AWS AmazonRDS documentation change
Summary
Updated documentation for AWS Glue catalog setup in SageMaker zero-ETL integration, including service-linked role requirements and permission configurations.
Security assessment
The changes clarify IAM role requirements (e.g., AWSServiceRoleForRedshift) and Lake Formation permissions, which are security-related configurations. However, there's no evidence this addresses a specific security vulnerability.
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/zero-etl.setting-up.md b/AmazonRDS/latest/AuroraUserGuide/zero-etl.setting-up.md index 25f240511..e322cdd0d 100644 --- a//AmazonRDS/latest/AuroraUserGuide/zero-etl.setting-up.md +++ b//AmazonRDS/latest/AuroraUserGuide/zero-etl.setting-up.md @@ -5 +5 @@ -Step 1: Create a custom DB cluster parameter groupStep 2: Select or create a source DB clusterStep 3a: Create a target data warehouseSet up an integration using the AWS SDKsStep 3b: Create a target Amazon SageMaker lakehouseNext steps +Step 1: Create a custom DB cluster parameter groupStep 2: Select or create a source DB clusterStep 3a: Create a target data warehouseSet up an integration using the AWS SDKsStep 3b: Create an AWS Glue catalog for Amazon SageMaker zero-ETL integrationNext steps @@ -551 +551 @@ Aurora PostgreSQL -## Step 3b: Create a target Amazon SageMaker lakehouse +## Step 3b: Create an AWS Glue catalog for Amazon SageMaker zero-ETL integration @@ -553 +553 @@ Aurora PostgreSQL -When creating a zero-ETL integration with an Amazon SageMaker lakehouse, you must target a AWS Glue catalog in AWS Lake Formation. +When creating a zero-ETL integration with an Amazon SageMaker lakehouse, you must create an AWS Glue managed catalog in AWS Lake Formation. The target catalog must be an Amazon Redshift managed catalog. To create an Amazon Redshift managed catalog, first create the `AWSServiceRoleForRedshift` service-linked role. In the Lake Formation console, add the `AWSServiceRoleForRedshift` as a read-only administrator. @@ -555 +555,3 @@ When creating a zero-ETL integration with an Amazon SageMaker lakehouse, you mus -### Configure permissions for the target AWS Glue catalog +For more information about the previous tasks, see the following topics. + + * For information about creating an Amazon Redshift managed catalog, see [Creating an Amazon Redshift managed catalog in the AWS Glue Data Catalog](https://docs.aws.amazon.com/lake-formation/latest/dg/create-rms-catalog.html) in the _AWS Lake Formation Developer Guide_. @@ -557 +559 @@ When creating a zero-ETL integration with an Amazon SageMaker lakehouse, you mus -To enable zero-ETL integration for a catalog, you need to configure the following permissions: + * For information about the service-linked role for Amazon Redshift, see [Using service-linked roles for Amazon Redshift](https://docs.aws.amazon.com/redshift/latest/mgmt/using-service-linked-roles.html) in the _Amazon Redshift Management Guide_. @@ -559 +561 @@ To enable zero-ETL integration for a catalog, you need to configure the followin - * AWS Lake Formation administrator role + * For information about read-only administrator permissions for Lake Formation, see [Lake Formation personas and IAM permissions reference](https://docs.aws.amazon.com/lake-formation/latest/dg/permissions-reference.html) in the _AWS Lake Formation Developer Guide_. @@ -561 +562,0 @@ To enable zero-ETL integration for a catalog, you need to configure the followin - * Glue role for data transfer @@ -564,0 +566,3 @@ To enable zero-ETL integration for a catalog, you need to configure the followin +### Configure permissions for the target AWS Glue catalog + +Before creating a target catalog for zero-ETL integration, you must create the Lake Formation target creation role and the AWS Glue data transfer role. Use the Lake Formation target creation role to create the target catalog. When creating the target catalog, enter the Glue data transfer role in the **IAM role** field in the **Access from engines section**. @@ -566 +570 @@ To enable zero-ETL integration for a catalog, you need to configure the followin -The target creation role must be a Lake Formation administrator and requires the following permissions: +The target creation role must be a Lake Formation administrator and requires the following permissions. @@ -607 +611 @@ The target creation role must be a Lake Formation administrator and requires the -The target creation role must have the following trust relationship: +The target creation role must have the following trust relationship. @@ -623 +627 @@ The target creation role must have the following trust relationship: - "AWS": "arn:aws:sts::account-id:assumed-role/Role" + "AWS": "arn:aws:iam::account-id:user/Username" @@ -630 +634 @@ The target creation role must have the following trust relationship: -The Glue data transfer role (GlueDataCatalogDataTransferRole) is required for MySQL catalog operations and must have the following permissions: +The Glue data transfer role is required for MySQL catalog operations and must have the following permissions. @@ -652 +656 @@ The Glue data transfer role (GlueDataCatalogDataTransferRole) is required for My -The Glue data transfer role must have the following trust relationship: +The Glue data transfer role must have the following trust relationship.