AWS lake-formation documentation change
Summary
Added requirement for data location registration to enable Lake Formation credential vending
Security assessment
Documents a prerequisite for security-related credential vending feature but does not indicate resolution of a security vulnerability.
Diff
diff --git a/lake-formation/latest/dg/hybrid-access-workflow.md b/lake-formation/latest/dg/hybrid-access-workflow.md index 5cdb64656..e78a01722 100644 --- a//lake-formation/latest/dg/hybrid-access-workflow.md +++ b//lake-formation/latest/dg/hybrid-access-workflow.md @@ -11 +11 @@ The following diagram shows how Lake Formation authorization works in hybrid acc -Before accessing data in your data lake, a data lake administrator or a user with administrative permissions sets up individual Data Catalog table user policies to allow or deny access to tables in your Data Catalog. Then, a principal who has the permissions to perform `RegisterResource` operation registers the Amazon S3 location of the table with Lake Formation in hybrid access mode. The administrator grants Lake Formation permissions to specific users on the Data Catalog databases and tables and opt them in to use Lake Formation permissions for those databases and tables in hybrid access mode. +Before accessing data in your data lake, a data lake administrator or a user with administrative permissions sets up individual Data Catalog table user policies to allow or deny access to tables in your Data Catalog. Then, a principal who has the permissions to perform `RegisterResource` operation registers the Amazon S3 location of the table with Lake Formation in hybrid access mode. If a data location is not registered with Lake Formation, The administrator grants Lake Formation permissions to specific users on the Data Catalog databases and tables and opt them in to use Lake Formation permissions for those databases and tables in hybrid access mode. @@ -24,0 +25,2 @@ Before accessing data in your data lake, a data lake administrator or a user wit +Lake Formation credential vending is not available, even when opted in, unless the data location is registered with Lake Formation. +