AWS athena documentation change
Summary
Added detailed IAM permissions requirements for S3 Tables integration and restructured access control guidance
Security assessment
The changes explicitly document required s3tables permissions for secure access control, including a comprehensive list of IAM actions needed for S3 Tables operations. This improves security documentation but does not indicate a specific vulnerability being patched.
Diff
diff --git a/athena/latest/ug/gdc-register-s3-table-bucket-cat.md b/athena/latest/ug/gdc-register-s3-table-bucket-cat.md index 8f9309c86..5c74428e9 100644 --- a//athena/latest/ug/gdc-register-s3-table-bucket-cat.md +++ b//athena/latest/ug/gdc-register-s3-table-bucket-cat.md @@ -36 +36 @@ Amazon S3 table buckets are a bucket type in Amazon S3 that is purpose-built to - 2. Make sure that the integration of your table buckets with AWS Glue Data Catalog and AWS Lake Formation is successful by following [Prerequisites for integration](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html#table-integration-prerequisites) and [Integrating table buckets with AWS analytics services](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html#table-integration-procedures) in Amazon Simple Storage Service User Guide. + 2. Make sure that the integration of your table buckets with AWS Glue Data Catalog is successful. For required permissions and setup steps, see [Prerequisites for S3 Tables integration](https://docs.aws.amazon.com/glue/latest/dg/s3tables-catalog-prerequisites.html) and [Enabling S3 Tables integration with Glue Data Catalog](https://docs.aws.amazon.com/glue/latest/dg/enable-s3-tables-catalog-integration.html) in the AWS Glue Developer Guide. @@ -38 +38,33 @@ Amazon S3 table buckets are a bucket type in Amazon S3 that is purpose-built to -###### Note + 3. For the principal you use to run queries with Athena, grant permissions on the S3 Table catalog using one of the following approaches: + +**Option 1: Use IAM permissions** + +When using IAM access control, your principal needs permissions on both AWS Glue Data Catalog resources and Amazon S3 Tables resources. + +The following list contains all `s3tables` permissions required to perform any supported DDL or DML operation against your S3 Tables in Athena: + + * `s3tables:GetTableBucket` + + * `s3tables:GetNamespace` + + * `s3tables:GetTable` + + * `s3tables:GetTableData` + + * `s3tables:PutTableData` + + * `s3tables:ListNamespaces` + + * `s3tables:ListTables` + + * `s3tables:DeleteNamespace` + + * `s3tables:DeleteTable` + + * `s3tables:CreateNamespace` + + * `s3tables:CreateTable` + + * `s3tables:UpdateTableMetadataLocation` + +Apply these permissions to specific S3 table bucket and S3 Table resources or use `*` as the resource to grant access to all table buckets and tables in your account. These permissions can be combined with the [`AmazonAthenaFullAccess`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonAthenaFullAccess.html) managed policy to enable complete functionality. @@ -40 +72 @@ Amazon S3 table buckets are a bucket type in Amazon S3 that is purpose-built to -If you enabled the integration while creating an S3 table bucket from the S3 console in Step 1, then you can skip this step. +**Option 2: Use Lake Formation permissions** @@ -42 +74 @@ If you enabled the integration while creating an S3 table bucket from the S3 con - 3. For the principal you use to run queries with Athena, grant Lake Formation permissions on the S3 Table catalog, either through the Lake Formation console or AWS CLI. +Alternatively, to enable fine-grained access control you can grant Lake Formation permissions on the S3 Table catalog, either through the Lake Formation console or AWS CLI. This requires registering your S3 table buckets as a Lake Formation data location. For more information, see [Creating an Amazon S3 Tables catalog in the AWS Glue Data Catalog](https://docs.aws.amazon.com/lake-formation/latest/dg/create-s3-tables-catalog.html) in the Lake Formation Developer Guide. @@ -293 +325 @@ When creating a CTAS query for an S3 Table, there are a few important difference -Before you create S3 Tables using CTAS, ensure that you have the necessary permissions configured in AWS Lake Formation. Specifically, you need permissions to create tables in the S3 Tables catalog. Without these permissions, your CTAS operations will fail. +Before you create S3 Tables using CTAS, ensure that you have the necessary permissions configured in IAM or AWS Lake Formation. Specifically, you need permissions to create tables in the S3 Tables catalog. Without these permissions, your CTAS operations will fail.