AWS firehose documentation change
Summary
Updated documentation to clarify IAM role permissions for Firehose when writing to Amazon S3 table buckets, distinguishing between IAM access control and Lake Formation access control modes.
Security assessment
The change provides more detailed guidance on configuring IAM roles and permissions for accessing AWS Glue tables and S3 table buckets. It clarifies the two access control modes (IAM and Lake Formation) but does not indicate a fix for a specific security vulnerability or incident. The update enhances security documentation by explaining permission requirements.
Diff
diff --git a/firehose/latest/dev/apache-iceberg-prereq.md b/firehose/latest/dev/apache-iceberg-prereq.md index 85ed9ebb8..d05e6ce6d 100644 --- a//firehose/latest/dev/apache-iceberg-prereq.md +++ b//firehose/latest/dev/apache-iceberg-prereq.md @@ -49 +49 @@ To deliver data to Amazon S3 table buckets, complete the following prerequisites - * **Create an IAM role with required permissions** – Firehose needs an IAM role with specific permissions to access AWS Glue tables and write data to tables in an Amazon S3 table bucket. To write to tables in an S3 table bucket, you must also provide the IAM role with the required permissions in AWS Lake Formation. You configure this IAM role when you create a Firehose stream. For more information, see [Grant Firehose access to Amazon S3 Tables](https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-s3-tablesusing-iam-iceberg). + * **Create an IAM role with required permissions** – Firehose needs an IAM role with specific permissions to access AWS AWS Glue tables and write data to tables in an Amazon S3 table bucket. To write to tables in an Amazon S3 table bucket, you must also provide the IAM role with the required permissions. The permissions required for Amazon S3 Tables catalog depend on the access control mode you use: @@ -51 +51,5 @@ To deliver data to Amazon S3 table buckets, complete the following prerequisites - * **Configure AWS Lake Formation permissions** – AWS Lake Formation manages access to your table resources. Lake Formation uses its own [permissions model](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html#grant-permissions-tables) that enables fine-grained access control for Data Catalog resources. + * **IAM access control** – The Firehose delivery role needs IAM permissions directly on Amazon S3 Tables resources. + + * **Lake Formation access control** – The Firehose delivery role needs AWS AWS Lake Formation permissions for managing access to your table resources. AWS Lake Formation uses its own permissions model that enables fine-grained access control for Data Catalog resources. + +You configure this IAM role when you create a Firehose stream. For more information, see [Grant Firehose access to Amazon S3 Tables](https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-s3-tables).