AWS emr documentation change
Summary
Clarifications about AWS Lake Formation integration requirements and configuration steps. Strengthened language from 'need to' to 'must' for compliance emphasis.
Security assessment
Changes reinforce existing security documentation about access control modes (FTA vs FGAC) but do not address a specific vulnerability. The 'must' language emphasizes proper security configuration without introducing new security content.
Diff
diff --git a/emr/latest/EMR-Serverless-UserGuide/lake-formation-unfiltered-access.md b/emr/latest/EMR-Serverless-UserGuide/lake-formation-unfiltered-access.md index 6049ffa0b..4d606ef41 100644 --- a//emr/latest/EMR-Serverless-UserGuide/lake-formation-unfiltered-access.md +++ b//emr/latest/EMR-Serverless-UserGuide/lake-formation-unfiltered-access.md @@ -13 +13 @@ With Amazon EMR releases 7.8.0 and higher, you can leverage AWS Lake Formation w -You can access AWS Lake Formation protected Glue Data catalog tables from EMR Serverless Spark jobs or interactive sessions where the job's runtime role has full table access. You do not have to enable AWS Lake Formation on the EMR Serverless application. When a Spark job is configured for Full Table Access (FTA), AWS Lake Formation credentials are used to read/write S3 data for AWS Lake Formation registered tables, while the job's runtime role credentials will be used to read/write tables not registered with AWS Lake Formation. +You can access AWS Lake Formation protected Glue Data catalog tables from EMR Serverless Spark jobs or interactive sessions where the job's runtime role has full table access. You do not need to enable AWS Lake Formation on the EMR Serverless application. When a Spark job is configured for Full Table Access (FTA), AWS Lake Formation credentials are used to read/write S3 data for AWS Lake Formation registered tables, while the job's runtime role credentials will be used to read/write tables not registered with AWS Lake Formation. @@ -21 +21 @@ Do not enable AWS Lake Formation for fine-grained access control. A job cannot s -To use Full Table Access (FTA) mode, you need to allow third-party query engines to access data without the IAM session tag validation in AWS Lake Formation. To enable, follow the steps in [Application integration for full table access](https://docs.aws.amazon.com/lake-formation/latest/dg/full-table-credential-vending.html). +To use Full Table Access (FTA) mode, you must allow third-party query engines to access data without the IAM session tag validation in AWS Lake Formation. To enable, follow the steps in [Application integration for full table access](https://docs.aws.amazon.com/lake-formation/latest/dg/full-table-credential-vending.html). @@ -100 +100 @@ JSON -For more information, see [Granting permissions on Data Catalog resources](https://docs.aws.amazon.com/lake-formation/latest/dg/granting-catalog-permissions.html). +For more information, refer to [Granting permissions on Data Catalog resources](https://docs.aws.amazon.com/lake-formation/latest/dg/granting-catalog-permissions.html). @@ -114 +114 @@ Set the following settings to configure Glue catalog as a metastore: -For more information on enabling Data Catalog for EMR Serverless, see [Metastore configuration for EMR Serverless](metastore-config.html). +For more information on enabling Data Catalog for EMR Serverless, refer to [Metastore configuration for EMR Serverless](metastore-config.html). @@ -169 +169 @@ Delta Lake -To access Lake Formation registered tables from interactive Spark sessions in JupyterLab notebooks, you must use compatibility permission mode. Use the %%configure magic command to set up your Spark configuration. Choose the configuration based on your table type: +To access Lake Formation registered tables from interactive Spark sessions in JupyterLab notebooks, use compatibility permission mode. Use the %%configure magic command to set up your Spark configuration. Choose the configuration based on your table type: @@ -284 +284 @@ Operations not listed above will continue to use IAM permissions to access table - * Jobs referencing tables with Lake Formation Fine-Grained Access Control (FGAC) rules or Glue Data Catalog Views will fail. To query a table with an FGAC rules or a Glue Data Catalog View, you need to use the FGAC mode. You can enable FGAC mode by following the steps outlined in the AWS documentation: [Using EMR Serverless with AWS Lake Formation for fine-grained access control](emr-serverless-lf-enable.html). + * Jobs referencing tables with Lake Formation Fine-Grained Access Control (FGAC) rules or Glue Data Catalog Views will fail. To query a table with an FGAC rules or a Glue Data Catalog View, you must use the FGAC mode. You can enable FGAC mode by following the steps outlined in the AWS documentation: [Using EMR Serverless with AWS Lake Formation for fine-grained access control](emr-serverless-lf-enable.html).