AWS Security ChangesHomeSearch

AWS redshift documentation change

Service: redshift · 2025-06-07 · Documentation medium

File: redshift/latest/dg/r_ALTER_IDENTITY_PROVIDER.md

Summary

Expanded documentation for AUTO_CREATE_ROLES behavior and added _filter_pattern_ parameter details for group filtering

Security assessment

The changes clarify role auto-creation logic and introduce group filtering patterns, which are security-adjacent access control features. However, there's no evidence of addressing a specific vulnerability. The filter pattern documentation improves security posture by enabling granular group management.

Diff

diff --git a/redshift/latest/dg/r_ALTER_IDENTITY_PROVIDER.md b/redshift/latest/dg/r_ALTER_IDENTITY_PROVIDER.md
index bccbf8963..c4f943a9f 100644
--- a//redshift/latest/dg/r_ALTER_IDENTITY_PROVIDER.md
+++ b//redshift/latest/dg/r_ALTER_IDENTITY_PROVIDER.md
@@ -49 +49,37 @@ _auto_create_roles_
-Enables or disables the auto-create role feature. The default is `FALSE` if no option is provided in the SQL, and `TRUE` if an option is provided without any value. 
+Enables or disables the auto-create role feature. If the value is TRUE, Amazon Redshift enables the auto-create role feature. If the value is FALSE, Amazon Redshift disables the auto-create role feature. If the value for this parameter isn't specified, Amazon Redshift determines the value using the following logic: 
+
+  * If `AUTO_CREATE_ROLES` is provided but the value isn't specified, the value is set to TRUE. 
+
+  * If `AUTO_CREATE_ROLES` isn't provided and the identity provider is AWSIDC, the value is set to FALSE. 
+
+  * If `AUTO_CREATE_ROLES` isn't provided and the identity provider is Azure, the value is set to TRUE. 
+
+
+
+
+To include groups, specify `INCLUDE`. The default is empty, which means include all groups if `AUTO_CREATE_ROLES` is on.
+
+To exclude groups, specify `EXCLUDE`. The default is empty, which means do not exclude any groups if `AUTO_CREATE_ROLES` is on.
+
+_filter_pattern_
+    
+
+A valid UTF-8 character expression with a pattern to match group names. The LIKE option performs a case-sensitive match that supports the following pattern-matching metacharacters:
+
+Metacharacter | Description   
+---|---  
+`%` | Matches any sequence of zero or more characters.  
+`_` | Matches any single character.  
+  
+If _filter_pattern_ does not contain metacharacters, then the pattern only represents the string itself; in that case LIKE acts the same as the equals operator. 
+
+_filter_pattern_ supports the following characters:
+
+  * Uppercase and lowercase alphabetic characters (A-Z and a-z) 
+
+  * Numerals (0-9) 
+
+  * The following special characters: 
+    
+        _ % ^ * + ? { } , $
+
@@ -51 +86,0 @@ Enables or disables the auto-create role feature. The default is `FALSE` if no o
-To include groups, specify `INCLUDE`. The default is empty, which means include all groups if `AUTO_CREATES_ROLES` is on.
@@ -53 +87,0 @@ To include groups, specify `INCLUDE`. The default is empty, which means include
-To exclude groups, specify `EXCLUDE`. The default is empty, which means do not exclude any groups if `AUTO_CREATES_ROLES` is on.
@@ -58 +92 @@ _DISABLE or ENABLE_
-Turns an identity provider on or off. The default is ENABLE
+Turns an identity provider on or off. The default is ENABLE.