AWS AmazonS3 medium security documentation change
Summary
Restructured documentation into numbered steps, added access method recommendations, and expanded IAM role configuration details for different integration methods
Security assessment
Added explicit guidance about IAM role requirements including attaching 'AmazonS3TablesFullAccess' and 'AmazonS3FullAccess' policies, and recommended security best practices through AWS analytics integration with Lake Formation for fine-grained access control. These changes directly document security configurations required for secure access management.
Diff
diff --git a/AmazonS3/latest/userguide/s3-tables-integrating-glue.md b/AmazonS3/latest/userguide/s3-tables-integrating-glue.md index d28891b71..42e50239b 100644 --- a//AmazonS3/latest/userguide/s3-tables-integrating-glue.md +++ b//AmazonS3/latest/userguide/s3-tables-integrating-glue.md @@ -5 +5 @@ -PrerequisitesCreate a script to connect to table bucketsCreate a AWS Glue job that queries tables +Step 1 – PrerequisitesStep 2 – Create a script to connect to table bucketsStep 3 – Create a AWS Glue job that queries tables @@ -17 +17 @@ You can use AWS Glue jobs to process data in your S3 tables by connecting to you - * Prerequisites + * Step 1 – Prerequisites @@ -19 +19 @@ You can use AWS Glue jobs to process data in your S3 tables by connecting to you - * Create a script to connect to table buckets + * Step 2 – Create a script to connect to table buckets @@ -21 +21,12 @@ You can use AWS Glue jobs to process data in your S3 tables by connecting to you - * Create a AWS Glue job that queries tables + * Step 3 – Create a AWS Glue job that queries tables + + + + +Choose your access method based on your specific AWS Glue ETL job requirements: + + * **AWS analytics services integration (Recommended)** – Recommended when you need centralized metadata management across multiple AWS analytics services, need to leverage existing AWS Glue Data Catalog permissions and fine-grained access control with Lake Formation, or are building production ETL pipelines that integrate with other AWS services like Athena or Amazon EMR. + + * **Amazon S3 Tables Iceberg REST endpoint** – Recommended when you need to connect to S3 tables from third-party query engines that support Apache Iceberg, build custom ETL applications that need direct REST API access, or when you require control over catalog operations without dependencies on AWS Glue Data Catalog. + + * **Amazon S3 Tables Catalog for Apache Iceberg** – Use only for legacy applications or specific programmatic scenarios that require the Java client library. This method is not recommended for new AWS Glue ETL job implementations due to additional `JAR` dependency management and complexity. @@ -30 +41,35 @@ S3 Tables is supported on [AWS Glue version 5.0 or higher](https://docs.aws.amaz -## Prerequisites +## Step 1 – Prerequisites + +Before you can query tables from a AWS Glue job you must configure an IAM role that AWS Glue can use to run the job. Choose your method of access to see specific prerequisites for that method. + +AWS analytics services integration (Recommended) + + +Prerequisites required to use the S3 Tables AWS analytics integration to run AWS Glue jobs. + + * [Integrate your table buckets with AWS analytics services](./.html#s3-tables-integrating-aws). + + * [Create an IAM role for AWS Glue](https://docs.aws.amazon.com/glue/latest/dg/create-an-iam-role.html). + + * Attach the `AmazonS3TablesFullAccess` managed policy to the role. + + * Attach the `AmazonS3FullAccess` managed policy to the role. + + + + +Amazon S3 Tables Iceberg REST endpoint + + +Prerequisites to use the Amazon S3 Tables Iceberg REST endpoint to run AWS Glue ETL jobs. + + * [Create an IAM role for AWS Glue](https://docs.aws.amazon.com/glue/latest/dg/create-an-iam-role.html). + + * Attach the `AmazonS3TablesFullAccess` managed policy to the role. + + * Attach the `AmazonS3FullAccess` managed policy to the role. + + + + +Amazon S3 Tables Catalog for Apache Iceberg @@ -32 +76,0 @@ S3 Tables is supported on [AWS Glue version 5.0 or higher](https://docs.aws.amaz -Before you can query tables from a AWS Glue job you must configure an IAM role that AWS Glue can use to run the job, and upload the Amazon S3 Tables Catalog for Apache Iceberg JAR to an S3 bucket that AWS Glue can access when it runs the job. @@ -34 +78 @@ Before you can query tables from a AWS Glue job you must configure an IAM role t - * [Integrate your table buckets with AWS analytics services](./s3-tables-integrating-aws.html). +Prerequisites use the Amazon S3 Tables Catalog for Apache Iceberg to run AWS Glue ETL jobs. @@ -42 +86 @@ Before you can query tables from a AWS Glue job you must configure an IAM role t - * (Optional) If you are using the Amazon S3 Tables Catalog for Apache Iceberg you need to download the client catalog JAR and upload it to an S3 bucket. + * To use the Amazon S3 Tables Catalog for Apache Iceberg you need to download the client catalog JAR and upload it to an S3 bucket. @@ -57 +101 @@ Before you can query tables from a AWS Glue job you must configure an IAM role t -## Create a script to connect to table buckets +## Step 2 – Create a script to connect to table buckets @@ -63 +107 @@ You can configure the session to connect to your table buckets through the any o - * S3 Tables integration with AWS analytics services + * S3 Tables AWS analytics services integration (Recommended) @@ -74 +118 @@ Choose from the following access methods to view setup instructions and configur -AWS analytics services integration +AWS analytics services integration (Recommended) @@ -77 +121 @@ AWS analytics services integration -As a prerequisites to query tables with Spark on AWS Glue using the AWS analytics services integration, you must [Integrate your table buckets with AWS analytics services](./s3-tables-integrating-aws.html) +As a prerequisites to query tables with Spark on AWS Glue using the AWS analytics services integration, you must [Integrate your table buckets with AWS analytics services](./.html#s3-tables-integrating-aws) @@ -299 +343 @@ Amazon S3 Tables Catalog for Apache Iceberg -## Create a AWS Glue job that queries tables +## Step 3 – Create a AWS Glue job that queries tables @@ -307 +351 @@ The following procedure shows how to use the AWS Glue Studio script editor to cr - * Prerequisites + * Step 1 – Prerequisites @@ -309 +353 @@ The following procedure shows how to use the AWS Glue Studio script editor to cr - * Create a script to connect to table buckets + * Step 2 – Create a script to connect to table buckets @@ -339 +383 @@ The following procedure shows how to use the AWS CLI to create an ETL job that q - * Prerequisites + * Step 1 – Prerequisites @@ -341 +385 @@ The following procedure shows how to use the AWS CLI to create an ETL job that q - * Create a script to connect to table buckets and upload it to an S3 bucket. + * Step 2 – Create a script to connect to table buckets and upload it to an S3 bucket.