AWS firehose documentation change

Service: firehose · 2025-07-18 · Documentation medium

File: firehose/latest/dev/apache-iceberg-considerations.md

Summary

Added encryption guidance specifying KMS parameters must be configured in S3 Tables rather than Firehose. Added concurrency warnings and library version details.

Security assessment

Explicitly documents security-relevant encryption configuration requirements, though no specific vulnerability is addressed. Clarifies secure implementation practices for data encryption.

Diff

diff --git a/firehose/latest/dev/apache-iceberg-considerations.md b/firehose/latest/dev/apache-iceberg-considerations.md
index 829fb36a4..1588a052e 100644
--- a//firehose/latest/dev/apache-iceberg-considerations.md
+++ b//firehose/latest/dev/apache-iceberg-considerations.md
@@ -47,0 +48,6 @@ Besides compaction of data files, you can also optimize storage consumption with
+  * Firehose does not recommend using multiple Firehose streams to write data to the same Apache Iceberg table. This is because Apache Iceberg relies on [Optimistic Concurrency Control (OCC)](https://iceberg.apache.org/docs/1.6.0/reliability/#concurrent-write-operations). If multiple Firehose streams attempt to write to a single Iceberg table concurrently, then only one stream is succeed in committing the data at a given time. The other streams that fail to commit back-off, and retry the commit operation until the configured retry duration expires. Once the retry duration is exhausted, the data and delete file keys (Amazon S3 paths) are sent to the configured Amazon S3 error prefix.
+
+  * The current Iceberg Library version that Firehose supports is version 1.5.2.
+
+  * For delivering encrypted data to Amazon S3 Tables, you should configure AWS Key Management Service parameters in Amazon S3 Tables, and not in the Firehose configuration. If you configure AWS Key Management Service parameters in Firehose for delivering encrypted data to Amazon S3 Tables, then Firehose cannot use those parameters to encrypt. For more information, see [Using server-side encryption with AWS KMS keys](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-kms-encryption.html).
+