AWS AmazonS3 documentation change
Summary
Updated integration details from SageMaker Lakehouse to AWS Glue Data Catalog, added supported regions list, restructured permissions section, and clarified automated integration process.
Security assessment
The changes primarily focus on service integration mechanisms (AWS Glue vs Lake Formation) and regional availability. While permissions are discussed, there is no evidence of addressing a specific security vulnerability. The removal of Lake Formation permissions details in some regions reflects architectural changes rather than security fixes.
Diff
diff --git a/AmazonS3/latest/userguide/s3-tables-integration-overview.md b/AmazonS3/latest/userguide/s3-tables-integration-overview.md index 04d6a44c8..719605dee 100644 --- a//AmazonS3/latest/userguide/s3-tables-integration-overview.md +++ b//AmazonS3/latest/userguide/s3-tables-integration-overview.md @@ -5 +5 @@ -How the integration worksNext steps +How the integration worksRegions supportedNext steps @@ -9 +9 @@ How the integration worksNext steps -To make tables in your account accessible by AWS analytics services, you integrate your Amazon S3 table buckets with Amazon SageMaker Lakehouse. This integration allows AWS analytics services to automatically discover and access your table data. You can use this integration to work with your tables in these services: +To make tables in your account accessible by AWS analytics services, you integrate your Amazon S3 table buckets with AWS Glue Data Catalog. This integration allows AWS analytics services to automatically discover and access your table data. You can use this integration to work with your tables in these services: @@ -26 +26 @@ To make tables in your account accessible by AWS analytics services, you integra -This integration uses the AWS Glue and AWS Lake Formation services and might incur AWS Glue request and storage costs. For more information, see [AWS Glue Pricing.](https://aws.amazon.com/glue/pricing/) +This integration uses AWS Glue and AWS Lake Formation services and might incur AWS Glue request and storage costs. For more information, see [AWS Glue Pricing.](https://aws.amazon.com/glue/pricing/) @@ -32 +32 @@ Additional pricing applies for running queries on your S3 tables. For more infor -When you create a table bucket in the console, Amazon S3 initiates the following actions to integrate table buckets in the Region that you have selected with AWS analytics services: +When you integrate S3 Tables with the AWS analytics services, Amazon S3 adds the catalog named `s3tablescatalog` to the AWS Glue Data Catalog in the current Region. Adding the `s3tablescatalog` allows all your table buckets, namespaces, and tables to be populated in the Data Catalog. @@ -34 +34 @@ When you create a table bucket in the console, Amazon S3 initiates the following - 1. Creates a new AWS Identity and Access Management (IAM) [service role](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_roles_create_for-service.html) that gives Lake Formation access to all your table buckets. +###### Note @@ -36 +36 @@ When you create a table bucket in the console, Amazon S3 initiates the following - 2. Using the service role, Lake Formation registers table buckets in the current Region. This allows Lake Formation to manage access, permissions, and governance for all current and future table buckets in that Region. +These actions are automated through the Amazon S3 console. If you perform this integration programmatically, you must manually take these actions. @@ -38 +38 @@ When you create a table bucket in the console, Amazon S3 initiates the following - 3. Adds the `s3tablescatalog` catalog to the AWS Glue Data Catalog in the current Region. Adding the `s3tablescatalog` catalog allows all your table buckets, namespaces, and tables to be populated in the Data Catalog. +You integrate your table buckets once per AWS Region. After the integration is completed, all current and future table buckets, namespaces, and tables are added to the AWS Glue Data Catalog in that Region. @@ -39,0 +40 @@ When you create a table bucket in the console, Amazon S3 initiates the following +The following illustration shows how the `s3tablescatalog` catalog automatically populates table buckets, namespaces, and tables in the current Region as corresponding objects in the Data Catalog. Table buckets are populated as subcatalogs. Namespaces within a table bucket are populated as databases within their respective subcatalogs. Tables are populated as tables in their respective databases. @@ -40,0 +42 @@ When you create a table bucket in the console, Amazon S3 initiates the following + @@ -41,0 +44 @@ When you create a table bucket in the console, Amazon S3 initiates the following +After integrating with Data Catalog, you can create Apache Iceberg tables in table buckets and access them via AWS analytics engines such as Amazon Athena, Amazon EMR, as well as third-party analytics engines. @@ -43 +46 @@ When you create a table bucket in the console, Amazon S3 initiates the following -###### Note +###### How permissions work @@ -45 +48 @@ When you create a table bucket in the console, Amazon S3 initiates the following -These actions are automated through the Amazon S3 console. If you perform this integration programmatically, you must manually take all of these actions. +We recommend integrating your table buckets with AWS analytics services so that you can work with your table data across services that use the AWS Glue Data Catalog as a metadata store. Once the integration is enabled, you can use AWS Identity and Access Management (IAM) permissions to grant access to S3 Tables resources and their associated Data Catalog objects. @@ -47 +50 @@ These actions are automated through the Amazon S3 console. If you perform this i -You integrate your table buckets once per AWS Region. After the integration is completed, all current and future table buckets, namespaces, and tables are added to the AWS Glue Data Catalog in that Region. +Make sure that you follow the steps in [Integrating S3 Tables with AWS analytics services](./s3-tables-integrating-aws.html) so that you have the appropriate permissions to access the AWS Glue Data Catalog and your table resources, and to work with AWS analytics services. @@ -49 +52 @@ You integrate your table buckets once per AWS Region. After the integration is c -The following illustration shows how the `s3tablescatalog` catalog automatically populates table buckets, namespaces, and tables in the current Region as corresponding objects in the Data Catalog. Table buckets are populated as subcatalogs. Namespaces within a table bucket are populated as databases within their respective subcatalogs. Tables are populated as tables in their respective databases. +## Regions supported @@ -51 +54 @@ The following illustration shows how the `s3tablescatalog` catalog automatically - +S3 Tables integration with AWS analytics services uses AWS Glue Data Catalog with IAM-based access controls in the following regions. In all other regions, the integration also requires AWS Lake Formation. @@ -53 +56 @@ The following illustration shows how the `s3tablescatalog` catalog automatically -###### How permissions work + * US East (N. Virginia) @@ -55 +58 @@ The following illustration shows how the `s3tablescatalog` catalog automatically -We recommend integrating your table buckets with AWS analytics services so that you can work with your table data across services that use the AWS Glue Data Catalog as a metadata store. The integration enables fine-grained access control through AWS Lake Formation. This security approach means that, in addition to AWS Identity and Access Management (IAM) permissions, you must grant your IAM principal Lake Formation permissions on your tables before you can work with them. + * US East (Ohio) @@ -57 +60 @@ We recommend integrating your table buckets with AWS analytics services so that -There are two main types of permissions in AWS Lake Formation: + * US West (N. California) @@ -59 +62 @@ There are two main types of permissions in AWS Lake Formation: - * Metadata access permissions control the ability to create, read, update, and delete metadata databases and tables in the Data Catalog. + * US West (Oregon) @@ -61 +64 @@ There are two main types of permissions in AWS Lake Formation: - * Underlying data access permissions control the ability to read and write data to the underlying Amazon S3 locations that the Data Catalog resources point to. + * Africa (Cape Town) @@ -62,0 +66 @@ There are two main types of permissions in AWS Lake Formation: + * Asia Pacific (Hong Kong) @@ -63,0 +68 @@ There are two main types of permissions in AWS Lake Formation: + * Asia Pacific (Taipei) @@ -64,0 +70 @@ There are two main types of permissions in AWS Lake Formation: + * Asia Pacific (Tokyo) @@ -66 +72 @@ There are two main types of permissions in AWS Lake Formation: -Lake Formation uses a combination of its own permissions model and the IAM permissions model to control access to Data Catalog resources and underlying data: + * Asia Pacific (Seoul) @@ -68 +74 @@ Lake Formation uses a combination of its own permissions model and the IAM permi - * For a request to access Data Catalog resources or underlying data to succeed, the request must pass permission checks by both IAM and Lake Formation. + * Asia Pacific (Osaka) @@ -70 +76 @@ Lake Formation uses a combination of its own permissions model and the IAM permi - * IAM permissions control access to the Lake Formation and AWS Glue APIs and resources, whereas Lake Formation permissions control access to the Data Catalog resources, Amazon S3 locations, and the underlying data. + * Asia Pacific (Mumbai) @@ -71,0 +78 @@ Lake Formation uses a combination of its own permissions model and the IAM permi + * Asia Pacific (Hyderabad) @@ -72,0 +80 @@ Lake Formation uses a combination of its own permissions model and the IAM permi + * Asia Pacific (Singapore) @@ -73,0 +82,37 @@ Lake Formation uses a combination of its own permissions model and the IAM permi + * Asia Pacific (Sydney) + + * Asia Pacific (Jakarta) + + * Asia Pacific (Melbourne) + + * Asia Pacific (Malaysia) + + * Asia Pacific (New Zealand) + + * Asia Pacific (Thailand) + + * Canada (Central) + + * Canada West (Calgary) + + * Europe (Frankfurt) + + * Europe (Zurich) + + * Europe (Stockholm) + + * Europe (Milan) + + * Europe (Spain) + + * Europe (Ireland) + + * Europe (London) + + * Europe (Paris) + + * Israel (Tel Aviv) + + * Mexico (Central) + + * South America (São Paulo) @@ -75 +119,0 @@ Lake Formation uses a combination of its own permissions model and the IAM permi -Lake Formation permissions apply only in the Region in which they were granted, and a principal must be authorized by a data lake administrator or another principal with the necessary permissions in order to be granted Lake Formation permissions. @@ -77 +120,0 @@ Lake Formation permissions apply only in the Region in which they were granted, -For more information, see [Overview of Lake Formation permissions](https://docs.aws.amazon.com/lake-formation/latest/dg/lf-permissions-overview.html) in the _AWS Lake Formation Developer Guide_. @@ -79 +121,0 @@ For more information, see [Overview of Lake Formation permissions](https://docs. -Make sure that you follow the steps in [Integrating S3 Tables with AWS analytics services](./s3-tables-integrating-aws.html) so that you have the appropriate permissions to access the AWS Glue Data Catalog and your table resources, and to work with AWS analytics services.