AWS lake-formation documentation change

Service: lake-formation · 2026-03-22 · Documentation low

File: lake-formation/latest/dg/connect-lf-identity-center.md

Summary

Added documentation for enabling Amazon Redshift Connect authorization with Trusted Identity Propagation and multi-region IAM Identity Center support

Security assessment

Documents configuration of Redshift Connect authorization and identity propagation, which are security controls for access management. No evidence of addressing a specific vulnerability.

Diff

diff --git a/lake-formation/latest/dg/connect-lf-identity-center.md b/lake-formation/latest/dg/connect-lf-identity-center.md
index 3809bc22f..2bae222c2 100644
--- a//lake-formation/latest/dg/connect-lf-identity-center.md
+++ b//lake-formation/latest/dg/connect-lf-identity-center.md
@@ -4,0 +5,2 @@
+Using IAM Identity Center across multiple AWS Regions
+
@@ -32 +34,3 @@ Lake Formation permits IAM roles from external accounts to act as carrier roles
-  5. Select **Submit**.
+  5. (Optional) On the **Create Lake Formation integration** screen, check mark the Amazon Redshift Connect checkbox in Trusted Identity Propagation to enable Amazon Redshift Federated Permissions discovery via IDC. Lake Formation propagates identity to downstream based on the effective permissions, so that authorized applications can access data on behalf of users.
+
+  6. Select **Submit**.
@@ -57,0 +62,38 @@ AWS CLI
+  * The following example shows how to enable `Redshift:Connect` Authorization. Authorization can be ENABLED or DISABLED.
+    
+        aws lakeformation  create-lake-formation-identity-center-configuration \
+    --instance-arn <arn:aws:sso:::instance/ssoins-112111f12ca1122p> \
+    --service-integrations '[{
+      "Redshift": [{
+        "RedshiftConnect": {
+          "Authorization": "ENABLED"
+        }
+      }]
+    }]'
+
+  * Use the `describe-lake-formation-identity-center-configuration` command to describe the lake formation identity center application. `Redshift:Connect` service integration is essential for cross-service and cross-cluster IdC identity propagation:
+    
+        aws lakeformation describe-lake-formation-identity-center-configuration --catalog-id <123456789012>
+
+Response:
+    
+        {
+        "CatalogId": "CATALOG ID",
+        "InstanceArn": "INSTANCE ARN",
+        "ApplicationArn": "APPLICATION ARN",
+        "ShareRecipients": [],
+        "ServiceIntegrations": [
+            {
+                "Redshift": [
+                    {
+                        "RedshiftConnect": {
+                            "Authorization": "ENABLED"
+                        }
+                    }
+                ]
+            }
+        ]
+    }
+
+
+
@@ -58,0 +101 @@ AWS CLI
+## Using IAM Identity Center across multiple AWS Regions
@@ -59,0 +103 @@ AWS CLI
+Lake Formation supports IAM Identity Center in multiple AWS Regions. You can extend IAM Identity Center from your primary AWS Region to additional Regions for improved performance through proximity to users and reliability. When a new Region is added in IAM Identity Center, you can create Lake Formation Identity Center applications in the new Region without replicating identities from the primary Region. For more details to get started with IAM Identity Center in multiple Regions, see [Multi-Region IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/multi-region-iam-identity-center.html) in the _IAM Identity Center User Guide_.