AWS clean-rooms medium security documentation change
Summary
Added security guidance for parameter handling and expanded parameter configuration options in PySpark analysis templates.
Security assessment
The change explicitly adds security warnings about user-provided parameters ('can contain arbitrary content') and instructs to 'handle parameters safely to prevent unexpected behavior'. This directly addresses potential injection risks and unsafe input handling vulnerabilities in analysis templates. The addition of parameter validation rules (naming conventions, length limits) further supports security hardening.
Diff
diff --git a/clean-rooms/latest/userguide/create-pyspark-analysis-template.md b/clean-rooms/latest/userguide/create-pyspark-analysis-template.md index a940e97e0..7e9768a04 100644 --- a//clean-rooms/latest/userguide/create-pyspark-analysis-template.md +++ b//clean-rooms/latest/userguide/create-pyspark-analysis-template.md @@ -6,0 +7,11 @@ +###### Note + +Parameters are user-provided strings that can contain arbitrary content. + + * Review the code to ensure parameters are handled safely to prevent unexpected behavior in your analysis. + + * Design parameter handling to work safely regardless of what parameter values are provided at submission time. + + + + @@ -66 +77,21 @@ For information about how to create a PySpark analysis template using the AWS SD - 8. For **Tables referenced in the definition** , + 8. For **Parameters – optional** , if you want to add parameters to make your analysis template reusable: + + 1. Choose **Add parameter**. + + 2. Enter a **Parameter name**. + +Parameter names must start with a letter or underscore, followed by alphanumeric characters or underscores. + + 3. For **Type** , **STRING** is automatically selected as the only supported type for PySpark analysis templates. + + 4. (Optional) Enter a **Default value** for the parameter. + +If you provide a default value, job runners can use this value when running jobs without explicitly providing a parameter value. + + 5. To add more parameters, choose **Add another parameter** and repeat the previous steps. + +###### Note + +You can define up to 50 parameters per PySpark analysis template. Each parameter value can be up to 1,000 characters. + + 9. For **Tables referenced in the definition** , @@ -84 +115 @@ For information about how to create a PySpark analysis template using the AWS SD - 9. For **Error message configuration** , choose one of the following: + 10. For **Error message configuration** , choose one of the following: @@ -94 +125 @@ When using **Detailed error messages** , all data provider members must approve - 10. Specify the **Service access** permissions by selecting an **Existing service role name** from the dropdown list. + 11. Specify the **Service access** permissions by selecting an **Existing service role name** from the dropdown list. @@ -114 +145 @@ By default, AWS Clean Rooms doesn't attempt to update the existing role policy t - 11. If you want to enable **Tags** for the configured table resource, choose **Add new tag** and then enter the **Key** and **Value** pair. + 12. If you want to enable **Tags** for the configured table resource, choose **Add new tag** and then enter the **Key** and **Value** pair. @@ -116 +147 @@ By default, AWS Clean Rooms doesn't attempt to update the existing role policy t - 12. Choose **Create**. + 13. Choose **Create**. @@ -118 +149 @@ By default, AWS Clean Rooms doesn't attempt to update the existing role policy t - 13. You are now ready to inform your collaboration member that they can [Review an analysis template](./review-analysis-template.html). (Optional if you want to query your own data.) + 14. You are now ready to inform your collaboration member that they can [Review an analysis template](./review-analysis-template.html). (Optional if you want to query your own data.)