AWS timestream documentation change

Service: timestream · 2025-08-28 · Documentation low

File: timestream/latest/developerguide/export-unload-prerequisites.md

Summary

Removed detailed IAM policy examples for S3 write permissions and KMS encryption requirements related to UNLOAD operations

Security assessment

Removal of policy examples reduces guidance for proper access control configuration but doesn't directly address a specific security vulnerability. The change appears to be documentation cleanup rather than response to a security incident.

Diff

diff --git a/timestream/latest/developerguide/export-unload-prerequisites.md b/timestream/latest/developerguide/export-unload-prerequisites.md
index 1f7370077..ef3c60caf 100644
--- a//timestream/latest/developerguide/export-unload-prerequisites.md
+++ b//timestream/latest/developerguide/export-unload-prerequisites.md
@@ -22,36 +21,0 @@ Following are prerequisites for writing data to S3 using `UNLOAD` from Timestrea
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [{
-                "Effect": "Allow",
-                "Action": [
-                    "timestream:Select",
-                    "timestream:ListMeasures",
-                    "timestream:WriteRecords",
-                    "timestream:Unload"
-                ],
-                "Resource": "arn:aws:timestream:111122223333:database/database_name/table/table_name"
-            },
-            {
-                "Effect": "Allow",
-                "Action": [
-                    "s3:GetBucketAcl",
-                    "s3:PutObject",
-                    "s3:GetObjectMetadata",
-                    "s3:AbortMultipartUpload"
-                ],
-                "Resource": [
-                    "arn:aws:s3:::S3_Bucket_Created",
-                    "arn:aws:s3:::S3_Bucket_Created/*"
-                ]
-            }
-        ]
-    }
-    
-
@@ -60,48 +23,0 @@ For additional context on these S3 write permissions, refer to the [Amazon Simpl
-JSON
-    
-
-****
-    
-    
-    
-    {
-        "Version": "2012-10-17",
-        "Statement": [
-          {
-            "Effect": "Allow",
-            "Action": [
-                "kms:DescribeKey",
-                "kms:Decrypt",
-                "kms:GenerateDataKey*"
-            ],
-            "Resource": "arn:aws:kms:111122223333:key/*",
-            "Condition": {
-                "ForAnyValue:StringLike": {
-                    "kms:ResourceAliases": "alias/Alias_For_Generated_Key"
-                }
-            }
-        }, {
-            "Effect": "Allow",
-            "Action": [
-                "kms:CreateGrant"
-            ],
-            "Resource": "arn:aws:kms:111122223333:key/*",
-            "Condition": {
-                "ForAnyValue:StringEquals": {
-                    "kms:EncryptionContextKeys": "aws:timestream:database_name"
-                },
-                "Bool": {
-                    "kms:GrantIsForAWSResource": true
-                },
-                "StringLike": {
-                    "kms:ViaService": "timestream..amazonaws.com"
-                },
-                "ForAnyValue:StringLike": {
-                    "kms:ResourceAliases": "alias/Alias_For_Generated_Key"
-                }
-            }
-        }
-    ]
-    }
-    
-