AWS athena documentation change
Summary
Expanded documentation for trusted identity propagation support in SageMaker/EMR Studio and workgroup configuration details
Security assessment
Clarifies identity management features and access controls but does not address vulnerabilities. Enhances documentation of existing security mechanisms (IAM Identity Center integration) without evidence of patching security issues.
Diff
diff --git a/athena/latest/ug/workgroups-identity-center.md b/athena/latest/ug/workgroups-identity-center.md index 404ef752a..94cec76a9 100644 --- a//athena/latest/ug/workgroups-identity-center.md +++ b//athena/latest/ug/workgroups-identity-center.md @@ -9 +9 @@ Considerations and limitationsCreating an IAM Identity Center enabled Athena wor -The trusted identity propagation feature of AWS IAM Identity Center permits your workforce identities to be used across AWS analytics services. Trusted identity propagation saves you from having to perform service-specific identity provider configurations or IAM role setups. +The trusted identity propagation feature of AWS IAM Identity Center permits your workforce identities to be used across AWS analytics services. Trusted identity propagation saves you from having to perform service-specific identity provider configurations or IAM role setups. This feature is now supported in both EMR Studio and SageMaker Unified Studio for Athena SQL workgroups. @@ -13 +13,12 @@ With IAM Identity Center, you can manage sign-in security for your workforce ide -Currently, Athena SQL support for trusted identity propagation lets you use the same identity for Amazon EMR Studio and the Athena SQL interface in EMR Studio. To use IAM Identity Center identities with Athena SQL in EMR Studio, you must create IAM Identity Center enabled workgroups in Athena. You can then use the IAM Identity Center console or API to assign IAM Identity Center users or groups to the IAM Identity Center enabled Athena workgroups. Queries from an Athena workgroup that uses trusted identity propagation must be run from the Athena SQL interface in an EMR Studio that has IAM Identity Center enabled. +Athena SQL support for trusted identity propagation is available in both EMR Studio and SageMaker Unified Studio. Each platform provides specific interfaces for using TIP with Athena. + +When using Athena SQL in EMR Studio with IAM Identity Center identities, you have two workgroup options: + + * **Regular WorkGroups** – No user/group assignments needed. + + * **IAM Identity Center enabled workgroups** – Requires assigning users/groups through IAM Identity Center console or API. + + + + +For both options, you can run queries using the Athena SQL interface in EMR Studio with IAM Identity Center enabled. @@ -21 +32 @@ When you use trusted identity propagation with Amazon Athena, consider the follo - * Existing Athena SQL workgroups cannot be modified to support IAM Identity Center enabled workgroups. + * Existing Athena SQL workgroups cannot be modified to support IAM Identity Center enabled workgroups. Existing Athena SQL workgroups can propagate identity to downstream services. @@ -31 +42 @@ When you use trusted identity propagation with Amazon Athena, consider the follo - * By default, queries time out after 30 minutes in workgroups that use trusted identity propagation. You can request a query timeout increase, but the maximum a query can run in trusted identity propagation workgroups is one hour. + * By default, queries time out after 30 minutes in IAM Identity Center enabled workgroups. You can request a query timeout increase, but the maximum a query can run in trusted identity propagation workgroups is one hour. @@ -39 +50 @@ When you use trusted identity propagation with Amazon Athena, consider the follo - * `aws:CalledVia` context keys. + * `aws:CalledVia` context keys for IAM Identity Center enabled workgroups.