AWS emr documentation change
Summary
Minor wording adjustments and clarifications in S3 Access Grants documentation (e.g., 'can' instead of 'will be able to', 'must' instead of 'need to'). No functional changes.
Security assessment
Changes are editorial improvements to existing security documentation about S3 Access Grants. The clarification about IAM roles overriding S3 Access Grants permissions (line 46) reinforces existing security behavior but does not address a new vulnerability or weakness.
Diff
diff --git a/emr/latest/EMR-Serverless-UserGuide/access-grants.md b/emr/latest/EMR-Serverless-UserGuide/access-grants.md index 9096b91ec..2235b65d9 100644 --- a//emr/latest/EMR-Serverless-UserGuide/access-grants.md +++ b//emr/latest/EMR-Serverless-UserGuide/access-grants.md @@ -11 +11 @@ OverviewLaunch an applicationConsiderations -With Amazon EMR releases 6.15.0 and higher, Amazon S3 Access Grants provide a scalable access control solution that you can use to augment access to your Amazon S3 data from EMR Serverless. If you have a complex or large permission configuration for your S3 data, you can use Access Grants to scale S3 data permissions for users, roles, and applications. +With Amazon EMR releases 6.15.0 and higher, Amazon S3 Access Grants provide a scalable access control solution for augmenting access to your Amazon S3 data from EMR Serverless. If you have a complex or large permission configuration for your S3 data, use Access Grants to scale S3 data permissions for users, roles, and applications. @@ -15 +15 @@ Use S3 Access Grants to augment access to Amazon S3 data beyond the permissions -For more information, see [Managing access with S3 Access Grants for Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-access-grants.html) in the _Amazon EMR Management Guide_ and [Managing access with S3 Access Grants](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants.html) in the _Amazon Simple Storage Service User Guide_. +For more information, refer to [Managing access with S3 Access Grants for Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-access-grants.html) in the _Amazon EMR Management Guide_ and [Managing access with S3 Access Grants](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants.html) in the _Amazon Simple Storage Service User Guide_. @@ -30 +30 @@ You can enable S3 Access Grants on EMR Serverless and launch a Spark application - 1. Set up a job execution role for your EMR Serverless application. Include the required IAM permissions that you need to run Spark jobs and use S3 Access Grants, `s3:GetDataAccess` and `s3:GetAccessGrantsInstanceForPrefix`: + 1. Set up a job execution role for your EMR Serverless application. Include the required IAM permissions that you must run Spark jobs and use S3 Access Grants, `s3:GetDataAccess` and `s3:GetAccessGrantsInstanceForPrefix`: @@ -46 +46 @@ You can enable S3 Access Grants on EMR Serverless and launch a Spark application -If you specify IAM roles for job execution that have additional permissions to access S3 directly, then users will be able to access the data permitted by the role even if they don't have permission from S3 Access Grants. +If you specify IAM roles for job execution that have additional permissions to access S3 directly, then users can access the data permitted by the role even if they don't have permission from S3 Access Grants. @@ -75 +75 @@ If you specify IAM roles for job execution that have additional permissions to a -For important support, compatibility, and behavioral information when you use Amazon S3 Access Grants with EMR Serverless, see [S3 Access Grants considerations with Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-access-grants.html#emr-access-grants-considerations) in the _Amazon EMR Management Guide_. +For important support, compatibility, and behavioral information when you use Amazon S3 Access Grants with EMR Serverless, refer to [S3 Access Grants considerations with Amazon EMR](https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-access-grants.html#emr-access-grants-considerations) in the _Amazon EMR Management Guide_.