AWS redshift medium security documentation change
Summary
Added limitations for GLOBAL IDENTITY IAM roles and linked to AWS managed policy documentation
Security assessment
Clarifying that users with GLOBAL IDENTITY roles cannot modify views enforces least-privilege access, addressing a potential misconfiguration risk. Linking to the managed policy improves security guidance.
Diff
diff --git a/redshift/latest/dg/federated-permissions-onboarding.md b/redshift/latest/dg/federated-permissions-onboarding.md index 3bdc83d7b..beb25516e 100644 --- a//redshift/latest/dg/federated-permissions-onboarding.md +++ b//redshift/latest/dg/federated-permissions-onboarding.md @@ -290 +290 @@ This feature is useful for following use cases: -Requirements: +Requirements and limitations: @@ -296 +296,3 @@ Requirements: - * IAM role must have permissions to access resources needed to run queries on Redshift warehouses with federated permissions. We recommend using `AmazonRedshiftFederatedAuthorization` AWS managed policy. + * IAM role must have permissions to access resources needed to run queries on Redshift warehouses with federated permissions. We recommend using `[AmazonRedshiftFederatedAuthorization](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRedshiftFederatedAuthorization.html)` AWS managed policy. + + * The users authenticating via GLOBAL IDENTITY IAM role can query views in Redshift Warehouses with Federated Permissions, but cannot CREATE, ALTER, REFRESH or DROP them. @@ -331 +333 @@ IAM_ROLE 'arn:aws:iam::<account-id>:role/<role-name>' -Use the Amazon Resource Name (ARN) for an IAM role that your cluster uses for authentication and authorization when user `username` runs queries on Redshift warehouses with federated permissions. This role needs to have the required permissions to run the query. We recommend using `AmazonRedshiftFederatedAuthorization` AWS Managed Policy. +Use the Amazon Resource Name (ARN) for an IAM role that your cluster uses for authentication and authorization when user `username` runs queries on Redshift warehouses with federated permissions. This role needs to have the required permissions to run the query. We recommend using `[AmazonRedshiftFederatedAuthorization](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRedshiftFederatedAuthorization.html)` AWS Managed Policy.