AWS lake-formation documentation change

Service: lake-formation · 2025-04-18 · Documentation low

File: lake-formation/latest/dg/granting-table-permissions.md

Summary

Clarified that implicit DESCRIBE permission doesn't apply with ABAC, updated UI references from 'Data lake permissions' to 'Data permissions', and added permission scope specification for attribute-based grants

Security assessment

The changes document ABAC behavior differences and attribute-based permission scopes, which are security features, but there's no evidence of addressing a specific vulnerability.

Diff

diff --git a/lake-formation/latest/dg/granting-table-permissions.md b/lake-formation/latest/dg/granting-table-permissions.md
index 38f9515bf..337a22328 100644
--- a//lake-formation/latest/dg/granting-table-permissions.md
+++ b//lake-formation/latest/dg/granting-table-permissions.md
@@ -9 +9 @@ You can use the Lake Formation console or AWS CLI to grant Lake Formation permis
-If you grant permissions on all tables in a database, you are implicitly granting the `DESCRIBE` permission on the database. The database then appears on the **Databases** page on the console, and is returned by the `GetDatabases` API operation.
+If you grant permissions on all tables in a database, you are implicitly granting the `DESCRIBE` permission on the database. The database then appears on the **Databases** page on the console, and is returned by the `GetDatabases` API operation. This automatic `DESCRIBE` permission grant doesn't apply when using attribute-based access control (ABAC). When granting permissions on all tables in a database using attributes, Lake Formation doesn't implicitly grant `DESCRIBE` permission to the database.
@@ -31 +31 @@ To grant permissions on a table resource link, see [Granting resource link permi
-  1. Open the Grant data lake permissions page.
+  1. Open the Grant permissions page.
@@ -37 +37 @@ Do one of the following:
-     * In the navigation pane, choose **Data lake permissions** under **Permissions**. Then choose **Grant**.
+     * In the navigation pane, choose **Data permissions** under **Permissions**. Then choose **Grant**.
@@ -47,2 +46,0 @@ You can grant permissions on a table through its resource link. To do so, on the
-![The Principal type section contains two options - Principals and Principals by attributes. The Principals option is selected.](/images/lake-formation/latest/dg/images/identity-center-grant-perm.png)
-
@@ -83,0 +82,2 @@ Specify the attribute key and value(s). If you choose more than one value, you a
+Choose the permission scope by specifying if you're granting permissions to principals with matching attributes in the same account or in another account. 
+