AWS glue documentation change
Summary
Removed multiple JSON policy examples related to IAM role permissions for Glue integrations
Security assessment
The changes remove policy examples but don't indicate any security vulnerability being addressed. Policy examples are standard documentation elements rather than security fixes.
Diff
diff --git a/glue/latest/dg/zero-etl-prerequisites.md b/glue/latest/dg/zero-etl-prerequisites.md index 4d7347de8..a3b7bae33 100644 --- a//glue/latest/dg/zero-etl-prerequisites.md +++ b//glue/latest/dg/zero-etl-prerequisites.md @@ -40,39 +39,0 @@ Create a role which has permissions for the integration to access the connection -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "GlueConnections", - "Effect": "Allow", - "Action": [ - "glue:GetConnections", - "glue:GetConnection" - ], - "Resource": [ - "arn:aws:glue:*:<accountId>:catalog", - "arn:aws:glue:us-east-1:<accountId>:connection/*" - ] - }, - { - "Sid": "GlueActionBasedPermissions", - "Effect": "Allow", - "Action": [ - "// Fetch entities: ", - "glue:ListEntities", - "// Refresh connection credentials:", - "glue:RefreshOAuth2Tokens" - ], - "Resource": [ - "*" - ] - } - ] - } - - @@ -165,54 +125,0 @@ You can access the **Catalog settings** under **Data Catalog**. Then provide the -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { // Allow Alice to create Integration on Target Database - "Principal": { - "AWS": [ - "arn:aws:iam::<source-account-id>:user/Alice" - ] - }, - "Effect": "Allow", - "Action": [ - "glue:CreateInboundIntegration" - ], - "Resource": [ - "arn:aws:glue:<region>:<Target-Account-Id>:catalog", - "arn:aws:glue:<region>:<Target-Account-Id>:database/DatabaseName" - ], - "Condition": { - "StringLike": { - "aws:SourceArn": "arn:aws:dynamodb:<region>:<Account>:table/<table-name>" - } - } - }, - { // Allow Glue to Authorize the Inbound Integration on behalf of Bob - "Principal": { - "Service": [ - "glue.amazonaws.com" - ] - }, - "Effect": "Allow", - "Action": [ - "glue:AuthorizeInboundIntegration" - ], - "Resource": [ - "arn:aws:glue:<region>:<Target-Account-Id>:catalog", - "arn:aws:glue:<region>:<Target-Account-Id>:database/DatabaseName" - ], - "Condition": { - "StringEquals": { - "aws:SourceArn": "arn:aws:dynamodb:<region>:<account-id>:table/<table-name>" - } - } - } - ] - } - - @@ -223,77 +129,0 @@ Create a target IAM role with the following permissions and trust relationships: -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Action": "s3:ListBucket", - "Resource": "arn:aws:s3:::", - "Effect": "Allow" - }, - { - "Action": [ - "s3:GetObject", - "s3:PutObject", - "s3:DeleteObject" - ], - "Resource": "arn:aws:s3:::/prefix/*", - "Effect": "Allow" - }, - { - "Action": [ - "glue:GetDatabase" - ], - "Resource": [ - "arn:aws:glue:us-east-1:111122223333:catalog", - "arn:aws:glue:us-east-1:111122223333:database/DatabaseName" - ], - "Effect": "Allow" - }, - { - "Action": [ - "glue:CreateTable", - "glue:GetTable", - "glue:GetTables", - "glue:DeleteTable", - "glue:UpdateTable", - "glue:GetTableVersion", - "glue:GetTableVersions", - "glue:GetResourcePolicy" - ], - "Resource": [ - "arn:aws:glue:us-east-1:111122223333:catalog", - "arn:aws:glue:us-east-1:111122223333:database/DatabaseName", - "arn:aws:glue:us-east-1:111122223333:table/DatabaseName/*" - ], - "Effect": "Allow" - }, - { - "Action": [ - "cloudwatch:PutMetricData" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "cloudwatch:namespace": "AWS/Glue/ZeroETL" - } - }, - "Effect": "Allow" - }, - { - "Action": [ - "logs:CreateLogGroup", - "logs:CreateLogStream", - "logs:PutLogEvents" - ], - "Resource": "*", - "Effect": "Allow" - } - ] - } - - @@ -452,24 +281,0 @@ To set up a zero-ETL cross-account integration: -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "Stmt123456789012", - "Action": [ - "glue:CreateInboundIntegration" - ], - "Effect": "Allow", - "Resource": [ - "arn:aws:glue:<region>:<target-account-id>:catalog", - "arn:aws:glue:<region>:<target-account-id>:database/DatabaseName" - ] - } - ] - }