AWS AmazonS3 documentation change
Summary
Updated documentation for AWS managed table buckets with expanded permissions guidance, encryption clarification, and policy examples including KMS key references
Security assessment
The changes add explicit references to AWS KMS keys in IAM policy examples and clarify encryption requirements (SSE-S3 vs customer-managed KMS keys). While this improves security documentation by emphasizing encryption controls, there is no evidence of addressing a specific vulnerability.
Diff
diff --git a/AmazonS3/latest/userguide/s3-tables-aws-managed-buckets.md b/AmazonS3/latest/userguide/s3-tables-aws-managed-buckets.md index 8cb2a1483..fbfc24332 100644 --- a//AmazonS3/latest/userguide/s3-tables-aws-managed-buckets.md +++ b//AmazonS3/latest/userguide/s3-tables-aws-managed-buckets.md @@ -5 +5 @@ -Permissions to create AWS managed table bucketsQuerying tables in AWS managed table bucketsEncryption for AWS managed table buckets +Permissions to work with AWS managed table buckets and to query tablesQuerying tables in AWS managed table bucketsEncryption for AWS managed table buckets @@ -9 +9,3 @@ Permissions to create AWS managed table bucketsQuerying tables in AWS managed ta -AWS managed table buckets are specialized S3 table buckets designed to store AWS managed tables, such as [Discovering your data with S3 Metadata tables](./metadata-tables-overview.html) journal and live inventory tables. Unlike customer-managed table buckets that you create and manage directly, AWS managed table buckets are automatically provisioned by AWS when you configure features that require AWS managed tables. When managed tables are created, they belong to a predefined namespace based on the source bucket that can't be modified. Each AWS account has one AWS managed table bucket per Region, following the naming convention `aws-s3`. This bucket serves as a centralized location for all managed tables associated with your account's resources in that Region. +AWS managed table buckets are specialized Amazon S3 table buckets designed to store AWS managed tables, such as [S3 Metadata](./metadata-tables-overview.html) journal and live inventory tables. Unlike customer-managed table buckets that you create and manage directly, AWS managed table buckets are automatically provisioned by AWS when you configure features that require AWS managed tables. When managed tables are created, they belong to a predefined namespace that's based on the name of the source bucket. This predefined namespace can't be modified. + +Each AWS account has one AWS managed table bucket per Region, following the naming convention `aws-s3`. This bucket serves as a centralized location for all managed tables associated with your account's resources in that Region. @@ -16 +18 @@ The following table compares AWS managed table buckets with customer-managed tab -**Naming** | Use a standard naming convention (aws-s3) | You define your own names +**Naming** | Use a standard naming convention (`aws-s3`) | You define your own names @@ -18 +20 @@ The following table compares AWS managed table buckets with customer-managed tab -**Namespace control** | You can't create or delete namespaces (All tables belong to a fixed namespace) | You can create and delete namespaces +**Namespace control** | You can't create or delete namespaces (all tables belong to a fixed namespace) | You can create and delete namespaces @@ -20,2 +22,2 @@ The following table compares AWS managed table buckets with customer-managed tab -**Encryption** | You can only change the default encryption (SSE-S3) settings if you encrypted the initial table with a customer manged AWS KMS key. | You can set bucket-level default encryption and modify it anytime -**Maintenance** | Managed by AWS services | Automated maintenance can be customized at bucket level +**Encryption** | You can change the default encryption (SSE-S3) settings only if you encrypted the initial table with a customer managed AWS Key Management Service (AWS KMS) key | You can set bucket-level default encryption and modify it anytime +**Maintenance** | Managed by AWS services | You can customize automated maintenance at the bucket level @@ -23 +25 @@ The following table compares AWS managed table buckets with customer-managed tab -## Permissions to create AWS managed table buckets +## Permissions to work with AWS managed table buckets and to query tables @@ -25 +27 @@ The following table compares AWS managed table buckets with customer-managed tab -To work with AWS managed table buckets, you need permissions to create AWS managed table buckets and tables, specify encryption settings for AWS managed tables as well as basic read permissions for querying tables. +To work with AWS managed table buckets, you need permissions to create AWS managed table buckets and tables and to specify encryption settings for AWS managed tables. You also need permissions to query the tables in your AWS managed table buckets. @@ -27 +29 @@ To work with AWS managed table buckets, you need permissions to create AWS manag -The following is an example policy that will allow you to create an AWS managed table bucket through service configurations: +The following example policy allows you to create an AWS managed table bucket through an S3 Metadata configuration: @@ -48,2 +50,3 @@ The following is an example policy that will allow you to create an AWS managed - "arn:aws:s3tables:region:111122223333:bucket/aws-s3", - "arn:aws:s3tables:region:111122223333:bucket/aws-s3/table/*" + "arn:aws:s3tables:us-east-1:111122223333:bucket/aws-s3", + "arn:aws:s3tables:us-east-1:111122223333:bucket/aws-s3/table/*", + "arn:aws:kms:us-east-1:111122223333:key/01234567-89ab-cdef-0123-456789abcdef" @@ -55 +58 @@ The following is an example policy that will allow you to create an AWS managed -The following is an example policy that will allow you to query tables in AWS managed table buckets: +The following example policy allows you to query tables in AWS managed table buckets: @@ -62 +65 @@ The following is an example policy that will allow you to query tables in AWS ma - "Sid":"PermissionsToWorkWithMetadataTables", + "Sid":"PermissionsToQueryMetadataTables", @@ -71,2 +74,3 @@ The following is an example policy that will allow you to query tables in AWS ma - "arn:aws:s3tables:region:111122223333:bucket/aws-s3", - "arn:aws:s3tables:region:111122223333:bucket/aws-s3/table/*" + "arn:aws:s3tables:us-east-1:111122223333:bucket/aws-s3", + "arn:aws:s3tables:us-east-1:111122223333:bucket/aws-s3/table/*", + "arn:aws:kms:us-east-1:111122223333:key/01234567-89ab-cdef-0123-456789abcdef" @@ -80 +84 @@ The following is an example policy that will allow you to query tables in AWS ma -You can query AWS managed tables in AWS managed table buckets using access methods and engines supported by S3 Tables. The following are some example queries +You can query AWS managed tables in AWS managed table buckets using access methods and engines supported by S3 Tables. The following are some example queries. @@ -85 +89 @@ Using standard SQL -The following example shows how to query AWS managed tables using standard SQL syntax. +The following example shows how to query AWS managed tables using standard SQL syntax: @@ -92 +96 @@ The following example shows how to query AWS managed tables using standard SQL s -The following example shows how to join AWS managed tables with your own tables. +The following example shows how to join AWS managed tables with your own tables: @@ -104 +108 @@ Using Spark -The following example shows how to query your table with Spark. +The following example shows how to query your table with Spark: @@ -114 +118 @@ The following example shows how to query your table with Spark. -The following example shows how to joining your AWS managed table with another table. +The following example shows how to joining your AWS managed table with another table: