AWS athena medium security documentation change

Service: athena · 2025-08-16 · Security-related medium

File: athena/latest/ug/connectors-cloudera-impala.md

Summary

Added Glue connection configuration guidance, casing_mode parameter documentation, and security notes about Secrets Manager requirements

Security assessment

The documentation now requires AWS Secrets Manager for credentials with Glue connections, enforcing secure credential storage. This directly addresses potential exposure risks from insecure credential handling.

Diff

diff --git a/athena/latest/ug/connectors-cloudera-impala.md b/athena/latest/ug/connectors-cloudera-impala.md
index e0ceb8da3..b4fe50951 100644
--- a//athena/latest/ug/connectors-cloudera-impala.md
+++ b//athena/latest/ug/connectors-cloudera-impala.md
@@ -62 +62,36 @@ Use the parameters in this section to configure the Cloudera Impala connector.
-### Connection string
+We recommend that you configure a Cloudera Impala connector by using a Glue connections object. To do this, set the `glue_connection` environment variable of the Cloudera Impala connector Lambda to the name of the Glue connection to use.
+
+**Glue connections properties**
+
+Use the following command to get the schema for a Glue connection object. This schema contains all the parameters that you can use to control your connection.
+    
+    
+    aws glue describe-connection-type --connection-type CLOUDERAIMPALA
+
+**Lambda environment properties**
+
+  * glue_connection – Specifies the name of the Glue connection associated with the federated connector. 
+
+  * **casing_mode** – (Optional) Specifies how to handle casing for schema and table names. The `casing_mode` parameter uses the following values to specify the behavior of casing:
+
+    * **none** – Do not change case of the given schema and table names. This is the default for connectors that have an associated glue connection. 
+
+    * **upper** – Upper case all given schema and table names.
+
+    * **lower** – Lower case all given schema and table names.
+
+
+
+
+###### Note
+
+  * All connectors that use Glue connections must use AWS Secrets Manager to store credentials.
+
+  * The Cloudera Impala connector created using Glue connections does not support the use of a multiplexing handler.
+
+  * The Cloudera Impala connector created using Glue connections only supports `ConnectionSchemaVersion` 2.
+
+
+
+
+#### Connection string
@@ -69 +104 @@ Use a JDBC connection string in the following format to connect to an Impala clu
-### Using a multiplexing handler
+#### Using a multiplexing handler
@@ -79 +114 @@ Record handler | `ImpalaMuxRecordHandler`
-#### Multiplexing handler parameters
+##### Multiplexing handler parameters
@@ -94 +129 @@ Property | Value
-#### Providing credentials
+##### Providing credentials
@@ -129 +164 @@ Currently, Cloudera Impala recognizes the `UID` and `PWD` JDBC properties.
-### Using a single connection handler
+#### Using a single connection handler
@@ -139 +174 @@ Record handler | `ImpalaRecordHandler`
-#### Single connection handler parameters
+##### Single connection handler parameters
@@ -153 +188 @@ Property | Value
-### Spill parameters
+#### Spill parameters