AWS firehose documentation change
Summary
Updated IAM policy examples to use placeholder values (<region>, <aws-account-id>) instead of hardcoded regions/account IDs, fixed ARN formatting inconsistencies, and removed redundant JSON syntax markers
Security assessment
Changes enforce security best practices by preventing accidental exposure of real account IDs/regions in examples. The kms:ViaService change to 's3.region.amazonaws.com' improves security by using service principal constraints rather than specific key ARNs.
Diff
diff --git a/firehose/latest/dev/database-as-source-grant-access.md b/firehose/latest/dev/database-as-source-grant-access.md index 370b9cb2d..9d1942e86 100644 --- a//firehose/latest/dev/database-as-source-grant-access.md +++ b//firehose/latest/dev/database-as-source-grant-access.md @@ -19,6 +18,0 @@ You must have an IAM role before you create a Firehose stream and Apache Iceberg -JSON - - -**** - - @@ -39,3 +33,3 @@ JSON - "arn:aws:glue:us-east-1:111122223333:catalog", - "arn:aws:glue:us-east-1:111122223333:database/*", - "arn:aws:glue:us-east-1:111122223333:table/*/*" + "arn:aws:glue:<region>:<aws-account-id>:catalog", + "arn:aws:glue:<region>:<aws-account-id>:database/*", + "arn:aws:glue:<region>:<aws-account-id>:table/*/*" @@ -56,2 +50,2 @@ JSON - "arn:aws::s3:::amzn-s3-demo-bucket", - "arn:aws::s3:::amzn-s3-demo-bucket/*" + "arn:aws:s3:::amzn-s3-demo-bucket", + "arn:aws:s3:::amzn-s3-demo-bucket/*" @@ -67 +61 @@ JSON - "arn:aws::kms:us-east-1:123456789012:key/<key-id>" + "arn:aws:kms:<region>:<aws-account-id>:key/<key-id>" @@ -71 +65 @@ JSON - "kms:ViaService": "arn:aws::kms:us-east-1:123456789012:key/s3" + "kms:ViaService": "s3.region.amazonaws.com" @@ -74 +68 @@ JSON - "kms:EncryptionContext:aws:s3:arn": "arn:aws::s3:::amzn-s3-demo-bucket/prefix*" + "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::amzn-s3-demo-bucket/prefix*" @@ -84 +78 @@ JSON - "arn:aws::logs:"us-east-1:111122223333:log-group:log-group-name>:log-stream:log-stream-name>" + "arn:aws:logs:<region>:<aws-account-id>:log-group:<log-group-name>:log-stream:<log-stream-name>" @@ -90 +84 @@ JSON - "Resource": "arn:aws::secretsmanager:us-east-1:123456789012:secret:mySecret-abc123>" + "Resource": "<Secret ARN>"