AWS redshift low security documentation change
Summary
Removed standalone 'Secure logging' section and added a consolidated note about metadata masking in query logs with a link to secure logging documentation
Security assessment
The change explicitly documents metadata masking in system logs when using AWS Glue Data Catalog views, which prevents sensitive information exposure in logs. While it removes redundant details, it adds a security-focused explanation and reference. This constitutes security documentation rather than addressing a specific vulnerability.
Diff
diff --git a/redshift/latest/dg/data-catalog-views-overview.md b/redshift/latest/dg/data-catalog-views-overview.md index eb96ed488..c9b612845 100644 --- a//redshift/latest/dg/data-catalog-views-overview.md +++ b//redshift/latest/dg/data-catalog-views-overview.md @@ -5 +5 @@ -PrerequisitesEnd-to-end exampleSecure loggingConsiderations +PrerequisitesEnd-to-end exampleConsiderations @@ -29,0 +30,2 @@ Definitions of Data Catalog views are stored in the AWS Glue Data Catalog. Use A +When you use Amazon Redshift to run a query referencing such AWS Glue Data Catalog views, Amazon Redshift automatically masks fields in certain system table and view columns when logging metadata about that query. For more information, see [ Secure logging](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing-secure-logging.html) in the _Amazon Redshift Management Guide_. + @@ -142,73 +143,0 @@ For more information about the SQL commands related to views in the Data Catalog -## Secure logging - -Redshift masks metadata logged in the Redshift system logs when a query references a multi-dialect glue view. Multi-dialect means that the view supports the SQL dialects of different query engines, such as Redshift and Amazon EMR. Data in the following tables is masked for all queries with the same query id. The following table lists system views and columns with secure logging applied. - -System table | Sensitive columns ----|--- -SYS_EXTERNAL_QUERY_DETAIL | **Columns:** source_type, total_partitions, qualified_partitions, scanned_files, returned_rows, returned_bytes, file_format, file_location, external_query_text, warning_message. For more information, see [SYS_EXTERNAL_QUERY_DETAIL](./SYS_EXTERNAL_QUERY_DETAIL.html). -SYS_EXTERNAL_QUERY_ERROR | **Columns:** file_location, rowid, column_name, original_value, modified_value, trigger, action, action_value, error_code. For more information, see [SYS_EXTERNAL_QUERY_ERROR](./SYS_EXTERNAL_QUERY_ERROR.html). -SYS_QUERY_DETAIL | **Columns:** step_name, table_id, table_name, input_bytes, input_rows, output_bytes, output_rows, blocks_read, blocks_write, local_read_IO, remote_read_IO, spilled_block_local_disk, spilled_block_remote_disk. For more information, see [SYS_QUERY_DETAIL](./SYS_QUERY_DETAIL.html). -SYS_QUERY_HISTORY | **Columns:** returned_rows, returned_bytes. For more information, see [SYS_QUERY_HISTORY](./SYS_QUERY_HISTORY.html). -STL_AGGR | **Columns:** rows, bytes, tbl, type. For more information, see [STL_AGGR](./r_STL_AGGR.html). -STL_BCAST | **Columns:** rows, bytes, packets. For more information, see [STL_BCAST](./r_STL_BCAST.html). -STL_DDLTEXT | **Columns:** text. For more information, see [STL_DDLTEXT](./r_STL_DDLTEXT.html). -STL_DELETE | **Columns:** rows, tbl. For more information, see [STL_DELETE](./r_STL_DELETE.html). -STL_DIST | **Columns:** rows, bytes, packets. For more information, see [STL_DIST](./r_STL_DIST.html). -STL_EXPLAIN | **Columns:** plannode, info. For more information, see [STL_EXPLAIN](./r_STL_EXPLAIN.html). -STL_HASH | **Columns:** rows, bytes, tbl, est_rows. For more information, see [STL_HASH](./r_STL_HASH.html). -STL_HASHJOIN | **Columns:** rows, tbl, num_parts, join_type. For more information, see [STL_HASHJOIN](./r_STL_HASHJOIN.html). -STL_INSERT | **Columns:** rows, tbl. For more information, see [STL_INSERT](./r_STL_INSERT.html). -STL_LIMIT | **Columns:** rows. For more information, see [STL_LIMIT](./r_STL_LIMIT.html). -STL_MERGE | **Columns:** rows. For more information, see [STL_MERGE](./r_STL_MERGE.html). -STL_MERGEJOIN | **Columns:** rows, tbl. For more information, see [STL_MERGEJOIN](./r_STL_MERGEJOIN.html). -STL_NESTLOOP | **Columns:** rows, tbl. For more information, see [STL_NESTLOOP](./r_STL_NESTLOOP.html). -STL_PARSE | **Columns:** rows. For more information, see [STL_PARSE](./r_STL_PARSE.html). -STL_PLAN_INFO | **Columns:** rows, bytes. For more information, see [STL_PLAN_INFO](./r_STL_PLAN_INFO.html). -STL_PROJECT | **Columns:** rows, tbl. For more information, see [STL_PROJECT](./r_STL_PROJECT.html). -STL_QUERY | **Columns:** querytxt. For more information, see [STL_QUERY](./r_STL_QUERY.html). -STL_QUERY_METRICS | **Columns:** max_rows, rows, max_blocks_read, blocks_read, max_blocks_to_disk, blocks_to_disk, max_query_scan_size, query_scan_size. For more information, see [STL_QUERY_METRICS](./r_STL_QUERY_METRICS.html). -STL_QUERYTEXT | **Columns:** text. For more information, see [STL_QUERYTEXT](./r_STL_QUERYTEXT.html). -STL_RETURN | **Columns:** rows, bytes. For more information, see [STL_RETURN](./r_STL_RETURN.html). -STL_SAVE | **Columns:** rows, bytes, tbl. For more information, see [STL_SAVE](./r_STL_SAVE.html). -STL_SCAN | **Columns:** rows, bytes, fetches, type, tbl, rows_pre_filter, perm_table_name, scanned_mega_value. For more information, see [STL_SCAN](./r_STL_SCAN.html). -STL_SORT | **Columns:** rows, bytes, tbl. For more information, see [STL_SORT](./r_STL_SORT.html). -STL_TR_CONFLICT | **Columns:** table_id. For more information, see [STL_TR_CONFLICT](./r_STL_TR_CONFLICT.html). -STL_UNDONE | **Columns:** table_id. For more information, see [STL_UNDONE](./r_STL_UNDONE.html). -STL_UNIQUE | **Columns:** rows, type, bytes. For more information, see [STL_UNIQUE](./r_STL_UNIQUE.html). -STL_UTILITYTEXT | **Columns:** text. For more information, see [STL_UTILITYTEXT](./r_STL_UTILITYTEXT.html). -STL_WINDOW | **Columns:** rows. For more information, see [STL_WINDOW](./r_STL_WINDOW.html). -STV_BLOCKLIST | **Columns:** col, tbl, num_values, minvalue, maxvalue. For more information, see [STV_BLOCKLIST](./r_STV_BLOCKLIST.html). -STV_EXEC_STATE | **Columns:** rows, bytes, label. For more information, see [STV_EXEC_STATE](./r_STV_EXEC_STATE.html). -STV_LOCKS | **Columns:** table_id. For more information, see [STV_LOCKS](./r_STV_LOCKS.html). -STV_QUERY_METRICS | **Columns:** rows, max_rows, blocks_read, max_blocks_read, max_blocks_to_disk, blocks_to_disk, max_query_scan_size, query_scan_size. For more information, see [STV_QUERY_METRICS](./r_STV_QUERY_METRICS.html). -STV_STARTUP_RECOVERY_STATE | **Columns:** table_id, table_name. For more information, see [STV_STARTUP_RECOVERY_STATE](./r_STV_STARTUP_RECOVERY_STATE.html). -STV_TBL_PERM | **Columns:** id, rows, sorted_rows, temp, block_count, query_scan_size. For more information, see [STV_TBL_PERM](./r_STV_TBL_PERM.html). -STV_TBL_TRANS | **Columns:** id, rows, size. For more information, see [STV_TBL_TRANS](./r_STV_TBL_TRANS.html). -SVCS_EXPLAIN | **Columns:** plannode, info. For more information, see [SVCS_EXPLAIN](./r_SVCS_EXPLAIN.html). -SVCS_PLAN_INFO | **Columns:** rows, bytes. For more information, see [SVCS_PLAN_INFO](./r_SVCS_PLAN_INFO.html). -SVCS_QUERY_SUMMARY | **Columns:** step, rows, bytes, rate_row, rate_byte, label, rows_pre_filter. For more information, see [SVCS_QUERY_SUMMARY](./r_SVCS_QUERY_SUMMARY.html). -SVCS_S3LIST | **Columns:** bucket, prefix, max_file_size, avg_file_size. For more information, see [SVCS_QUERY_SUMMARY](./r_SVCS_QUERY_SUMMARY.html). -SVCS_S3LOG | **Columns:** message. For more information, see [SVCS_QUERY_SUMMARY](./r_SVCS_QUERY_SUMMARY.html). -SVCS_S3PARTITION_SUMMARY | **Columns:** total_partitions, qualified_partitions, min_assigned_partitions, max_assigned_partitions, avg_assigned_partitions. For more information, see [SVCS_S3PARTITION_SUMMARY](./r_SVCS_S3PARTITION_SUMMARY.html). -SVCS_S3QUERY_SUMMARY | **Columns:** external_table_name, file_format, s3_scanned_rows, s3_scanned_bytes, s3query_returned_rows, s3query_returned_bytes. For more information, see [SVCS_S3QUERY_SUMMARY](./r_SVCS_S3QUERY_SUMMARY.html). -SVL_QUERY_METRICS | **Columns:** step_label, scan_row_count, join_row_count, nested_loop_join_row_count, return_row_count, spectrum_scan_row_count, spectrum_scan_size_mb. For more information, see [SVL_QUERY_METRICS](./r_SVL_QUERY_METRICS.html). -SVL_QUERY_METRICS_SUMMARY | **Columns:** step_label, scan_row_count, join_row_count, nested_loop_join_row_count, return_row_count, spectrum_scan_row_count, spectrum_scan_size_mb. For more information, see [SVL_QUERY_METRICS_SUMMARY](./r_SVL_QUERY_METRICS_SUMMARY.html). -SVL_QUERY_REPORT | **Columns:** rows, bytes, label, rows_pre_filter. For more information, see [SVL_QUERY_REPORT](./r_SVL_QUERY_REPORT.html). -SVL_QUERY_SUMMARY | **Columns:** rows, bytes, rows_pre_filter. For more information, see [SVL_QUERY_SUMMARY](./r_SVL_QUERY_SUMMARY.html). -SVL_S3LIST | **Columns:** bucket, prefix, max_file_size, avg_file_size. For more information, see [SVL_S3LIST](./r_SVL_S3LIST.html). -SVL_S3LOG | **Columns:** message. For more information, see [SVL_S3LOG](./r_SVL_S3LOG.html). -SVL_S3PARTITION | **Columns:** rows, bytes, label, rows_pre_filter. For more information, see [SVL_S3PARTITION](./r_SVL_S3PARTITION.html). -SVL_S3PARTITION_SUMMARY | **Columns:** total_partitions, qualified_partitions, min_assigned_partitions, max_assigned_partitions, avg_assigned_partitions. For more information, see [SVL_S3PARTITION_SUMMARY](./r_SVL_S3PARTITION_SUMMARY.html). -SVL_S3QUERY | **Columns:** external_table_name, file_format, s3_scanned_rows, s3_scanned_bytes, s3query_returned_rows, s3query_returned_bytes. For more information, see [SVL_S3QUERY](./r_SVL_S3QUERY.html). -SVL_S3QUERY_SUMMARY | **Columns:** external_table_name, file_format, s3_scanned_rows, s3_scanned_bytes, s3query_returned_rows, s3query_returned_bytes. For more information, see [SVL_S3QUERY_SUMMARY](./r_SVL_S3QUERY_SUMMARY.html). -SVL_S3RETRIES | **Columns:** file_size, location, message. For more information, see [SVL_S3RETRIES](./r_SVL_S3RETRIES.html). -SVL_SPECTRUM_SCAN_ERROR | **Columns:** location, rowid, colname, original_value, modified_value. For more information, see [SVL_SPECTRUM_SCAN_ERROR](./r_SVL_SPECTRUM_SCAN_ERROR.html). -SVL_STATEMENTTEXT | **Columns:** type, text. For more information, see [SVL_STATEMENTTEXT](./r_SVL_STATEMENTTEXT.html). -SVL_STORED_PROC_CALL | **Columns:** querytxt. For more information, see [SVL_STORED_PROC_CALL](./r_SVL_STORED_PROC_CALL.html). -SVL_STORED_PROC_MESSAGES | **Columns:** querytext. For more information, see [SVL_STORED_PROC_MESSAGES](./r_SVL_STORED_PROC_MESSAGES.html). -SVL_UDF_LOG | **Columns:** funcname. For more information, see [SVL_UDF_LOG](./r_SVL_UDF_LOG.html). -SVV_DISKUSAGE | **Columns:** name, col, tbl, blocknum, num_values, minvalue, maxvalue. For more information, see [SVV_DISKUSAGE](./r_SVV_DISKUSAGE.html). -SVV_QUERY_STATE | **Columns:** rows, bytes, label. For more information, see [SVV_QUERY_STATE](./r_SVV_QUERY_STATE.html). -SVV_TABLE_INFO | **Columns:** table_id, table. For more information, see [SVV_TABLE_INFO](./r_SVV_TABLE_INFO.html). -SVV_TRANSACTIONS | **Columns:** relation. For more information, see [SVV_TRANSACTIONS](./r_SVV_TRANSACTIONS.html). -