AWS AmazonS3 documentation change

Service: AmazonS3 · 2025-08-28 · Documentation low

File: AmazonS3/latest/userguide/s3-tables-integrating-firehose.md

Summary

Removed detailed IAM policy example for Firehose integration containing permissions for Glue, S3 error buckets, Kinesis, Lake Formation, KMS encryption, logging, and Lambda

Security assessment

Removal of policy examples reduces documentation clarity but does not directly address a security vulnerability. The change removes guidance but doesn't indicate a patched security flaw.

Diff

diff --git a/AmazonS3/latest/userguide/s3-tables-integrating-firehose.md b/AmazonS3/latest/userguide/s3-tables-integrating-firehose.md
index 25cdfca4a..2c5c28e41 100644
--- a//AmazonS3/latest/userguide/s3-tables-integrating-firehose.md
+++ b//AmazonS3/latest/userguide/s3-tables-integrating-firehose.md
@@ -36,104 +35,0 @@ Firehose needs an IAM [service role](https://docs.aws.amazon.com/IAM/latest/User
-JSON
-    
-
-****
-    
-    
-        {
-        "Version": "2012-10-17",
-        "Statement": [
-            {
-                "Sid": "S3TableAccessViaGlueFederation",
-                "Effect": "Allow",
-                "Action": [
-                    "glue:GetTable",
-                    "glue:GetDatabase",
-                    "glue:UpdateTable"
-                ],
-                "Resource": [
-                    "arn:aws:glue:us-east-1:account-id:catalog/s3tablescatalog/*",
-                    "arn:aws:glue:us-east-1:account-id:catalog/s3tablescatalog",
-                    "arn:aws:glue:us-east-1:account-id:catalog",
-                    "arn:aws:glue:us-east-1:account-id:database/*",
-                    "arn:aws:glue:us-east-1:account-id:table/*/*"
-                ]
-            },
-            {
-                "Sid": "S3DeliveryErrorBucketPermission",
-                "Effect": "Allow",
-                "Action": [
-                    "s3:AbortMultipartUpload",
-                    "s3:GetBucketLocation",
-                    "s3:GetObject",
-                    "s3:ListBucket",
-                    "s3:ListBucketMultipartUploads",
-                    "s3:PutObject"
-                ],
-                "Resource": [
-                    "arn:aws:s3:::error delivery bucket",
-                    "arn:aws:s3:::error delivery bucket/*"
-                ]
-            },
-            {
-                "Sid": "RequiredWhenUsingKinesisDataStreamsAsSource",
-                "Effect": "Allow",
-                "Action": [
-                    "kinesis:DescribeStream",
-                    "kinesis:GetShardIterator",
-                    "kinesis:GetRecords",
-                    "kinesis:ListShards"
-                ],
-                "Resource": "arn:aws:kinesis:us-east-1:account-id:stream/stream-name"
-            },
-            {
-                "Sid": "RequiredWhenDoingMetadataReadsANDDataAndMetadataWriteViaLakeformation",
-                "Effect": "Allow",
-                "Action": [
-                    "lakeformation:GetDataAccess"
-                ],
-                "Resource": "*"
-            },
-            {
-                "Sid": "RequiredWhenUsingKMSEncryptionForS3ErrorBucketDelivery",
-                "Effect": "Allow",
-                "Action": [
-                    "kms:Decrypt",
-                    "kms:GenerateDataKey"
-                ],
-                "Resource": [
-                    "arn:aws:kms:us-east-1:account-id:key/KMS-key-id"
-                ],
-                "Condition": {
-                    "StringEquals": {
-                        "kms:ViaService": "s3.us-east-1.amazonaws.com"
-                    },
-                    "StringLike": {
-                        "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::error delivery bucket/prefix*"
-                    }
-                }
-            },
-            {
-                "Sid": "LoggingInCloudWatch",
-                "Effect": "Allow",
-                "Action": [
-                    "logs:PutLogEvents"
-                ],
-                "Resource": [
-                    "arn:aws:logs:us-east-1:account-id:log-group:log-group-name:log-stream:log-stream-name"
-                ]
-            },
-            {
-                "Sid": "RequiredWhenAttachingLambdaToFirehose",
-                "Effect": "Allow",
-                "Action": [
-                    "lambda:InvokeFunction",
-                    "lambda:GetFunctionConfiguration"
-                ],
-                "Resource": [
-                    "arn:aws:lambda:us-east-1:account-id:function:function-name:function-version"
-                ]
-            }
-        ]
-    }
-    
-