AWS athena high security documentation change
Summary
Added section 'Verify the ODBC driver signature' with steps to validate RPM package integrity using OpenSSL
Security assessment
The change introduces verification of driver signatures to prevent tampering. Explicit instructions for cryptographic verification directly address supply chain security risks.
Diff
diff --git a/athena/latest/ug/odbc-v2-driver-getting-started-linux.md b/athena/latest/ug/odbc-v2-driver-getting-started-linux.md index 1b43fc226..c9abe0458 100644 --- a//athena/latest/ug/odbc-v2-driver-getting-started-linux.md +++ b//athena/latest/ug/odbc-v2-driver-getting-started-linux.md @@ -5 +5 @@ -Linux system requirementsInstalling the ODBC data connector on LinuxConfiguring a data source name on Linux +Linux system requirementsInstalling the ODBC data connector on LinuxConfiguring a data source name on LinuxVerify the ODBC driver signature @@ -150,0 +151,31 @@ Sample output +## Verify the ODBC driver signature + +###### Important + +We recommend verifying the Athena ODBC driver RPM signature before installing it on your machine. + +Follow these steps to verify the signature of the Athena ODBC driver RPM package: + + 1. **Prepare the templates** + +Prepare the commands with appropriate public key, RPM signature, and the corresponding access link to the RPM scripts hosted in Amazon S3 buckets. You must download the following to your device. + + * [Athena ODBC driver](https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.0.4.0/Linux/AmazonAthenaODBC-2.0.4.0.rpm) + + * [Public Key](https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.0.4.0/Linux/public_key.pem) + + * [Athena ODBC RPM signature](https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.0.4.0/Linux/signature.bin) + + 2. Download the Athena ODBC driver, public key, and Athena ODBC RPM signature to your device. + + 3. Run the following command to verify ODBC driver signature: + + openssl dgst -sha256 -verify public_key.pem -signature signature.bin AmazonAthenaODBC-2.0.4.0.rpm + +If verification passes, you will see a message similar to `Verified OK`. This means you can now proceed to install the Athena ODBC driver. + +If it fails with a message `Verification Failure`, it means that the signature on RPM has been tampered. Ensure that all the three files mentioned in step 1 are present, the paths are correctly specified ,and the files haven't been modified since download and then retry the verification process. + + + +