AWS emr documentation change
Summary
Updated phrasing for S3 Express One Zone usage instructions, including imperative verb changes and clarification about S3A connector requirements.
Security assessment
While the documentation mentions required IAM permissions (s3express:CreateSession), this is a refinement of existing security guidance rather than a new security feature or vulnerability fix. The changes emphasize proper configuration but do not address a specific security flaw.
Diff
diff --git a/emr/latest/EMR-Serverless-UserGuide/upload-data.md b/emr/latest/EMR-Serverless-UserGuide/upload-data.md index ba439fa05..db572661b 100644 --- a//emr/latest/EMR-Serverless-UserGuide/upload-data.md +++ b//emr/latest/EMR-Serverless-UserGuide/upload-data.md @@ -9 +9 @@ PrerequisitesGetting started with S3 Express One Zone -With Amazon EMR releases 7.2.0 and higher, you can use EMR Serverless with the [Amazon S3 Express One Zone](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-one-zone.html) storage class for improved performance when you run jobs and workloads. S3 Express One Zone is a a high-performance, single-zone Amazon S3 storage class that delivers consistent, single-digit millisecond data access for most latency-sensitive applications. At the time of its release, S3 Express One Zone delivers the lowest latency and highest performance cloud object storage in Amazon S3. +With Amazon EMR releases 7.2.0 and higher, use EMR Serverless with the [Amazon S3 Express One Zone](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-one-zone.html) storage class for improved performance when you run jobs and workloads. S3 Express One Zone is a a high-performance, single-zone Amazon S3 storage class that delivers consistent, single-digit millisecond data access for most latency-sensitive applications. At the time of its release, S3 Express One Zone delivers the lowest latency and highest performance cloud object storage in Amazon S3. @@ -13 +13 @@ With Amazon EMR releases 7.2.0 and higher, you can use EMR Serverless with the [ - * S3 Express One Zone permissions – When S3 Express One Zone initially performs an action like `GET`, `LIST`, or `PUT` on an S3 object, the storage class calls `CreateSession` on your behalf. Your IAM policy must allow the `s3express:CreateSession` permission so that the S3A connector can invoke the `CreateSession` API. For an example policy with this permission, see Getting started with S3 Express One Zone. + * S3 Express One Zone permissions – When S3 Express One Zone initially performs an action like `GET`, `LIST`, or `PUT` on an S3 object, the storage class calls `CreateSession` on your behalf. Your IAM policy must allow the `s3express:CreateSession` permission so that the S3A connector can invoke the `CreateSession` API. For an example policy with this permission, refer to Getting started with S3 Express One Zone. @@ -15 +15 @@ With Amazon EMR releases 7.2.0 and higher, you can use EMR Serverless with the [ - * S3A connector – To configure Spark to access data from an Amazon S3 bucket that uses the S3 Express One Zone storage class, you must use the Apache Hadoop connector S3A. To use the connector, ensure all S3 URIs use the `s3a` scheme. If they don’t, you can change the filesystem implementation that you use for `s3` and `s3n` schemes. + * S3A connector – To configure Spark to access data from an Amazon S3 bucket that uses the S3 Express One Zone storage class, use the Apache Hadoop connector S3A. To use the connector, ensure all S3 URIs use the `s3a` scheme. If they don’t, change the filesystem implementation that you use for `s3` and `s3n` schemes. @@ -81 +81 @@ JSON - 5. Run your job. Note that you must use the `S3A` scheme to access S3 Express One Zone buckets. + 5. Run your job. Note that use the `S3A` scheme to access S3 Express One Zone buckets.