AWS lake-formation medium security documentation change
Summary
Clarified hybrid access mode permissions requirements for opted-in principals
Security assessment
Explicitly states that opted-in principals require both Lake Formation and IAM permissions, clarifying security controls for access management
Diff
diff --git a/lake-formation/latest/dg/hybrid-access-mode.md b/lake-formation/latest/dg/hybrid-access-mode.md index 07a76c290..9119fd2b6 100644 --- a//lake-formation/latest/dg/hybrid-access-mode.md +++ b//lake-formation/latest/dg/hybrid-access-mode.md @@ -11 +11 @@ AWS Lake Formation _hybrid access mode_ supports two permission pathways to the -When registering an Amazon S3 location with Lake Formation, you have the option to either enforce Lake Formation permissions for all resources at this location or use hybrid access mode. The hybrid access mode enforces only `CREATE_TABLE`, `CREATE_PARTITION`, `UPDATE_TABLE` permissions by default. When an Amazon S3 location is in the hybrid mode, you can enable Lake Formation permissions by opting in principals for the Data Catalog objects under that location. +When registering an Amazon S3 location with Lake Formation, you have the option to either enforce Lake Formation permissions for all resources at this location or use hybrid access mode. The hybrid access mode enforces only `CREATE_TABLE`, `CREATE_PARTITION`, `UPDATE_TABLE` permissions by default. When an Amazon S3 location is in the hybrid mode, you can enable Lake Formation permissions by opting in principals for the Data Catalog objects under that location. It means both Lake Formation permissions and IAM permissions can control access to that data. This means that opted in principals will require both Lake Formation permissions and IAM permissions to access the data, while non-opted-in principals will continue to access data using only IAM permissions. @@ -13 +13 @@ When registering an Amazon S3 location with Lake Formation, you have the option -Thus, hybrid access mode provides the flexibility to selectively enable Lake Formation for databases and tables in your Data Catalog for a specific set of users without interrupting the access for other existing users or workloads. +Thus, hybrid access mode provides the flexibility to selectively enable Lake Formation for catalogs, databases, and tables in your Data Catalog for a specific set of users without interrupting the access for other existing users or workloads.