AWS athena high security documentation change

Service: athena · 2025-08-16 · Security-related high

File: athena/latest/ug/athena-catalog-access.md

Summary

Restructured IAM permissions with resource constraints

Security assessment

Added resource ARN restrictions to IAM policies, reducing over-permissive access by implementing principle of least privilege. This directly addresses potential privilege escalation risks from broad resource wildcards.

Diff

diff --git a/athena/latest/ug/athena-catalog-access.md b/athena/latest/ug/athena-catalog-access.md
index 87ed9ea9a..ab92977bd 100644
--- a//athena/latest/ug/athena-catalog-access.md
+++ b//athena/latest/ug/athena-catalog-access.md
@@ -52,15 +51,0 @@ JSON
-            "iam:AttachRolePolicy",
-            "iam:DetachRolePolicy",
-            "iam:DeleteRolePolicy",
-            "iam:PutRolePolicy",
-            "iam:GetRolePolicy",
-            "iam:CreateRole",
-            "iam:TagRole",
-            "iam:DeleteRole",
-            "iam:GetRole",
-            "iam:PassRole",
-            "iam:ListRoles",
-            "iam:ListAttachedRolePolicies",
-            "iam:ListRolePolicies",
-            "iam:GetPolicy",
-            "iam:UpdateRole",
@@ -93,0 +79,24 @@ JSON
+      },
+      {
+      "Effect": "Allow",
+      "Action": [
+      "iam:AttachRolePolicy",
+      "iam:DetachRolePolicy",
+      "iam:DeleteRolePolicy",
+      "iam:PutRolePolicy",
+      "iam:GetRolePolicy",
+      "iam:CreateRole",
+      "iam:TagRole",
+      "iam:DeleteRole",
+      "iam:GetRole",
+      "iam:PassRole",
+      "iam:ListRoles",
+      "iam:ListAttachedRolePolicies",
+      "iam:ListRolePolicies",
+      "iam:GetPolicy",
+      "iam:UpdateRole"
+      ],
+      "Resource": [
+      "arn:aws:iam::*:role/RoleName",
+      "arn:aws:iam::111122223333:policy/*"
+      ]