AWS neptune documentation change
Summary
Restructured documentation to focus on cross-account IAM authentication, removed outdated TinkerPop version-specific instructions, and consolidated SigV4 connection examples.
Security assessment
The changes improve documentation for IAM authentication (security feature) but show no evidence of addressing a specific vulnerability. Removed deprecated implementation guidance without security incident references.
Diff
diff --git a/neptune/latest/userguide/iam-auth-connecting-gremlin-java.md b/neptune/latest/userguide/iam-auth-connecting-gremlin-java.md index 2e6ac8f3c..2fccbdd68 100644 --- a//neptune/latest/userguide/iam-auth-connecting-gremlin-java.md +++ b//neptune/latest/userguide/iam-auth-connecting-gremlin-java.md @@ -5 +5 @@ -Using TinkerPop 3.4.11 or higherBefore TinkerPop 3.4.11 +Cross account IAM authentication @@ -9,3 +9 @@ Using TinkerPop 3.4.11 or higherBefore TinkerPop 3.4.11 -## Using TinkerPop 3.4.11 or higher to connect to Neptune with Sig4 signing - -Here is an example of how to connect to Neptune using the Gremlin Java API with Sig4 signing when using TinkerPop 3.4.11 or higher (it assumes general knowledge about using Maven). This example uses the [ Amazon Neptune SigV4 Signer](https://github.com/aws/amazon-neptune-sigv4-signer) library to assist in request signing. First, define the dependencies as part of the `pom.xml` file: +Here is an example of how to connect to Neptune using the Gremlin Java driver with Sigv4 signing (it assumes a general knowledge about using Maven). @@ -59,5 +57 @@ The Amazon Neptune SigV4 Signer supports use of both versions 1.x and 2.x of the -###### Note - -If you are upgrading from `3.4.11`, remove references to the `amazon-neptune-gremlin-java-sigv4` library. It is no longer necessary when using `requestInterceptor()` as shown in the example above. Do not attempt to use the `requestInterceptor()` in conjunction with the channelizer (`SigV4WebSocketChannelizer.class`), because it will produce errors. - -### Cross account IAM authentication +## Cross account IAM authentication @@ -150,31 +143,0 @@ JSON -## Using a version of TinkerPop earlier than 3.4.11 to connect to Neptune with Sig4 signing - -TinkerPop versions prior to `3.4.11` did not have support for the `requestInterceptor()` configuration shown in the previous section and therefore must rely on the `amazon-neptune-gremlin-java-sigv4` package. This is a Neptune library that contains the `SigV4WebSocketChannelizer` class, which replaces the standard TinkerPop Channelizer with one that can automatically inject a SigV4 signature. Where possible, ugrade to TinkerPop 3.4.11 or higher, because the `amazon-neptune-gremlin-java-sigv4` library is deprecated. - -Here is an example of how to connect to Neptune using the Gremlin Java API with Sig4 signing when using TinkerPop versions prior to 3.4.11 (it assumes general knowledge about how to use Maven). - -First, define the dependencies as part of the `pom.xml` file: - - - <dependency> - <groupId>com.amazonaws</groupId> - <artifactId>amazon-neptune-gremlin-java-sigv4</artifactId> - <version>2.4.0</version> - </dependency> - -The dependency above will include the Gremlin driver version `3.4.10`. Although it is possible to use newer Gremlin driver versions (up through `3.4.13`), an upgrade of the driver past 3.4.10 should include a change to use the `requestInterceptor()` model described above. - -The `gremlin-driver` Cluster object should then be configured as follows in the Java code: - - - import org.apache.tinkerpop.gremlin.driver.SigV4WebSocketChannelizer; - - ... - - Cluster cluster = Cluster.build(your cluster) - .enableSsl(true) - .channelizer(SigV4WebSocketChannelizer.class) - .create(); - Client client = cluster.connect(); - client.submit("g.V().has('code','IAD')").all().get(); -