AWS keyspaces documentation change
Summary
Modified permissions requirements for CDC streams (added 'alter' permission), updated resource ARNs to us-east-1 region/account, removed commented lines, and expanded IAM policy structure
Security assessment
Changes clarify permissions requirements and update example ARNs but do not address security vulnerabilities or introduce new security documentation. The 'alter' permission addition improves accuracy but does not indicate a security fix.
Diff
diff --git a/keyspaces/latest/devguide/configure-cdc-permissions.md b/keyspaces/latest/devguide/configure-cdc-permissions.md index 650325d3c..096956a4d 100644 --- a//keyspaces/latest/devguide/configure-cdc-permissions.md +++ b//keyspaces/latest/devguide/configure-cdc-permissions.md @@ -15 +15 @@ For more information about AWS Identity and Access Management, see [AWS Identity -To enable a CDC stream for an Amazon Keyspaces table, the principal first needs permissions to create a table and second the permissions to create the service linked role [AWSServiceRoleForAmazonKeyspacesCDC](./using-service-linked-roles-CDC-streams.html#service-linked-role-permissions-CDC-streams). Amazon Keyspaces uses the service linked role to publish CloudWatch metrics into your account on your behalf +To enable a CDC stream for an Amazon Keyspaces table, the principal first needs permissions to create or alter a table and second the permissions to create the service linked role [AWSServiceRoleForAmazonKeyspacesCDC](./using-service-linked-roles-CDC-streams.html#service-linked-role-permissions-CDC-streams). Amazon Keyspaces uses the service linked role to publish CloudWatch metrics into your account on your behalf @@ -26 +25,0 @@ The following IAM policy is an example of this. - // Enable CDC stream during table creation @@ -29 +27,0 @@ The following IAM policy is an example of this. - // Enable CDC stream after creation @@ -34,2 +32,2 @@ The following IAM policy is an example of this. - "arn:aws:cassandra:aws-region:555555555555:/keyspace/my_keyspace/*", - "arn:aws:cassandra:aws-region:555555555555:/keyspace/system*" + "arn:aws:cassandra:us-east-1:111122223333:/keyspace/my_keyspace/*", + "arn:aws:cassandra:us-east-1:111122223333:/keyspace/system*" @@ -68 +66 @@ The following IAM policy is an example of this. - "arn:aws:cassandra:aws-region:111122223333:/keyspace/system*" + "arn:aws:cassandra:us-east-1:111122223333:/keyspace/system*" @@ -74 +72 @@ The following IAM policy is an example of this. -To view or list CDC streams with the AWS CLI or the Amazon Keyspaces API, the principal needs permissions for the actions `cassandra:ListStreams` and `cassandra:GetStream`. +To view or list CDC streams with the AWS CLI or the Amazon Keyspaces API, the principal needs additional permissions for the actions `cassandra:ListStreams` and `cassandra:GetStream`. @@ -78,0 +77,3 @@ The following IAM policy is an example of this. + { + "Version": "2012-10-17", + "Statement": [ @@ -87,0 +89,2 @@ The following IAM policy is an example of this. + ] + } @@ -105,2 +108 @@ To read CDC streams, the principal needs the following permissions. - // CDC Stream ARN - "arn:aws:cassandra:aws-region:111122223333:/keyspace/my_keyspace/table/my_table/stream/stream_label" + "arn:aws:cassandra:us-east-1:111122223333:/keyspace/my_keyspace/table/my_table/stream/stream_label" @@ -137 +139 @@ To process Amazon Keyspaces CDC streams with KCL, the IAM principal needs the fo - "arn:aws:cassandra:aws-region:111122223333:/keyspace/my_keyspace/table/my_table/stream/stream_label" + "arn:aws:cassandra:us-east-1:111122223333:/keyspace/my_keyspace/table/my_table/stream/stream_label" @@ -153 +155 @@ To process Amazon Keyspaces CDC streams with KCL, the IAM principal needs the fo - "arn:aws:dynamodb:aws-region:111122223333:table/KCL_APPLICATION_NAME" + "arn:aws:dynamodb:us-east-1:111122223333:table/KCL_APPLICATION_NAME" @@ -168,2 +170,2 @@ To process Amazon Keyspaces CDC streams with KCL, the IAM principal needs the fo - "arn:aws:dynamodb:aws-region:111122223333:table/KCL_APPLICATION_NAME-WorkerMetricStats", - "arn:aws:dynamodb:aws-region:111122223333:table/KCL_APPLICATION_NAME-CoordinatorState" + "arn:aws:dynamodb:us-east-1:111122223333:table/KCL_APPLICATION_NAME-WorkerMetricStats", + "arn:aws:dynamodb:us-east-1:111122223333:table/KCL_APPLICATION_NAME-CoordinatorState" @@ -178 +180 @@ To process Amazon Keyspaces CDC streams with KCL, the IAM principal needs the fo - "arn:aws:dynamodb:aws-region:111122223333:table/KCL_APPLICATION_NAME/index/*" + "arn:aws:dynamodb:us-east-1:111122223333:table/KCL_APPLICATION_NAME/index/*"