AWS redshift documentation change
Summary
Expanded documentation for AUTO_CREATE_ROLES behavior and added _filter_pattern_ parameter details for group filtering
Security assessment
The changes clarify role auto-creation logic and introduce group filtering patterns, which are security-adjacent access control features. However, there's no evidence of addressing a specific vulnerability. The filter pattern documentation improves security posture by enabling granular group management.
Diff
diff --git a/redshift/latest/dg/r_ALTER_IDENTITY_PROVIDER.md b/redshift/latest/dg/r_ALTER_IDENTITY_PROVIDER.md index bccbf8963..c4f943a9f 100644 --- a//redshift/latest/dg/r_ALTER_IDENTITY_PROVIDER.md +++ b//redshift/latest/dg/r_ALTER_IDENTITY_PROVIDER.md @@ -49 +49,37 @@ _auto_create_roles_ -Enables or disables the auto-create role feature. The default is `FALSE` if no option is provided in the SQL, and `TRUE` if an option is provided without any value. +Enables or disables the auto-create role feature. If the value is TRUE, Amazon Redshift enables the auto-create role feature. If the value is FALSE, Amazon Redshift disables the auto-create role feature. If the value for this parameter isn't specified, Amazon Redshift determines the value using the following logic: + + * If `AUTO_CREATE_ROLES` is provided but the value isn't specified, the value is set to TRUE. + + * If `AUTO_CREATE_ROLES` isn't provided and the identity provider is AWSIDC, the value is set to FALSE. + + * If `AUTO_CREATE_ROLES` isn't provided and the identity provider is Azure, the value is set to TRUE. + + + + +To include groups, specify `INCLUDE`. The default is empty, which means include all groups if `AUTO_CREATE_ROLES` is on. + +To exclude groups, specify `EXCLUDE`. The default is empty, which means do not exclude any groups if `AUTO_CREATE_ROLES` is on. + +_filter_pattern_ + + +A valid UTF-8 character expression with a pattern to match group names. The LIKE option performs a case-sensitive match that supports the following pattern-matching metacharacters: + +Metacharacter | Description +---|--- +`%` | Matches any sequence of zero or more characters. +`_` | Matches any single character. + +If _filter_pattern_ does not contain metacharacters, then the pattern only represents the string itself; in that case LIKE acts the same as the equals operator. + +_filter_pattern_ supports the following characters: + + * Uppercase and lowercase alphabetic characters (A-Z and a-z) + + * Numerals (0-9) + + * The following special characters: + + _ % ^ * + ? { } , $ + @@ -51 +86,0 @@ Enables or disables the auto-create role feature. The default is `FALSE` if no o -To include groups, specify `INCLUDE`. The default is empty, which means include all groups if `AUTO_CREATES_ROLES` is on. @@ -53 +87,0 @@ To include groups, specify `INCLUDE`. The default is empty, which means include -To exclude groups, specify `EXCLUDE`. The default is empty, which means do not exclude any groups if `AUTO_CREATES_ROLES` is on. @@ -58 +92 @@ _DISABLE or ENABLE_ -Turns an identity provider on or off. The default is ENABLE +Turns an identity provider on or off. The default is ENABLE.