AWS athena high security documentation change
Summary
Added documentation recommending Glue connections configuration with AWS Secrets Manager for credentials, and notes about multiplexing handler limitations and schema version support.
Security assessment
The change explicitly mandates the use of AWS Secrets Manager for credential storage, which is a security best practice. This addresses potential insecure credential handling by enforcing secure storage. The note about credentials being stored in Secrets Manager provides direct evidence of security-related improvements.
Diff
diff --git a/athena/latest/ug/connectors-cwmetrics.md b/athena/latest/ug/connectors-cwmetrics.md index 66703acd0..64127f797 100644 --- a//athena/latest/ug/connectors-cwmetrics.md +++ b//athena/latest/ug/connectors-cwmetrics.md @@ -25,0 +26,27 @@ Use the parameters in this section to configure the CloudWatch Metrics connector +We recommend that you configure a CloudWatch Metrics connector by using a Glue connections object. To do this, set the `glue_connection` environment variable of the CloudWatch Metrics connector Lambda to the name of the Glue connection to use. + +**Glue connections properties** + +Use the following command to get the schema for a Glue connection object. This schema contains all the parameters that you can use to control your connection. + + + aws glue describe-connection-type --connection-type CLOUDWATCHMETRICS + +**Lambda environment properties** + + * glue_connection – Specifies the name of the Glue connection associated with the federated connector. + + + + +###### Note + + * All connectors that use Glue connections must use AWS Secrets Manager to store credentials. + + * The CloudWatch Metrics connector created using Glue connections does not support the use of a multiplexing handler. + + * The CloudWatch Metrics connector created using Glue connections only supports `ConnectionSchemaVersion` 2. + + + +