AWS firehose documentation change
Summary
Added documentation about resource links for S3 table buckets and clarified Lake Formation permissions requirements
Security assessment
Added details about required permissions (DESCRIBE on resource links, read/write on tables) improve security documentation by clarifying access control requirements. However, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/firehose/latest/dev/apache-iceberg-prereq.md b/firehose/latest/dev/apache-iceberg-prereq.md index 85ed9ebb8..553a329f3 100644 --- a//firehose/latest/dev/apache-iceberg-prereq.md +++ b//firehose/latest/dev/apache-iceberg-prereq.md @@ -48,0 +49,2 @@ To deliver data to Amazon S3 table buckets, complete the following prerequisites + * **Create a resource link to the namespace** – Firehose streams data to the tables in the database registered in the default catalog of the AWS Glue Data Catalog. To stream data to tables in S3 table buckets, create a [resource link](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html#database-link-tables) in the default catalog that points to the namespace in table bucket. A resource link is a Data Catalog object that acts as an alias or pointer to another Data Catalog resource, such as a database or table. + @@ -51 +53 @@ To deliver data to Amazon S3 table buckets, complete the following prerequisites - * **Configure AWS Lake Formation permissions** – AWS Lake Formation manages access to your table resources. Lake Formation uses its own [permissions model](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html#grant-permissions-tables) that enables fine-grained access control for Data Catalog resources. + * **Configure AWS Lake Formation permissions** – AWS Lake Formation manages access to your table resources. Lake Formation uses its own [permissions model](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html#grant-permissions-tables) that enables fine-grained access control for Data Catalog resources. For Firehose to ingest data into table buckets, the Firehose role requires `DESCRIBE` permissions on the resource link to discover the S3 Tables namespace through the resource link and read/write permission on the underlying table. @@ -57,0 +60,4 @@ For step-by-step integration, refer to the blog [Build a data lake for streaming +You will use the resource link name for Database created as part of prerequisites in your Firehose stream configuration for routing purposes. You can use them in the **Unique key** section of your Firehose stream configuration if you are routing to a single table, or send them as part of your input data for Firehose to route to the right table using JSON Query expressions. + +For more ways to create resource links, see [Creating a resource link to a shared Data Catalog table](https://docs.aws.amazon.com/lake-formation/latest/dg/create-resource-link-table.html) or [Creating a resource link to a shared Data Catalog database](https://docs.aws.amazon.com/lake-formation/latest/dg/create-resource-link-database.html) in the _Lake Formation user guide_. +