AWS lake-formation medium security documentation change

Service: lake-formation · 2026-01-16 · Security-related medium

File: lake-formation/latest/dg/materialized-views.md

Summary

Updated IAM policy snippet to use sts:AssumeRole with Glue service principal instead of iam:PassRole.

Security assessment

Corrects IAM permissions to follow security best practices (service-linked roles). Using sts:AssumeRole reduces over-permissioning risks compared to iam:PassRole.

Diff

diff --git a/lake-formation/latest/dg/materialized-views.md b/lake-formation/latest/dg/materialized-views.md
index 52d103774..7344a49d9 100644
--- a//lake-formation/latest/dg/materialized-views.md
+++ b//lake-formation/latest/dg/materialized-views.md
@@ -200,6 +200,4 @@ To let Glue automatically refresh the materialized view for you, the role must a
-          "Action": [
-            "iam:PassRole"
-          ],
-          "Resource": [
-            "arn:aws:iam::111122223333:role/materialized-view-role-name"
-          ]
+          "Principal": {
+            "Service": "glue.amazonaws.com"
+          },
+          "Action": "sts:AssumeRole"