AWS lake-formation documentation change
Summary
Restructured documentation to explain S3 Tables integration with AWS Glue Data Catalog and Lake Formation, added details about IAM vs Lake Formation access control modes, credential vending, and three integration scenarios.
Security assessment
The changes clarify security controls but do not address a specific vulnerability. Added documentation about Lake Formation's fine-grained access control (column/row-level security) and credential vending features, which are security-related capabilities. However, this appears to be routine documentation improvement rather than a response to a security incident.
Diff
diff --git a/lake-formation/latest/dg/create-s3-tables-catalog.md b/lake-formation/latest/dg/create-s3-tables-catalog.md index cfffd146c..943e50750 100644 --- a//lake-formation/latest/dg/create-s3-tables-catalog.md +++ b//lake-formation/latest/dg/create-s3-tables-catalog.md @@ -7 +7 @@ How Data Catalog and Lake Formation integration works -# Creating an Amazon S3 Tables catalog in the AWS Glue Data Catalog +# Amazon S3 Tables integration with AWS Glue Data Catalog and AWS Lake Formation @@ -11 +11 @@ How Data Catalog and Lake Formation integration works -You can integrate Amazon S3 table buckets and tables with AWS Glue Data Catalog (Data Catalog), and register the catalog as a Lake Formation data location from the Lake Formation console or using service APIs. When your organization manages data in the Data Catalog, and register the data location with Lake Formation, you can use Lake Formation to control access to your datasets. +You can integrate Amazon S3 Tables with AWS Glue Data Catalog using either IAM access controls or with IAM and Lake Formation grants: @@ -13 +13 @@ You can integrate Amazon S3 table buckets and tables with AWS Glue Data Catalog -You can apply Lake Formation permissions using tag-based access control and the named resource method on the federated databases, and share them across multiple AWS accounts, AWS Organizations, and organizational units (OUs). You can also share the federated databases directly with IAM principals from another account. + * **IAM access control** : Uses IAM policies to control access to S3 Tables and Data Catalog. In this access control approach, you need IAM permissions on both S3 Tables resources and Data Catalog objects to access resources. @@ -15 +15,17 @@ You can apply Lake Formation permissions using tag-based access control and the -For more information, see [Using Amazon S3 Tables with AWS analytics services](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html) in the Amazon Simple Storage Service User Guide. + * **Lake Formation access control** : Uses AWS Lake Formation grants in addition to AWS Glue IAM permissions to control access to S3 Tables through the Data Catalog. In this mode, principals require IAM permissions to interact with the Data Catalog, and Lake Formation grants determine which catalog resources (databases, tables, columns, rows) the principal can access. This mode supports both coarse-grained access control (database-level and table-level grants) and fine-grained access control (column-level and row-level security). When a registered role is configured and credential vending is enabled, S3 Tables IAM permissions are not required for the principal, as Lake Formation vends credentials on behalf of the principal using the registered role. Lake Formation access control also supports credential vending for third-party analytics engines. + + + + +This section provides guidance to configure the integration with AWS Lake Formation for the following scenarios: + + * **Scenario A** : You integrated S3 Tables and Data Catalog using IAM access controls and now plan to use AWS Lake Formation. See [Changing access controls for S3 Tables integration](./manage-s3tables-catalog-integration.html) to learn more. + + * **Scenario B** : You plan to integrate S3 Tables and Data Catalog using AWS Lake Formation and do not have them integrated in your account and Region today. Start with the [Prerequisites for integrating Amazon S3 tables catalog with the Data Catalog and Lake Formation](./s3tables-catalog-prerequisites.html) section and follow [Enabling Amazon S3 Tables integration](./enable-s3-tables-catalog-integration.html). + + * **Scenario C** : You integrated S3 Tables and Data Catalog using AWS Lake Formation and now plan to use IAM. See [Changing access controls for S3 Tables integration](./manage-s3tables-catalog-integration.html) to learn more. + + + + +Make sure that you follow the steps in [Integrating S3 Tables with AWS analytics services](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-tables-integrating-aws.html) so that you have the appropriate permissions to access the AWS Glue Data Catalog and your table resources, and to work with AWS analytics services. @@ -50,0 +67,22 @@ After integrating with Lake Formation, you can create Apache Iceberg tables in t +When you also enable Lake Formation with integration, it enables fine-grained access control through AWS Lake Formation. This security approach means that, in addition to AWS Identity and Access Management (IAM) permissions, you must grant your IAM principal with Lake Formation permissions on your tables before you can work with them. + +There are two main types of permissions in AWS Lake Formation: + + * Metadata access permissions control the ability to create, read, update, and delete metadata databases and tables in the Data Catalog. + + * Underlying data access permissions control the ability to read and write data to the underlying Amazon S3 locations that the Data Catalog resources point to. + + + + +Lake Formation uses a combination of its own permissions model and the IAM permissions model to control access to Data Catalog resources and underlying data: + + * For a request to access Data Catalog resources or underlying data to succeed, the request must pass permission checks by both IAM and Lake Formation. + + * IAM permissions control access to the Lake Formation and AWS Glue APIs and resources, whereas Lake Formation permissions control access to the Data Catalog resources, Amazon S3 locations, and the underlying data. + + + + +Lake Formation permissions apply only in the Region in which they were granted, and a principal must be authorized by a data lake administrator or another principal with the necessary permissions in order to be granted Lake Formation permissions. +