AWS glue high security documentation change
Summary
Replaced manual credential encoding with AWS Secrets Manager integration for Google Cloud credentials
Security assessment
Shift to Secrets Manager improves credential security by avoiding manual base64 encoding, directly addressing secure credential handling.
Diff
diff --git a/glue/latest/dg/creating-bigquery-connection.md b/glue/latest/dg/creating-bigquery-connection.md index 4a7c6fbf4..b5b059abd 100644 --- a//glue/latest/dg/creating-bigquery-connection.md +++ b//glue/latest/dg/creating-bigquery-connection.md @@ -47 +47 @@ You should now have downloaded a JSON file with credentials for your service acc - 3. base64 encode your downloaded credentials file. On an AWS CloudShell session or similar, you can do this from the command line by running `cat `credentialsFile.json` | base64 -w 0`. Retain the output of this command, `credentialString`. + 3. In AWS Secrets Manager, create a secret using your downloaded credentials file. You can choose the **Plaintext** tab and paste the JSON formatted file content. To create a secret in Secrets Manager, follow the tutorial available in [ Create an AWS Secrets Manager secret ](https://docs.aws.amazon.com/secretsmanager/latest/userguide/create_secret.html) in the AWS Secrets Manager documentation. After creating the secret, keep the Secret name, `secretName` for the next step. @@ -49,5 +49 @@ You should now have downloaded a JSON file with credentials for your service acc - 4. In AWS Secrets Manager, create a secret using your Google Cloud Platform credentials. To create a secret in Secrets Manager, follow the tutorial available in [ Create an AWS Secrets Manager secret ](https://docs.aws.amazon.com/secretsmanager/latest/userguide/create_secret.html) in the AWS Secrets Manager documentation. After creating the secret, keep the Secret name, `secretName` for the next step. - - * When selecting **Key/value pairs** , create a pair for the key `credentials` with the value `credentialString`. - - 5. In the AWS Glue Data Catalog, create a connection by following the steps in <https://docs.aws.amazon.com/glue/latest/dg/console-connections.html>. After creating the connection, keep the connection name, `connectionName`, for the next step. + 4. In the AWS Glue Data Catalog, create a connection by following the steps in <https://docs.aws.amazon.com/glue/latest/dg/console-connections.html>. After creating the connection, keep the connection name, `connectionName`, for the next step. @@ -59 +55 @@ You should now have downloaded a JSON file with credentials for your service acc - 6. Grant the IAM role associated with your AWS Glue job permission to read `secretName`. + 5. Grant the IAM role associated with your AWS Glue job permission to read `secretName`. @@ -61 +57 @@ You should now have downloaded a JSON file with credentials for your service acc - 7. In your AWS Glue job configuration, provide `connectionName` as an **Additional network connection**. + 6. In your AWS Glue job configuration, provide `connectionName` as an **Additional network connection**.