AWS athena medium security documentation change

Service: athena · 2025-08-13 · Security-related medium

File: athena/latest/ug/connectors-docdb.md

Summary

Added documentation for configuring DocumentDB connector using Glue connections with Secrets Manager requirement, metadata retrieval configuration, and connection schema constraints

Security assessment

The change mandates AWS Secrets Manager for credential storage in Glue connections and adds security constraints (no multiplexing handler, specific schema version). This directly addresses credential management security best practices.

Diff

diff --git a/athena/latest/ug/connectors-docdb.md b/athena/latest/ug/connectors-docdb.md
index e35b4797f..af85fdea1 100644
--- a//athena/latest/ug/connectors-docdb.md
+++ b//athena/latest/ug/connectors-docdb.md
@@ -5 +5 @@
-PrerequisitesParametersSetting up databases and tables in AWS GlueData type supportRequired PermissionsPerformancePassthrough queriesAdditional resources
+PrerequisitesParametersRetrieving supplemental metadataSetting up databases and tables in AWS GlueData type supportRequired PermissionsPerformancePassthrough queriesAdditional resources
@@ -39,0 +40,27 @@ The parameter names and definitions listed below are for Athena data source conn
+We recommend that you configure a DocumentDB connector by using a Glue connections object. To do this, set the `glue_connection` environment variable of the DocumentDB connector Lambda to the name of the Glue connection to use.
+
+**Glue connections properties**
+
+Use the following command to get the schema for a Glue connection object. This schema contains all the parameters that you can use to control your connection.
+    
+    
+    aws glue describe-connection-type --connection-type DOCUMENTDB
+
+**Lambda environment properties**
+
+  * glue_connection – Specifies the name of the Glue connection associated with the federated connector.
+
+
+
+
+###### Note
+
+  * All connectors that use Glue connections must use AWS Secrets Manager to store credentials.
+
+  * The DocumentDB connector created using Glue connections does not support the use of a multiplexing handler.
+
+  * The DocumentDB connector created using Glue connections only supports `ConnectionSchemaVersion` 2.
+
+
+
+
@@ -71 +98 @@ The parameter names and definitions listed below are for Athena data source conn
-### Specifying connection strings
+#### Specifying connection strings
@@ -86 +113 @@ Before you can use these two SQL statements, you must add two environment variab
-#### Using secrets
+##### Using secrets
@@ -100,0 +128,41 @@ The Athena Query Federation SDK automatically attempts to retrieve a secret name
+## Retrieving supplemental metadata
+
+To retrieve supplemental metadata, follow these steps to configure your Glue database and table.
+
+### Set up the Glue database
+
+  1. Create a Glue database with the same name as your DocumentDB collection.
+
+  2. In the Location URI field, enter `docdb-metadata-flag`.
+
+
+
+
+### Configure the Glue table
+
+Add the following parameters to your Glue table:
+
+  * `docdb-metadata-flag = true`
+
+  * `columnMapping = apple=APPLE`
+
+In this example, `apple` represents the lowercase column name in Glue, and `APPLE` represents the actual case-sensitive column name in your DocumentDB collection.
+
+
+
+
+### Verify metadata retrieval
+
+  1. Run your query.
+
+  2. Check the Lambda function's CloudWatch logs for successful metadata retrieval. A successful retrieval will show the following log entry:
+    
+        doGetTable: Retrieved schema for table[TableName{schemaName=test, tableName=profiles}] from AWS Glue.
+
+
+
+
+###### Note
+
+If your table already has a `columnMapping` field configured, you only need to add the `docdb-metadata-flag = true` parameter to the table properties.
+