properties may be logged. Do not pass plaintext secrets as properties. Retrieve secrets from a AWS Glue Connection, AWS Secrets Manager or other secret management mechanism if you intend to use them within the workflow run.