AWS AmazonS3 documentation change
Summary
Simplified Firehose setup process by removing resource link creation steps, reordering prerequisites, and adding cross-account streaming configuration options.
Security assessment
The changes streamline documentation by removing redundant resource link creation steps and emphasize proper Lake Formation permissions. While cross-account streaming guidance was added (a security-sensitive feature), there's no evidence of addressing a specific security vulnerability. The addition of cross-account configuration details improves security documentation by clarifying access control requirements.
Diff
diff --git a/AmazonS3/latest/userguide/s3-tables-integrating-firehose.md b/AmazonS3/latest/userguide/s3-tables-integrating-firehose.md index 41faaea75..aa8d6d716 100644 --- a//AmazonS3/latest/userguide/s3-tables-integrating-firehose.md +++ b//AmazonS3/latest/userguide/s3-tables-integrating-firehose.md @@ -5 +5 @@ -Creating a role for Firehose to use S3 tables as a destinationCreating a resource link to your namespaceGranting permission on a resource linkSetting up a Firehose stream to S3 tables +Creating a role for Firehose to use S3 tables as a destinationCreating a Firehose stream to S3 tables @@ -11 +11 @@ Amazon Data Firehose is a fully managed service for delivering real-time [stream -After you [integrate your table buckets with AWS analytics services](./s3-tables-integrating-aws.html), you do the following: +Complete these steps to set up Firehose streaming to tables in S3 table buckets: @@ -13 +13 @@ After you [integrate your table buckets with AWS analytics services](./s3-tables - 1. Configure Firehose to deliver data into your S3 tables. To do so, you create an AWS Identity and Access Management (IAM) service role that allows Firehose to access your tables. + 1. [Integrate your table buckets with AWS analytics services](./s3-tables-integrating-aws.html). @@ -15 +15 @@ After you [integrate your table buckets with AWS analytics services](./s3-tables - 2. Create a resource link to your table or table's namespace. + 2. Configure Firehose to deliver data into your S3 tables. To do so, you create an AWS Identity and Access Management (IAM) service role that allows Firehose to access your tables. @@ -17 +17 @@ After you [integrate your table buckets with AWS analytics services](./s3-tables - 3. Grant the Firehose service role explicit permissions to your table or table's namespace by granting permissions on the resource link. + 3. Grant the Firehose service role explicit permissions to your table or table's namespace. For more information, see [Grant Lake Formation permissions on your table resources](./s3-tables-integrating-aws.html#grant-permissions-tables). @@ -165 +165 @@ If error logging is enabled, Firehose also sends data delivery errors to your Cl -## Creating a resource link to your table's namespaces +## Creating a Firehose stream to S3 tables @@ -167,69 +167 @@ If error logging is enabled, Firehose also sends data delivery errors to your Cl -To access your tables, Amazon Data Firehose needs a resource link that targets your table's namespace. A resource link is a Data Catalog object that acts as an alias or pointer to another Data Catalog resource, such as a database or table. The link is stored in the Data Catalog of the account or Region where it's created. For more information, see [How resource links work](https://docs.aws.amazon.com/lake-formation/latest/dg/resource-links-about.html) in the _AWS Lake Formation Developer Guide_. - -After you've integrated your table buckets with the AWS analytics services, you can create resource links to work with your tables in Firehose. - -You create resource links to your table namespaces, and then provide the name of the link to Firehose so that Firehose can work with the linked tables. - -The following AWS CLI command creates a resource link that you can use to connect your S3 tables to Firehose. To use this example command, replace the ``user input placeholders`` with your own information. - - - aws glue create-database --region us-east-1 \ - --catalog-id "111122223333" \ - --database-input \ - '{ - "Name": "resource-link-name", - "TargetDatabase": { - "CatalogId": "111122223333:s3tablescatalog/amzn-s3-demo-table-bucket", - "DatabaseName": "my_namespace" - }, - "CreateTableDefaultPermissions": [] - }' - -###### Note - -You must separately grant permissions to both the resource link and the target (linked) namespace. For more information, see Granting permission on a resource link. - -## Granting permission on a resource link - -When you use a resource link to access your tables, you must separately grant permissions to both the resource link and the target (linked) namespace or table. You can grant an IAM principal Lake Formation permissions on a resource link that's linked to your table namespace either through the Lake Formation console or the AWS CLI. - -Console - - - 1. Open the AWS Lake Formation console at [https://console.aws.amazon.com/lakeformation/](https://console.aws.amazon.com/lakeformation/), and sign in as a data lake administrator. For more information on how to create a data lake administrator, see [Create a data lake administrator](https://docs.aws.amazon.com/lake-formation/latest/dg/initial-lf-config.html#create-data-lake-admin) in the _AWS Lake Formation Developer Guide_. - - 2. In the navigation pane, choose **Data permissions** , and then choose **Grant**. - - 3. On the **Grant Permissions** page, under **Principals** , choose **IAM users and roles** , and select the service role that you created to stream to tables. - - 4. Under **LF-Tags or catalog resources** , choose **Named Data Catalog resources**. - - 5. For **Catalogs** , choose your account ID, which is the **Default catalog**. - - 6. For **Databases** , choose the resource link that you created for your table namespace. - - 7. For **Resource link permissions** , choose **Describe**. - - 8. Choose **Grant**. - - - - -CLI - - - 1. Make sure that you're running AWS CLI commands as a data lake administrator. For more information, see [Create a data lake administrator](https://docs.aws.amazon.com/lake-formation/latest/dg/initial-lf-config.html#create-data-lake-admin) in the _AWS Lake Formation Developer Guide_. - - 2. Run the following command to grant Lake Formation permissions on a table in an S3 table bucket to an IAM principal so that the principal can access the table. To use this example, replace the ``user input placeholders`` with your own information. The `DataLakePrincipalIdentifier` value can be either an IAM user or role ARN. - - aws lakeformation grant-permissions \ - --principal DataLakePrincipalIdentifier=arn:aws:iam::account-id:role/role-name \ - --resource Database='{CatalogId=account-id, Name=database-name}' \ - --permissions DESCRIBE - - - - -## Setting up a Firehose stream to S3 tables - -The following procedure shows how to setup a Firehose stream to deliver data to S3 tables using the console. The following prerequisites are required to set up a Firehose stream to S3 tables. +The following procedure shows how to create a Firehose stream to deliver data to S3 tables using the console. The following prerequisites are required to set up a Firehose stream to S3 tables. @@ -247,11 +179 @@ The following procedure shows how to setup a Firehose stream to deliver data to - * [Creating a resource link to your namespace](./s3-tables-integrating-aws.html#database-link-tables) to be the destination of your stream. - -###### Note - -When you create a resource link for Firehose the name can consist only of uppercase letters, lowercase letters, and underscores (_). - - * [Granting Lake Formation permissions on your table resources](./s3-tables-integrating-aws.html#grant-permissions-tables) to the Firehose service role you created to stream to tables. - -###### Note - -You must separately grant permissions to both the resource link and on the target (linked) namespace or table. Firehose needs **Describe** permission on the resource link. + * [Grant Lake Formation permissions](./s3-tables-integrating-aws.html#grant-permissions-tables) to the Firehose service role you created to access tables. @@ -284 +206,5 @@ To provide routing information to Firehose when you configure a stream, you use - 7. For **Destination settings** , select **Current Account** and the **AWS Region** of the tables that you want to stream to. + 7. For **Destination settings** , choose **Current account** to stream to tables in your account or **Cross-account** for tables in another account. + + * For tables in the **Current account** , select your S3 Tables catalog from the **Catalog** dropdown. + + * For tables in a **Cross-account** , enter the **Catalog ARN** of the catalog you want to stream to in another account.