AWS athena high security documentation change
Summary
Added security update notes for v2.1.0.0: PKCE implementation to prevent authorization code interception attacks and details on secure credential caching.
Security assessment
Explicitly mentions a security update addressing authorization code interception attacks via PKCE, which is a concrete security improvement. Also documents secure storage of cached credentials with file permission restrictions.
Diff
diff --git a/athena/latest/ug/odbc-v2-driver-browser-azure-ad.md b/athena/latest/ug/odbc-v2-driver-browser-azure-ad.md index d96a676db..e666c986b 100644 --- a//athena/latest/ug/odbc-v2-driver-browser-azure-ad.md +++ b//athena/latest/ug/odbc-v2-driver-browser-azure-ad.md @@ -10,0 +11,4 @@ Browser Azure AD is a SAML based authentication plugin that works with Azure AD +###### Note + +v2.1.0.0 security update: Starting in v2.1.0.0, the BrowserAzureAD plugin includes PKCE (Proof Key for Code Exchange) in the OAuth 2.0 authorization flow. This prevents authorization code interception attacks on shared systems. No configuration changes are required. + @@ -60,0 +65,4 @@ Enables a temporary credentials cache. This connection parameter enables tempora +###### Note + +Starting in v2.1.0.0, cached credentials are stored as plaintext JSON in the `user-profile/.athena-odbc/` directory with file permissions restricted to the owning user, consistent with how the AWS CLI protects locally stored credentials. +