AWS emr documentation change
Summary
Updated documentation for Data Catalog views, including column naming conventions, IAM role requirements, and the addition of the `invoker_principal` function for access control
Security assessment
The changes clarify security practices for querying views using Lake Formation permissions and introduce the `invoker_principal` function to refine access based on the runtime role. This enhances security documentation but does not address a specific vulnerability.
Diff
diff --git a/emr/latest/EMR-Serverless-UserGuide/SECTION-jobs-glue-data-catalog-views.md b/emr/latest/EMR-Serverless-UserGuide/SECTION-jobs-glue-data-catalog-views.md index 1f41f414e..b068177a3 100644 --- a//emr/latest/EMR-Serverless-UserGuide/SECTION-jobs-glue-data-catalog-views.md +++ b//emr/latest/EMR-Serverless-UserGuide/SECTION-jobs-glue-data-catalog-views.md @@ -83 +83 @@ You use the following CLI command to create a view: - "Name": "colN", + "Name": "col_n", @@ -195 +195 @@ For more information about creating and configuring data-catalog views, see [Bui -After creating a Data Catalog view, you can use an IAM role to query the view. The IAM role must have the Lake Formation **SELECT** permission on the Data Catalog view. You don't need to grant access to the underlying tables referenced in the view. The IAM role used to query the view must be the runtime role of the EMR application. You can access the view from EMR Serverless, using a runtime role from Amazon EMR steps, EMR Studio, and SageMaker AI Studio. +After creating a Data Catalog view, you can query it using an Amazon EMR Serverless Spark job that has AWS Lake Formation fine-grained access control enabled. The job runtime role must have the Lake Formation `SELECT` permission on the Data Catalog view. You don't need to grant access to the underlying tables referenced in the view. @@ -201,0 +202,7 @@ Once you have everything set up, you can query your view. For example, after cre +A helpful function is the `invoker_principal`. It returns the unique identifier of the EMRS job runtime role. This can be used to control the view output, based on the invoking principal. You can use this to add a condition in your view that refines query results, based on the calling role. The job runtime role must have permission to the `LakeFormation:GetDataLakePrincipal` IAM action to use this function. + + + select invoker_principal(); + +You can add this function to a `WHERE` clause, for instance, to refine query results. + @@ -225,0 +233,4 @@ When you create Data Catalog views, the following apply: + * An AWS Glue Data Catalog view schema is always stored using lowercase. For example, if you use a DDL statement to create a Glue Data Catalog view with a column named `Castle`, the column created in the Glue Data Catalog will be made lowercase, to `castle`. If you then specify the column name in a DML query as `Castle` or `CASTLE`, EMR Spark will make the name lowercase for you in order to run the query. But the column heading displays using the casing that you specified in the query. + +If you want a query to fail in a case where a column name specified in the DML query does not match the column name in the Glue Data Catalog, you can set `spark.sql.caseSensitive=true`. + @@ -235 +246 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Job resiliency +Debugging jobs @@ -237 +248 @@ Job resiliency -Metastore configuration for EMR Serverless +Considerations