AWS lake-formation documentation change
Summary
Restructured prerequisites documentation to clarify IAM permissions required for S3 tables integration, moved legacy integration update instructions to a note section, and updated section titles
Security assessment
The changes explicitly document required IAM permissions (lakeformation:RegisterResource, lakeformation:RegisterResourceWithPrivilegedAccess) and automatic DATA_LOCATION_ACCESS grants when registering locations. While this improves security documentation, there's no evidence of addressing a specific vulnerability or security incident. The changes primarily clarify existing security controls rather than patching a weakness.
Diff
diff --git a/lake-formation/latest/dg/s3tables-catalog-prerequisites.md b/lake-formation/latest/dg/s3tables-catalog-prerequisites.md index 5aae8b260..f002bc7f8 100644 --- a//lake-formation/latest/dg/s3tables-catalog-prerequisites.md +++ b//lake-formation/latest/dg/s3tables-catalog-prerequisites.md @@ -9 +9 @@ Following are the prerequisites to enable Amazon S3 table integration with AWS G - 1. The AWS analytics services integration process has been updated. If you've set up the integration with the preview release, you can continue to use your current integration. However, the updated integration process provides performance improvements. To update the integration: + 1. When you enable the Amazon S3 tables integration, Lake Formation automatically registers the S3 tables' location. To register the table bucket location with Lake Formation, you need an IAM role/user with `lakeformation:RegisterResource`, `lakeformation:RegisterResourceWithPrivilegedAccess`, and `lakeformation:CreateCatalog` permissions. When a non-administrator user with these permissions registers a catalog location, Lake Formation automatically grants them the `DATA_LOCATION_ACCESS` permission for that location allowing the calling principal the permissions to perform all supported Lake Formation operations on the registered data location. @@ -11,17 +11 @@ Following are the prerequisites to enable Amazon S3 table integration with AWS G - 1. First, delete your existing S3 tables catalog in Lake Formation. To delete the catalog, select the `S3tablescatalog` catalog from the catalogs list, and choose **Delete** from **Actions**. - - 2. Next, deregister the data location for the `S3tablescatalog`. - - 1. On the Lake Formation console, under the **Administrations** section, choose **Data Locations**. - - 2. Select a location, and from the **Actions** menu, choose **Remove**. - - 3. When prompted for confirmation, choose **Remove**. - -For detailed instructions on deregistering a data location, see, the [Deregistering an Amazon S3 location](./unregister-location.html) section. - - 4. Then, follow the updated integration steps in the [Enabling Amazon S3 Tables integration](./enable-s3-tables-catalog-integration.html) secton. - - 2. When you enable the Amazon S3 tables integration, Lake Formation automatically registers the S3 tables' location. To register the table bucket location with Lake Formation, you need an IAM role/user with `lakeformation:RegisterResource`, `lakeformation:RegisterResourceWithPrivilegedAccess`, and `lakeformation:CreateCatalog` permissions. When a non-administrator user with these permissions registers a catalog location, Lake Formation automatically grants them the `DATA_LOCATION_ACCESS` permission for that location allowing the calling principal the permissions to perform all supported Lake Formation operations on the registered data location. - - 3. When you enable the S3 tables integration, you need to choose an IAM role for Lake Formation to vend credentials to allow data access. Create an IAM role for Lake Formation data access to your S3 table buckets. The IAM role used when registering the table bucket with Lake Formation requires the following permissions: + 2. When you enable the S3 tables integration, you need to choose an IAM role for Lake Formation to vend credentials to allow data access. Create an IAM role for Lake Formation data access to your S3 table buckets. The IAM role used when registering the table bucket with Lake Formation requires the following permissions: @@ -79 +63 @@ For more information, see [Requirements for roles used to register locations](./ - 4. Add the following trust policy to the IAM role to allow the Lake Formation service to assume the role and vend temporary credentials to the integrated analytical engines. + 3. Add the following trust policy to the IAM role to allow the Lake Formation service to assume the role and vend temporary credentials to the integrated analytical engines. @@ -95,0 +80,21 @@ For more information, see [Requirements for roles used to register locations](./ +###### Note + +The AWS analytics services integration process has been updated. If you've set up the integration with the preview release, you can continue to use your current integration. However, the updated integration process provides performance improvements. To update the integration: + + 1. First, delete your existing S3 tables catalog in Lake Formation. To delete the catalog, select the `s3tablescatalog` catalog from the catalogs list, and choose **Delete** from **Actions**. + + 2. Next, deregister the data location for the `s3tablescatalog`. + + 1. On the Lake Formation console, under the **Administrations** section, choose **Data Locations**. + + 2. Select a location, and from the **Actions** menu, choose **Remove**. + + 3. When prompted for confirmation, choose **Remove**. + +For detailed instructions on deregistering a data location, see the [Deregistering an Amazon S3 location](./unregister-location.html) section. + + 3. Then, follow the updated integration steps in the [Enabling Amazon S3 Tables integration](./enable-s3-tables-catalog-integration.html) section. + + + + @@ -102 +107 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Creating an Amazon S3 tables catalog in the Data Catalog +Amazon S3 Tables integration with Data Catalog and Lake Formation