AWS athena documentation change
Summary
Replaced 'Enable result reuse' section with 'Result fetcher' documentation, added details about CSE_KMS encryption handling and IAM/S3 policy considerations
Security assessment
The changes document secure data retrieval practices when using CSE-KMS encryption and IAM/S3 policies with s3:CalledVia conditions. While it explains security-related configurations, there is no evidence of addressing a specific vulnerability. The update improves clarity for secure driver configuration.
Diff
diff --git a/athena/latest/ug/odbc-v2-driver-advanced-options.md b/athena/latest/ug/odbc-v2-driver-advanced-options.md index 8fd02a2f3..2bafdfa36 100644 --- a//athena/latest/ug/odbc-v2-driver-advanced-options.md +++ b//athena/latest/ug/odbc-v2-driver-advanced-options.md @@ -5 +5 @@ -Fetch sizeEnable result reuseResult reuse maximum ageEnable streaming APIEnable S3 fetcher Use multiple S3 threadsUse single catalog and schemaUse query to list tablesUse WCHAR for string typesQuery external catalogsVerify SSLS3 result block sizeString column lengthComplex type column lengthTrusted CA certificateMin poll periodMax poll periodPoll multiplierMax poll durationConnection timeoutRequest timeout +Fetch sizeResult fetcherEnable result reuseResult reuse maximum ageUse multiple S3 threadsUse single catalog and schemaUse query to list tablesUse WCHAR for string typesQuery external catalogsVerify SSLS3 result block sizeString column lengthComplex type column lengthTrusted CA certificateMin poll periodMax poll periodPoll multiplierMax poll durationConnection timeoutRequest timeout @@ -17 +17 @@ RowsToFetchPerBlock | Optional | `1000` for non-streaming `20000` for streaming -## Enable result reuse +## Result fetcher @@ -19 +19 @@ RowsToFetchPerBlock | Optional | `1000` for non-streaming `20000` for streaming -Specifies if previous query results can be reused when the query is run. For parameter information, see ResultReuseByAgeConfiguration. +The default result fetcher downloads query results directly from Amazon S3 without going through the Athena API operations. When it detects situations where direct S3 download is not possible, it automatically falls back to using the `GetQueryResultsStream` API operation. For example, this happens when query results are encrypted with the `CSE_KMS` option. @@ -21,3 +21 @@ Specifies if previous query results can be reused when the query is run. For par -**Connection string name** | **Parameter type** | **Default value** | **Connection string example** ----|---|---|--- -EnableResultReuse | Optional | `0` | `EnableResultReuse=1;` +Using the `auto` fetcher is recommended in most situations. However, if your IAM policies, or S3 bucket policies use the `[s3:CalledVia](./security-iam-athena-calledvia.html)` condition to limit access to S3 objects to requests from Athena, the auto fetcher first attempts to download the results from S3 and then falls back to using the `GetQueryResultsStream`. In this situation, you might want to set the `ResultFetcher` to `GetQueryResultsStream` to avoid an extra API call. @@ -25 +23 @@ EnableResultReuse | Optional | `0` | `EnableResultReuse=1;` -## Result reuse maximum age +###### Note @@ -27 +25 @@ EnableResultReuse | Optional | `0` | `EnableResultReuse=1;` -Specifies, in minutes, the maximum age of a previous query result that Athena should consider for reuse. For parameter information, see [ResultReuseByAgeConfiguration](https://docs.aws.amazon.com/athena/latest/APIReference/API_ResultReuseByAgeConfiguration.html). +The driver still recognizes the Enable streaming API (`UseResultsetStreaming=1;`) and Enable S3 fetcher (`EnableS3Fetcher=1;`) parameters. However, we encourage you to use `ResultFetcher` parameter for better experience. @@ -29,3 +27,3 @@ Specifies, in minutes, the maximum age of a previous query result that Athena sh -**Connection string name** | **Parameter type** | **Default value** | **Connection string example** ----|---|---|--- -ReusedResultMaxAgeInMinutes | Optional | `60` | `ReusedResultMaxAgeInMinutes=90;` +**Connection string name** | **Parameter type** | **Default value** | **Possible values** | **Connection string example** +---|---|---|---|--- +ResultFetcher | Optional | `auto` | `auto`, `S3`, `GetQueryResults`, `GetQueryResultsStream` | `ResultFetcher=auto` @@ -33 +31 @@ ReusedResultMaxAgeInMinutes | Optional | `60` | `ReusedResultMaxAgeInMinutes=90; -## Enable streaming API +## Enable result reuse @@ -35 +33 @@ ReusedResultMaxAgeInMinutes | Optional | `60` | `ReusedResultMaxAgeInMinutes=90; -Chooses whether to use the Athena streaming API to fetch the result set. +Specifies if previous query results can be reused when the query is run. For parameter information, see ResultReuseByAgeConfiguration. @@ -39 +37 @@ Chooses whether to use the Athena streaming API to fetch the result set. -UseResultsetStreaming | Optional | `0` | `UseResultsetStreaming=1;` +EnableResultReuse | Optional | `0` | `EnableResultReuse=1;` @@ -41 +39 @@ UseResultsetStreaming | Optional | `0` | `UseResultsetStreaming=1;` -## Enable S3 fetcher +## Result reuse maximum age @@ -43 +41 @@ UseResultsetStreaming | Optional | `0` | `UseResultsetStreaming=1;` -Fetches the result set generated by Athena from the Amazon S3 bucket by interacting with Amazon S3 directly. +Specifies, in minutes, the maximum age of a previous query result that Athena should consider for reuse. For parameter information, see [ResultReuseByAgeConfiguration](https://docs.aws.amazon.com/athena/latest/APIReference/API_ResultReuseByAgeConfiguration.html). @@ -47 +45 @@ Fetches the result set generated by Athena from the Amazon S3 bucket by interact -EnableS3Fetcher | Optional | `1` | `EnableS3Fetcher=1;` +ReusedResultMaxAgeInMinutes | Optional | `60` | `ReusedResultMaxAgeInMinutes=90;`