AWS glue documentation change
Summary
Added configuration instructions for enabling Lake Formation FGAC in AWS Glue Interactive Sessions
Security assessment
Documents setup for fine-grained access control security feature but does not address a specific vulnerability
Diff
diff --git a/glue/latest/dg/security-lf-enable.md b/glue/latest/dg/security-lf-enable.md index 1fa7be40a..cb3ce893c 100644 --- a/glue/latest/dg/security-lf-enable.md +++ b/glue/latest/dg/security-lf-enable.md @@ -5 +5 @@ -OverviewHow it worksMinimum workersEnable runtime permissionsSet up runtime permissionsSubmitting a job runFGAC for AWS Glue 5.0 Notebook or interactive sessionsSupported operations +OverviewHow it worksMinimum workersEnable runtime permissionsSet up runtime permissionsSubmitting a job runUsing an Interactive SessionFGAC for AWS Glue 5.0 Notebook or interactive sessionsSupported operations @@ -142,0 +143,11 @@ After you finish setting up the Lake Formation grants, you can submit Spark jobs +## Using an Interactive Session + +After you finish setting up the AWS Lake Formation grants, you can use Interactive Sessions on AWS Glue. You must provide the following Spark configurations via the `%%configure` magic prior to executing code. + + + %%configure + { + "--enable-lakeformation-fine-grained-access": "true", + "--conf": "spark.sql.catalog.spark_catalog=org.apache.iceberg.spark.SparkSessionCatalog --conf spark.sql.catalog.spark_catalog.warehouse=<S3_DATA_LOCATION> --conf spark.sql.catalog.spark_catalog.catalog-impl=org.apache.iceberg.aws.glue.GlueCatalog --conf spark.sql.catalog.spark_catalog.io-impl=org.apache.iceberg.aws.s3.S3FileIO --conf spark.sql.extensions=org.apache.iceberg.spark.extensions.IcebergSparkSessionExtensions --conf spark.sql.catalog.spark_catalog.client.region=<REGION> --conf spark.sql.catalog.spark_catalog.glue.account-id=<ACCOUNT_ID> --conf spark.sql.catalog.spark_catalog.glue.endpoint=https://glue.<REGION>.amazonaws.com" + } +