AWS redshift medium security documentation change
Summary
Expanded REVOKE syntax documentation to include dynamic data masking policies alongside row-level security policies. Updated examples to show { RLS | MASKING } options and corrected grant/revoke terminology. Added explanations for revoking EXPLAIN permissions related to security policy filters.
Security assessment
The changes explicitly document how to revoke permissions related to security policies (RLS and dynamic data masking), which are security controls. Adding MASKING policy support shows expanded security feature documentation. Correcting grant->revoke terminology prevents accidental permission retention.
Diff
diff --git a/redshift/latest/dg/r_REVOKE.md b/redshift/latest/dg/r_REVOKE.md index 653db5e89..caea83626 100644 --- a//redshift/latest/dg/r_REVOKE.md +++ b//redshift/latest/dg/r_REVOKE.md @@ -221 +221 @@ The following is the syntax for revoking system permissions to roles on Amazon R -The following is the syntax for revoking permissions to explain the row-level security policy filters of a query in the EXPLAIN plan. You can revoke the privilege using the REVOKE statement. +The following is the syntax for revoking permissions to explain the security policy filters of a query in the EXPLAIN plan. Possible security policies include row-level security policies and dynamic data masking policies. @@ -224 +224 @@ The following is the syntax for revoking permissions to explain the row-level se - REVOKE EXPLAIN RLS FROM ROLE _rolename_ + REVOKE EXPLAIN { RLS | MASKING } FROM ROLE _rolename_ @@ -226 +226 @@ The following is the syntax for revoking permissions to explain the row-level se -The following is the syntax for granting permissions to bypass row-level security policies for a query. +The following is the syntax for revoking permissions to bypass row-level security policies for a query. @@ -231 +231 @@ The following is the syntax for granting permissions to bypass row-level securit -The following is the syntax for revoking permissions from the specified row-level security policy. +The following is the syntax for revoking SELECT permissions from the specified security policy. Possible security policies include row-level security policies and dynamic data masking policies. @@ -235 +235 @@ The following is the syntax for revoking permissions from the specified row-leve - FROM RLS POLICY _policy_name_ [, ...] + FROM { RLS | MASKING } POLICY _policy_name_ [, ...] @@ -542,0 +543,15 @@ The role that you revoke the specified role from. +EXPLAIN { RLS | MASKING } FROM ROLE _rolename_ + + +Revokes the permission to explain the security policy filters of a query in the EXPLAIN plan from a role. RLS revokes permission to explain row-level security policy filters. MASKING revokes permission to explain dynamic data masking policy filters. + +IGNORE RLS FROM ROLE _rolename_ + + +Revokes the permission to bypass row-level security policies for a query from a role. + +FROM { RLS | MASKING } POLICY _policy_name_ + + +Indicates the security policy losing the permissions. TO RLS POLICY indicates a row-level security policy. TO MASKING POLICY indicates a dynamic data masking policy. +