AWS AmazonRDS documentation change
Summary
Updated documentation for AWS Glue catalog setup in zero-ETL integration, including role requirements and permissions configuration.
Security assessment
The changes clarify IAM role configurations (e.g., AWSServiceRoleForRedshift, read-only administrator permissions) and security best practices for AWS Glue/Lake Formation integration. While these are security-related configurations, there's no evidence of addressing a specific vulnerability or incident. The updates improve security documentation but don't reference a patched issue.
Diff
diff --git a/AmazonRDS/latest/UserGuide/zero-etl.setting-up.md b/AmazonRDS/latest/UserGuide/zero-etl.setting-up.md index dc0b37796..8261caf6e 100644 --- a//AmazonRDS/latest/UserGuide/zero-etl.setting-up.md +++ b//AmazonRDS/latest/UserGuide/zero-etl.setting-up.md @@ -5 +5 @@ -Step 1: Create a custom DB parameter groupStep 2: Select or create a source databaseStep 3a: Create a target data warehouseSet up an integration using the AWS SDKsStep 3b: Create a target Amazon SageMaker lakehouseNext steps +Step 1: Create a custom DB parameter groupStep 2: Select or create a source databaseStep 3a: Create a target data warehouseSet up an integration using the AWS SDKsStep 3b: Create an AWS Glue catalog for Amazon SageMaker zero-ETL integrationNext steps @@ -288 +288 @@ Within the script, optionally modify the names of the source, target, and parame -## Step 3b: Create a target Amazon SageMaker lakehouse +## Step 3b: Create an AWS Glue catalog for Amazon SageMaker zero-ETL integration @@ -290 +290 @@ Within the script, optionally modify the names of the source, target, and parame -When creating a zero-ETL integration with an Amazon SageMaker lakehouse, you must target a AWS Glue catalog in AWS Lake Formation. +When creating a zero-ETL integration with an Amazon SageMaker lakehouse, you must create an AWS Glue managed catalog in AWS Lake Formation. The target catalog must be an Amazon Redshift managed catalog. To create an Amazon Redshift managed catalog, first create the `AWSServiceRoleForRedshift` service-linked role. In the Lake Formation console, add the `AWSServiceRoleForRedshift` as a read-only administrator. @@ -292 +292,3 @@ When creating a zero-ETL integration with an Amazon SageMaker lakehouse, you mus -### Configure permissions for the target AWS Glue catalog +For more information about the previous tasks, see the following topics. + + * For information about creating an Amazon Redshift managed catalog, see [Creating an Amazon Redshift managed catalog in the AWS Glue Data Catalog](https://docs.aws.amazon.com/lake-formation/latest/dg/create-rms-catalog.html) in the _AWS Lake Formation Developer Guide_. @@ -294 +296 @@ When creating a zero-ETL integration with an Amazon SageMaker lakehouse, you mus -To enable zero-ETL integration for a catalog, you need to configure the following permissions: + * For information about the service-linked role for Amazon Redshift, see [Using service-linked roles for Amazon Redshift](https://docs.aws.amazon.com/redshift/latest/mgmt/using-service-linked-roles.html) in the _Amazon Redshift Management Guide_. @@ -296 +298 @@ To enable zero-ETL integration for a catalog, you need to configure the followin - * AWS Lake Formation administrator role + * For information about read-only administrator permissions for Lake Formation, see [Lake Formation personas and IAM permissions reference](https://docs.aws.amazon.com/lake-formation/latest/dg/permissions-reference.html) in the _AWS Lake Formation Developer Guide_. @@ -298 +299,0 @@ To enable zero-ETL integration for a catalog, you need to configure the followin - * Glue role for data transfer @@ -301,0 +303,3 @@ To enable zero-ETL integration for a catalog, you need to configure the followin +### Configure permissions for the target AWS Glue catalog + +Before creating a target catalog for zero-ETL integration, you must create the Lake Formation target creation role and the AWS Glue data transfer role. Use the Lake Formation target creation role to create the target catalog. When creating the target catalog, enter the Glue data transfer role in the **IAM role** field in the **Access from engines section**. @@ -303 +307 @@ To enable zero-ETL integration for a catalog, you need to configure the followin -The target creation role must be a Lake Formation administrator and requires the following permissions: +The target creation role must be a Lake Formation administrator and requires the following permissions. @@ -344 +348 @@ The target creation role must be a Lake Formation administrator and requires the -The target creation role must have the following trust relationship: +The target creation role must have the following trust relationship. @@ -360 +364 @@ The target creation role must have the following trust relationship: - "AWS": "arn:aws:sts::account-id:assumed-role/Role" + "AWS": "arn:aws:iam::account-id:user/Username" @@ -367 +371 @@ The target creation role must have the following trust relationship: -The Glue data transfer role (GlueDataCatalogDataTransferRole) is required for MySQL catalog operations and must have the following permissions: +The Glue data transfer role is required for MySQL catalog operations and must have the following permissions. @@ -389 +393 @@ The Glue data transfer role (GlueDataCatalogDataTransferRole) is required for My -The Glue data transfer role must have the following trust relationship: +The Glue data transfer role must have the following trust relationship.