AWS athena medium security documentation change
Summary
Added Glue connection configuration guidance and security notes about Secrets Manager requirements
Security assessment
Introduces a mandatory requirement to use AWS Secrets Manager for credentials with Glue connections, mitigating risks associated with unsecured credential storage methods.
Diff
diff --git a/athena/latest/ug/connectors-cloudwatch.md b/athena/latest/ug/connectors-cloudwatch.md index 23ebd5c9e..bdb18927d 100644 --- a//athena/latest/ug/connectors-cloudwatch.md +++ b//athena/latest/ug/connectors-cloudwatch.md @@ -25,0 +26,27 @@ Use the parameters in this section to configure the CloudWatch connector. +We recommend that you configure a CloudWatch connector by using a Glue connections object. To do this, set the `glue_connection` environment variable of the CloudWatch connector Lambda to the name of the Glue connection to use. + +**Glue connections properties** + +Use the following command to get the schema for a Glue connection object. This schema contains all the parameters that you can use to control your connection. + + + aws glue describe-connection-type --connection-type CLOUDWATCH + +**Lambda environment properties** + + * glue_connection – Specifies the name of the Glue connection associated with the federated connector. + + + + +###### Note + + * All connectors that use Glue connections must use AWS Secrets Manager to store credentials. + + * The CloudWatch connector created using Glue connections does not support the use of a multiplexing handler. + + * The CloudWatch connector created using Glue connections only supports `ConnectionSchemaVersion` 2. + + + +