AWS datazone documentation change
Summary
Replaced inline IAM policy JSON with reference to AWS Managed Policy documentation
Security assessment
The change removes detailed policy statements and replaces them with a link to managed policy documentation. While this impacts documentation completeness, there's no evidence of addressing a specific security vulnerability or weakness. The change appears to be documentation restructuring rather than security-related.
Diff
diff --git a/datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneGlueManageAccessRolePolicy.md b/datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneGlueManageAccessRolePolicy.md index e86bba868..e46c8ed77 100644 --- a//datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneGlueManageAccessRolePolicy.md +++ b//datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneGlueManageAccessRolePolicy.md @@ -9,269 +9 @@ This policy gives Amazon DataZone permissions to publish AWS Glue data to the ca - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "GlueTagDatabasePermissions", - "Effect": "Allow", - "Action": [ - "glue:TagResource", - "glue:UntagResource" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - }, - "ForAnyValue:StringLikeIfExists": { - "aws:TagKeys": "DataZoneDiscoverable_*" - } - } - }, - { - "Sid": "GlueDataQualityPermissions", - "Effect": "Allow", - "Action": [ - "glue:ListDataQualityResults", - "glue:GetDataQualityResult" - ], - "Resource": "arn:aws:glue:*:*:dataQualityRuleset/*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "GlueCrawlerPermissions", - "Effect": "Allow", - "Action": "glue:ListCrawls", - "Resource": "arn:aws:glue:*:*:crawler/*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "GlueTableDatabasePermissions", - "Effect": "Allow", - "Action": [ - "glue:CreateTable", - "glue:DeleteTable", - "glue:GetDatabases", - "glue:GetTables", - "glue:SearchTables" - ], - "Resource": [ - "arn:aws:glue:*:*:catalog", - "arn:aws:glue:*:*:catalog/*", - "arn:aws:glue:*:*:database/*", - "arn:aws:glue:*:*:table/*" - ], - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "GlueGetTagsPermissions", - "Effect": "Allow", - "Action": [ - "glue:GetTags", - "glue:GetCatalog" - ], - "Resource": [ - "arn:aws:glue:*:*:catalog", - "arn:aws:glue:*:*:catalog/*", - "arn:aws:glue:*:*:database/*" - ], - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "LakeformationResourceSharingPermissions", - "Effect": "Allow", - "Action": [ - "lakeformation:BatchGrantPermissions", - "lakeformation:BatchRevokePermissions", - "lakeformation:CreateDataCellsFilter", - "lakeformation:CreateLakeFormationOptIn", - "lakeformation:DeleteDataCellsFilter", - "lakeformation:DeleteLakeFormationOptIn", - "lakeformation:GrantPermissions", - "lakeformation:GetDataCellsFilter", - "lakeformation:GetResourceLFTags", - "lakeformation:ListDataCellsFilter", - "lakeformation:ListLakeFormationOptIns", - "lakeformation:ListPermissions", - "lakeformation:RegisterResource", - "lakeformation:RevokePermissions", - "lakeformation:UpdateDataCellsFilter", - "glue:GetDatabase", - "glue:GetTable", - "organizations:DescribeOrganization", - "ram:GetResourceShareInvitations", - "ram:ListResources" - ], - "Resource": "*" - }, - { - "Sid": "LakeformationResourceFederatedSharingPermissions", - "Effect": "Allow", - "Action": [ - "lakeformation:GetDataAccess" - ], - "Resource": "*", - "Condition": { - "Null": { - "lakeformation:GlueARN": "true" - }, - "ForAnyValue:StringEquals": { - "aws:CalledVia": [ - "glue.amazonaws.com", - "lakeformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "CrossAccountRAMResourceSharingPermissions", - "Effect": "Allow", - "Action": [ - "glue:DeleteResourcePolicy", - "glue:PutResourcePolicy" - ], - "Resource": [ - "arn:aws:glue:*:*:catalog", - "arn:aws:glue:*:*:catalog/*", - "arn:aws:glue:*:*:database/*", - "arn:aws:glue:*:*:table/*" - ], - "Condition": { - "ForAnyValue:StringEquals": { - "aws:CalledVia": [ - "ram.amazonaws.com" - ] - } - } - }, - { - "Sid": "CrossAccountLakeFormationResourceSharingPermissions", - "Effect": "Allow", - "Action": [ - "ram:CreateResourceShare" - ], - "Resource": "*", - "Condition": { - "StringEqualsIfExists": { - "ram:RequestedResourceType": [ - "glue:Table", - "glue:Database", - "glue:Catalog" - ] - }, - "ForAnyValue:StringEquals": { - "aws:CalledVia": [ - "lakeformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "CrossAccountRAMResourceShareInvitationPermission", - "Effect": "Allow", - "Action": [ - "ram:AcceptResourceShareInvitation" - ], - "Resource": "arn:aws:ram:*:*:resource-share-invitation/*" - }, - { - "Sid": "CrossAccountRAMResourceSharingViaLakeFormationPermissions", - "Effect": "Allow", - "Action": [ - "ram:AssociateResourceShare", - "ram:DeleteResourceShare", - "ram:DisassociateResourceShare", - "ram:GetResourceShares", - "ram:ListResourceSharePermissions", - "ram:UpdateResourceShare" - ], - "Resource": "*",