AWS step-functions documentation change
Summary
Removed detailed API parameter documentation for Athena actions and added a note about AWS Lake Formation integration. Expanded IAM policy examples to include additional Athena permissions.
Security assessment
The change adds a security-related note about using AWS Lake Formation for data access control and expands IAM policies to include necessary Athena permissions. While this improves security documentation, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/step-functions/latest/dg/connect-athena.md b/step-functions/latest/dg/connect-athena.md index 834b6e6d1..8747d3f68 100644 --- a//step-functions/latest/dg/connect-athena.md +++ b//step-functions/latest/dg/connect-athena.md @@ -55,18 +54,0 @@ The following includes a Task state that starts an Athena query. - * [Request syntax](https://docs.aws.amazon.com/athena/latest/APIReference/API_StartQueryExecution.html#API_StartQueryExecution_RequestSyntax) - - * Supported parameters: - - * [`ClientRequestToken`](https://docs.aws.amazon.com/athena/latest/APIReference/API_StartQueryExecution.html#API_StartQueryExecution_RequestParameters) - - * [`ExecutionParameters`](https://docs.aws.amazon.com/athena/latest/APIReference/API_StartQueryExecution.html#athena-StartQueryExecution-request-ExecutionParameters) - - * [`QueryExecutionContext`](https://docs.aws.amazon.com/athena/latest/APIReference/API_StartQueryExecution.html#API_StartQueryExecution_RequestParameters) - - * [`QueryString`](https://docs.aws.amazon.com/athena/latest/APIReference/API_StartQueryExecution.html#API_StartQueryExecution_RequestParameters) - - * [`ResultConfiguration`](https://docs.aws.amazon.com/athena/latest/APIReference/API_StartQueryExecution.html#API_StartQueryExecution_RequestParameters) - - * [`WorkGroup`](https://docs.aws.amazon.com/athena/latest/APIReference/API_StartQueryExecution.html#API_StartQueryExecution_RequestParameters) - - * [`Response syntax`](https://docs.aws.amazon.com/athena/latest/APIReference/API_StartQueryExecution.html#API_StartQueryExecution_ResponseSyntax) - @@ -75,6 +56,0 @@ The following includes a Task state that starts an Athena query. - * [Request syntax](https://docs.aws.amazon.com/athena/latest/APIReference/API_StopQueryExecution.html#API_StopQueryExecution_RequestSyntax) - - * Supported parameters: - - * [`QueryExecutionId`](https://docs.aws.amazon.com/athena/latest/APIReference/API_StopQueryExecution.html#API_StopQueryExecution_RequestParameters) - @@ -83,8 +58,0 @@ The following includes a Task state that starts an Athena query. - * [Request syntax](https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryExecution.html#API_GetQueryExecution_RequestSyntax) - - * Supported parameters: - - * [`QueryExecutionId`](https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryExecution.html#API_GetQueryExecution_RequestParameters) - - * [`Response syntax`](https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryExecution.html#API_GetQueryExecution_ResponseSyntax) - @@ -93,12 +60,0 @@ The following includes a Task state that starts an Athena query. - * [Request syntax](https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryExecution.html#API_GetQueryExecution_RequestSyntax) - - * Supported parameters: - - * [`MaxResults`](https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryResults.html#API_GetQueryResults_RequestParameters) - - * [`NextToken`](https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryResults.html#API_GetQueryResults_RequestParameters) - - * [`QueryExecutionId`](https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryResults.html#API_GetQueryResults_RequestParameters) - - * [`Response syntax`](https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryResults.html#API_GetQueryResults_ResponseSyntax) - @@ -115,0 +72,4 @@ The following example templates show how AWS Step Functions generates IAM polici +###### Note + +In addition to IAM policies, you might need to use AWS Lake Formation to grant access to data in services, such as Amazon S3 and the AWS Glue Data Catalog. For more information, see [Use Athena to query data registered with AWS Lake Formation](https://docs.aws.amazon.com/athena/latest/ug/security-athena-lake-formation.html). + @@ -133 +93,5 @@ Run a Job (.sync) - "athena:getDataCatalog" + "athena:getDataCatalog", + "athena:GetWorkGroup", + "athena:BatchGetQueryExecution", + "athena:GetQueryResults", + "athena:ListQueryExecutions" @@ -289 +253,5 @@ Run a Job (.sync) - "athena:getDataCatalog" + "athena:getDataCatalog", + "athena:GetWorkGroup", + "athena:BatchGetQueryExecution", + "athena:GetQueryResults", + "athena:ListQueryExecutions"