AWS AmazonS3 documentation change
Summary
Updated table creation documentation to include encryption inheritance rules, KMS permission requirements, and integration prerequisites for analytics services.
Security assessment
Adds guidance about encryption settings and KMS permissions for tables but does not indicate a resolved security flaw. Focuses on security best practices for encryption configuration.
Diff
diff --git a/AmazonS3/latest/userguide/s3-tables-create.md b/AmazonS3/latest/userguide/s3-tables-create.md index 81c83a716..8fccb32a9 100644 --- a//AmazonS3/latest/userguide/s3-tables-create.md +++ b//AmazonS3/latest/userguide/s3-tables-create.md @@ -21 +21 @@ By default, you can create up to 10,000 tables in a table bucket. To request a q -You can create a table by using the Amazon S3 console, Amazon S3 REST API, AWS SDKs, AWS Command Line Interface (AWS CLI), or integrated query engines. +You can create a table by using the Amazon S3 console, Amazon S3 REST API, AWS SDKs, AWS Command Line Interface (AWS CLI), or query engines connected to your table buckets. @@ -23 +23 @@ You can create a table by using the Amazon S3 console, Amazon S3 REST API, AWS S -For information about valid table names, see [Naming rules for tables and namespaces](./s3-tables-buckets-naming.html#naming-rules-table). +When you create a table you can specify the encryption settings for that table, unless you are creating the table with Athena. If you don't specify encryption settings the table is encrypted with the default settings for the table bucket. For more information, see [Specifying encryption for tables](./s3-tables-kms-specify.html#specify-kms-table). @@ -34,0 +35,4 @@ To create a table, you must first do the following: + * ###### Note + +If you are using SSE-KMS encryption for your table, you need permissions for `s3tables:PutTableEncryption`, and `DescribeKey` permission on the chosen AWS KMS key. Additionally the AWS KMS key you use needs to grant S3 Tables permission to perform automatic table maintenance. For more information, see [Permission requirements for S3 Tables SSE-KMS encryption](./s3-tables-kms-permissions.html) + @@ -37,0 +42,2 @@ To create a table, you must first do the following: +For information about valid table names, see [Naming rules for tables and namespaces](./s3-tables-buckets-naming.html#naming-rules-table). + @@ -44 +50 @@ If your table definition contains capital letters, you receive the following err -The following procedure uses the Amazon S3 console to create a table with Amazon Athena. If you haven't already created a namespace in your table bucket, you can do so as part of this process. +The following procedure uses the Amazon S3 console to create a table with Amazon Athena. If you haven't already created a namespace in your table bucket, you can do so as part of this process. Before performing the following steps, make sure that you've integrated your table buckets with AWS analytics services in this Region. For more information, see [Using Amazon S3 Tables with AWS analytics services](./s3-tables-integrating-aws.html). @@ -48 +54 @@ The following procedure uses the Amazon S3 console to create a table with Amazon -Before performing the following steps, make sure that you've integrated your table buckets with AWS analytics services in this Region. For more information, see [Using Amazon S3 Tables with AWS analytics services](./s3-tables-integrating-aws.html). +When you create a table using Athena that table inherits the default encryption settings from the table bucket. If you want to use a different encryption type you need to create the table using another method.