AWS glue documentation change
Summary
Updated multiple ARNs in IAM policy examples: replaced placeholders with us-east-1 region and 111122223333 account ID, and modified S3 bucket ARNs to use wildcards
Security assessment
Changes are example value updates and syntax corrections (wildcard usage). The S3 bucket ARN change to wildcard could potentially lead to over-permissive policies if misapplied, but this is a documentation example update without evidence of addressing a specific security vulnerability.
Diff
diff --git a/glue/latest/dg/optimization-prerequisites.md b/glue/latest/dg/optimization-prerequisites.md index de0d0e946..087c92c79 100644 --- a//glue/latest/dg/optimization-prerequisites.md +++ b//glue/latest/dg/optimization-prerequisites.md @@ -36 +36 @@ JSON - "arn:aws:s3:::<bucket-name>/*" + "arn:aws:s3:::/*" @@ -45 +45 @@ JSON - "arn:aws:s3:::<bucket-name>" + "arn:aws:s3:::" @@ -55,3 +55,3 @@ JSON - "arn:aws:glue:<region>:<aws-account-id>:table/<database-name>/<table-name>", - "arn:aws:glue:<region>:<aws-account-id>:database/<database-name>", - "arn:aws:glue:<region>:<aws-account-id>:catalog" + "arn:aws:glue:us-east-1:111122223333:table/<database-name>/<table-name>", + "arn:aws:glue:us-east-1:111122223333:database/<database-name>", + "arn:aws:glue:us-east-1:111122223333:catalog" @@ -68,3 +68,3 @@ JSON - "arn:aws:logs:<region>:<aws-account-id>:log-group:/aws-glue/iceberg-compaction/logs:*", - "arn:aws:logs:<region>:<aws-account-id>:log-group:/aws-glue/iceberg-retention/logs:*", - "arn:aws:logs:<region>:<aws-account-id>:log-group:/aws-glue/iceberg-orphan-file-deletion/logs:*" + "arn:aws:logs:us-east-1:111122223333:log-group:/aws-glue/iceberg-compaction/logs:*", + "arn:aws:logs:us-east-1:111122223333:log-group:/aws-glue/iceberg-retention/logs:*", + "arn:aws:logs:us-east-1:111122223333:log-group:/aws-glue/iceberg-orphan-file-deletion/logs:*" @@ -106,3 +106,3 @@ JSON - "arn:aws:glue:<region>:<aws-account-id>:table/<databaseName>/<tableName>", - "arn:aws:glue:<region>:<aws-account-id>:database/<database-name>", - "arn:aws:glue:<region>:<aws-account-id>:catalog" + "arn:aws:glue:us-east-1:111122223333:table/<databaseName>/<tableName>", + "arn:aws:glue:us-east-1:111122223333:database/<database-name>", + "arn:aws:glue:us-east-1:111122223333:catalog" @@ -119,3 +119,3 @@ JSON - "arn:aws:logs:<region>:<aws-account-id>:log-group:/aws-glue/iceberg-compaction/logs:*", - "arn:aws:logs:<region>:<aws-account-id>:log-group:/aws-glue/iceberg-retention/logs:*", - "arn:aws:logs:<region>:<aws-account-id>:log-group:/aws-glue/iceberg-orphan-file-deletion/logs:*" + "arn:aws:logs:us-east-1:111122223333:log-group:/aws-glue/iceberg-compaction/logs:*", + "arn:aws:logs:us-east-1:111122223333:log-group:/aws-glue/iceberg-retention/logs:*", + "arn:aws:logs:us-east-1:111122223333:log-group:/aws-glue/iceberg-orphan-file-deletion/logs:*" @@ -186 +186 @@ JSON - "arn:aws:iam::<account-id>:role/<optimizer-role-name>" + "arn:aws:iam::111122223333:role/<optimizer-role-name>"