AWS datazone documentation change
Summary
Replaced inline IAM policy JSON with a reference link to the AWS Managed Policy documentation
Security assessment
The change removes the explicit policy details and replaces them with a link to the canonical policy reference. This does not indicate a security vulnerability fix, but rather a documentation maintenance change to centralize policy references. No specific security weaknesses or incidents are mentioned in the diff.
Diff
diff --git a/datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneRedshiftGlueProvisioningPolicy.md b/datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneRedshiftGlueProvisioningPolicy.md index 7bebfef3e..16dd64dae 100644 --- a//datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneRedshiftGlueProvisioningPolicy.md +++ b//datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneRedshiftGlueProvisioningPolicy.md @@ -9,333 +9 @@ The AmazonDataZoneRedshiftGlueProvisioningPolicy policy grants Amazon DataZone t - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AmazonDataZonePermissionsToCreateEnvironmentRole", - "Effect": "Allow", - "Action": [ - "iam:CreateRole", - "iam:DetachRolePolicy", - "iam:DeleteRolePolicy", - "iam:AttachRolePolicy", - "iam:PutRolePolicy" - ], - "Resource": "arn:aws:iam::*:role/datazone*", - "Condition": { - "StringEquals": { - "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary", - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "IamPassRolePermissions", - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": [ - "arn:aws:iam::*:role/datazone*" - ], - "Condition": { - "StringEquals": { - "iam:PassedToService": [ - "glue.amazonaws.com", - "lakeformation.amazonaws.com" - ], - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "AmazonDataZonePermissionsToManageCreatedEnvironmentRole", - "Effect": "Allow", - "Action": [ - "iam:DeleteRole", - "iam:GetRole" - ], - "Resource": "arn:aws:iam::*:role/datazone*", - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "AmazonDataZoneCFStackCreationForEnvironments", - "Effect": "Allow", - "Action": [ - "cloudformation:CreateStack", - "cloudformation:TagResource" - ], - "Resource": [ - "arn:aws:cloudformation:*:*:stack/DataZone*" - ], - "Condition": { - "ForAnyValue:StringLike": { - "aws:TagKeys": "AmazonDataZoneEnvironment" - }, - "Null": { - "aws:ResourceTag/AmazonDataZoneEnvironment": "false" - } - } - }, - { - "Sid": "AmazonDataZoneCFStackManagementForEnvironments", - "Effect": "Allow", - "Action": [ - "cloudformation:DeleteStack", - "cloudformation:DescribeStacks", - "cloudformation:DescribeStackEvents" - ], - "Resource": [ - "arn:aws:cloudformation:*:*:stack/DataZone*" - ] - }, - { - "Sid": "AmazonDataZoneEnvironmentParameterValidation", - "Effect": "Allow", - "Action": [ - "lakeformation:GetDataLakeSettings", - "lakeformation:PutDataLakeSettings", - "lakeformation:RevokePermissions", - "lakeformation:ListPermissions", - "glue:CreateDatabase", - "glue:GetDatabase", - "athena:GetWorkGroup", - "logs:DescribeLogGroups", - "redshift-serverless:GetNamespace", - "redshift-serverless:GetWorkgroup", - "redshift:DescribeClusters", - "secretsmanager:ListSecrets" - ], - "Resource": "*" - }, - { - "Sid": "AmazonDataZoneEnvironmentLakeFormationPermissions", - "Effect": "Allow", - "Action": [ - "lakeformation:RegisterResource", - "lakeformation:DeregisterResource", - "lakeformation:GrantPermissions", - "lakeformation:ListResources" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "AmazonDataZoneEnvironmentGlueDeletePermissions", - "Effect": "Allow", - "Action": [ - "glue:DeleteDatabase" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "AmazonDataZoneEnvironmentAthenaDeletePermissions", - "Effect": "Allow", - "Action": [ - "athena:DeleteWorkGroup" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "AmazonDataZoneEnvironmentAthenaResourceCreation", - "Effect": "Allow", - "Action": [ - "athena:CreateWorkGroup", - "athena:TagResource", - "iam:TagRole", - "iam:TagPolicy", - "logs:TagLogGroup" - ], - "Resource": "*", - "Condition": { - "ForAnyValue:StringLike": { - "aws:TagKeys": "AmazonDataZoneEnvironment" - }, - "Null": { - "aws:ResourceTag/AmazonDataZoneEnvironment": "false" - }, - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "AmazonDataZoneEnvironmentLogGroupCreation", - "Effect": "Allow", - "Action": [ - "logs:CreateLogGroup", - "logs:DeleteLogGroup" - ], - "Resource": "arn:aws:logs:*:*:log-group:datazone-*", - "Condition": { - "ForAnyValue:StringLike": { - "aws:TagKeys": "AmazonDataZoneEnvironment"