AWS firehose medium security documentation change
Summary
Removed detailed resource link instructions and simplified Lake Formation permissions guidance
Security assessment
Removed specific guidance about required DESCRIBE permissions and resource link creation, which could lead to misconfigured permissions if not properly documented elsewhere. This impacts security by potentially omitting critical access control details.
Diff
diff --git a/firehose/latest/dev/apache-iceberg-prereq.md b/firehose/latest/dev/apache-iceberg-prereq.md index 048d7e0ff..920657889 100644 --- a//firehose/latest/dev/apache-iceberg-prereq.md +++ b//firehose/latest/dev/apache-iceberg-prereq.md @@ -49,2 +48,0 @@ To deliver data to Amazon S3 table buckets, complete the following prerequisites - * **Create a resource link to the namespace** – Firehose streams data to the tables in the database registered in the default catalog of the AWS Glue Data Catalog. To stream data to tables in S3 table buckets, create a [resource link](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html#database-link-tables) in the default catalog that points to the namespace in table bucket. A resource link is a Data Catalog object that acts as an alias or pointer to another Data Catalog resource, such as a database or table. - @@ -53 +51 @@ To deliver data to Amazon S3 table buckets, complete the following prerequisites - * **Configure AWS Lake Formation permissions** – AWS Lake Formation manages access to your table resources. Lake Formation uses its own [permissions model](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html#grant-permissions-tables) that enables fine-grained access control for Data Catalog resources. For Firehose to ingest data into table buckets, the Firehose role requires `DESCRIBE` permissions on the resource link to discover the S3 Tables namespace through the resource link and read/write permission on the underlying table. + * **Configure AWS Lake Formation permissions** – AWS Lake Formation manages access to your table resources. Lake Formation uses its own [permissions model](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html#grant-permissions-tables) that enables fine-grained access control for Data Catalog resources. @@ -60,4 +57,0 @@ For step-by-step integration, refer to the blog [Build a data lake for streaming -You will use the resource link name for Database created as part of prerequisites in your Firehose stream configuration for routing purposes. You can use them in the **Unique key** section of your Firehose stream configuration if you are routing to a single table, or send them as part of your input data for Firehose to route to the right table using JSON Query expressions. - -For more ways to create resource links, see [Creating a resource link to a shared Data Catalog table](https://docs.aws.amazon.com/lake-formation/latest/dg/create-resource-link-table.html) or [Creating a resource link to a shared Data Catalog database](https://docs.aws.amazon.com/lake-formation/latest/dg/create-resource-link-database.html) in the _Lake Formation user guide_. -