AWS athena high security documentation change

Service: athena · 2025-08-13 · Security-related high

File: athena/latest/ug/connectors-adls-gen2.md

Summary

Added documentation about configuring Azure Data Lake Storage Gen2 connector using Glue connections, introduced casing_mode parameter, and security requirements for credentials storage

Security assessment

The change explicitly mandates use of AWS Secrets Manager for credential storage ('All connectors that use Glue connections must use AWS Secrets Manager to store credentials'), which is a security best practice. This directly addresses credential management security concerns.

Diff

diff --git a/athena/latest/ug/connectors-adls-gen2.md b/athena/latest/ug/connectors-adls-gen2.md
index 2ec7b8771..bbdcec9f0 100644
--- a//athena/latest/ug/connectors-adls-gen2.md
+++ b//athena/latest/ug/connectors-adls-gen2.md
@@ -77 +77,36 @@ The parameter names and definitions listed below are for Athena data source conn
-### Connection string
+We recommend that you configure a Azure Data Lake Storage Gen2 connector by using a Glue connections object. To do this, set the `glue_connection` environment variable of the Azure Data Lake Storage Gen2 connector Lambda to the name of the Glue connection to use.
+
+**Glue connections properties**
+
+Use the following command to get the schema for a Glue connection object. This schema contains all the parameters that you can use to control your connection.
+    
+    
+    aws glue describe-connection-type --connection-type DATALAKEGEN2
+
+**Lambda environment properties**
+
+  * glue_connection – Specifies the name of the Glue connection associated with the federated connector. 
+
+  * **casing_mode** – (Optional) Specifies how to handle casing for schema and table names. The `casing_mode` parameter uses the following values to specify the behavior of casing:
+
+    * **none** – Do not change case of the given schema and table names. This is the default for connectors that have an associated glue connection. 
+
+    * **upper** – Upper case all given schema and table names.
+
+    * **lower** – Lower case all given schema and table names.
+
+
+
+
+###### Note
+
+  * All connectors that use Glue connections must use AWS Secrets Manager to store credentials.
+
+  * The Azure Data Lake Storage Gen2 connector created using Glue connections does not support the use of a multiplexing handler.
+
+  * The Azure Data Lake Storage Gen2 connector created using Glue connections only supports `ConnectionSchemaVersion` 2.
+
+
+
+
+#### Connection string
@@ -84 +119 @@ Use a JDBC connection string in the following format to connect to a database in
-### Using a multiplexing handler
+#### Using a multiplexing handler
@@ -94 +129 @@ Record handler | `DataLakeGen2MuxRecordHandler`
-#### Multiplexing handler parameters
+##### Multiplexing handler parameters
@@ -109 +144 @@ Property | Value
-#### Providing credentials
+##### Providing credentials
@@ -142 +177 @@ The connector uses the secret name to retrieve secrets and provide the user name
-### Using a single connection handler
+#### Using a single connection handler
@@ -152 +187 @@ Record handler | `DataLakeGen2RecordHandler`
-#### Single connection handler parameters
+##### Single connection handler parameters
@@ -166 +201 @@ Property | Value
-### Spill parameters
+#### Spill parameters