AWS timestream documentation change

Service: timestream · 2025-11-25 · Documentation medium

File: timestream/latest/developerguide/export-unload-prerequisites.md

Summary

Added detailed IAM policy examples for Timestream UNLOAD operations with S3 and KMS permissions

Security assessment

Provides security configuration examples for data export permissions but does not address a specific vulnerability

Diff

diff --git a/timestream/latest/developerguide/export-unload-prerequisites.md b/timestream/latest/developerguide/export-unload-prerequisites.md
index 4d32e44f9..a74bd9d72 100644
--- a//timestream/latest/developerguide/export-unload-prerequisites.md
+++ b//timestream/latest/developerguide/export-unload-prerequisites.md
@@ -21,0 +22,36 @@ Following are prerequisites for writing data to S3 using `UNLOAD` from Timestrea
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",		 	 	 
+        "Statement": [{
+                "Effect": "Allow",
+                "Action": [
+                    "timestream:Select",
+                    "timestream:ListMeasures",
+                    "timestream:WriteRecords",
+                    "timestream:Unload"
+                ],
+                "Resource": "arn:aws:timestream:us-east-2:111122223333:database/database_name/table/table_name"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "s3:GetBucketAcl",
+                    "s3:PutObject",
+                    "s3:GetObject",
+                    "s3:AbortMultipartUpload"
+                ],
+                "Resource": [
+                    "arn:aws:s3:::S3_Bucket_Created",
+                    "arn:aws:s3:::S3_Bucket_Created/*"
+                ]
+            }
+        ]
+    }
+    
+
@@ -23,0 +60,48 @@ For additional context on these S3 write permissions, refer to the [Amazon Simpl
+JSON
+    
+
+****
+    
+    
+    
+    {
+        "Version":"2012-10-17",		 	 	 
+        "Statement": [
+          {
+            "Effect": "Allow",
+            "Action": [
+                "kms:DescribeKey",
+                "kms:Decrypt",
+                "kms:GenerateDataKey*"
+            ],
+            "Resource": "arn:aws:kms:us-east-2:111122223333:key/*",
+            "Condition": {
+                "ForAnyValue:StringLike": {
+                    "kms:ResourceAliases": "alias/Alias_For_Generated_Key"
+                }
+            }
+        }, {
+            "Effect": "Allow",
+            "Action": [
+                "kms:CreateGrant"
+            ],
+            "Resource": "arn:aws:kms:us-east-2:111122223333:key/*",
+            "Condition": {
+                "ForAnyValue:StringEquals": {
+                    "kms:EncryptionContextKeys": "aws:timestream:database_name"
+                },
+                "Bool": {
+                    "kms:GrantIsForAWSResource": true
+                },
+                "StringLike": {
+                    "kms:ViaService": "timestream.us-east-2.amazonaws.com"
+                },
+                "ForAnyValue:StringLike": {
+                    "kms:ResourceAliases": "alias/Alias_For_Generated_Key"
+                }
+            }
+        }
+    ]
+    }
+    
+