AWS redshift documentation change
Summary
Removed detailed IAM policy for EC2 network interfaces and simplified VPC routing guidance
Security assessment
Adjusts IAM permissions and emphasizes secure VPC routing practices, improving security documentation. However, no explicit evidence of addressing a specific vulnerability.
Diff
diff --git a/redshift/latest/dg/getting-started-machine-learning.md b/redshift/latest/dg/getting-started-machine-learning.md index 6b0142fda..b5c91543e 100644 --- a//redshift/latest/dg/getting-started-machine-learning.md +++ b//redshift/latest/dg/getting-started-machine-learning.md @@ -48,20 +47,0 @@ When an IAM role is created as the default for your cluster, include `redshift` -If your cluster has enhanced Amazon VPC routing turned on, you can use an IAM role created through the Amazon Redshift console. This IAM role has the `AmazonRedshiftAllCommandsFullAccess` policy attached and adds the following permissions to the policy. These additional permissions allow Amazon Redshift to create and delete an elastic network interface (ENI) in your account and attach it to compilation tasks running on Amazon EC2 or Amazon ECS. Doing this enables objects in your Amazon S3 buckets to be accessed only from within a virtual private cloud (VPC) with internet access blocked. - - { - "Effect": "Allow", - "Action": [ - "ec2:DescribeVpcEndpoints", - "ec2:DescribeDhcpOptions", - "ec2:DescribeVpcs", - "ec2:DescribeSubnets", - "ec2:DescribeSecurityGroups", - "ec2:DescribeNetworkInterfaces", - "ec2:DeleteNetworkInterfacePermission", - "ec2:DeleteNetworkInterface", - "ec2:CreateNetworkInterfacePermission", - "ec2:CreateNetworkInterface", - "ec2:ModifyNetworkInterfaceAttribute" - ], - "Resource": "*" - } - @@ -195,7 +175 @@ JSON - 6. (Optional) When you turn on VPC routing for your Redshift cluster, create the following: - - * An Amazon S3 endpoint or the VPC that your Redshift cluster is in - - * A SageMaker AI endpoint or an Amazon Bedrock VPC endpoint - -Doing this makes it possible for traffic to run through your VPC between services during CREATE MODEL. For more information about VPC routing, see [Enhanced VPC routing in Amazon Redshift](https://docs.aws.amazon.com/redshift/latest/mgmt/enhanced-vpc-routing.html). + 6. When you turn on enhanced VPC routing, traffic between Redshift ML and your S3 bucket goes through your private VPC. For more information about VPC routing, see [Enhanced VPC routing in Amazon Redshift](https://docs.aws.amazon.com/redshift/latest/mgmt/enhanced-vpc-routing.html).