AWS athena high security documentation change
Summary
Updated authentication flow to Authorization Code with PKCE, added listen_port parameter, warning about port hijacking in shared environments, and details on secure credential caching.
Security assessment
Explicitly mentions a security update changing from Device Code to Authorization Code with PKCE for improved security, addressing potential authorization vulnerabilities. Also adds warnings about port hijacking risks and mitigation strategies.
Diff
diff --git a/athena/latest/ug/odbc-v2-driver-browser-sso-oidc.md b/athena/latest/ug/odbc-v2-driver-browser-sso-oidc.md index c3e6a3608..496c1badd 100644 --- a//athena/latest/ug/odbc-v2-driver-browser-sso-oidc.md +++ b//athena/latest/ug/odbc-v2-driver-browser-sso-oidc.md @@ -5 +5 @@ -Authentication typeIAM Identity Center Start URLIAM Identity Center RegionScopesAccount IDRole nameTimeoutEnable file cache +Authentication typeIAM Identity Center Start URLIAM Identity Center RegionScopesAccount IDRole nameTimeoutListen portEnable file cache @@ -10,0 +11,4 @@ Browser SSO OIDC is an authentication plugin that works with AWS IAM Identity Ce +###### Note + +v2.1.0.0 security update: Starting in version 2.1.0.0, the BrowserSSOOIDC plugin uses Authorization Code with PKCE instead of Device Code Authorization for improved security. This change eliminates the device code display step and provides faster authentication. A new `listen_port` parameter (default 7890) is used for the OAuth 2.0 callback server. You may need to allowlist this port on your network. The default scope has changed to `sso:account:access`. + @@ -19 +23 @@ AuthenticationType | Required | `IAM Credentials` | `AuthenticationType=BrowserS -The URL for the AWS access portal. The IAM Identity Center [StartDeviceAuthorization](https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_StartDeviceAuthorization.html) API action uses this value for the `startUrl` parameter. +The URL for the AWS access portal. The IAM Identity Center [RegisterClient](https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_RegisterClient.html) API action uses this value for the `issuerUrl` parameter. @@ -50 +54 @@ The list of scopes that are defined by the client. Upon authorization, this list -sso_oidc_scopes | Optional | `none` | `sso_oidc_scopes=scope1,scope2,scope3;` +sso_oidc_scopes | Optional | `sso:account:access` | `sso_oidc_scopes=sso:account:access;` @@ -75,0 +80,21 @@ sso_oidc_timeout | Optional | `120` | `sso_oidc_timeout=60;` +## Listen port + +The local port number to use for the OAuth 2.0 callback server. This is used as the redirect URI and you may need to allowlist this port on your network. The default generated redirect URI is: `http://localhost:7890/athena`. This parameter was added in v2.1.0.0 as part of the migration from Device Code to Authorization Code with PKCE. + +###### Warning + +In shared environments like Windows Terminal Servers or Remote Desktop Services, the loopback port (default: 7890) is shared among all users on the same machine. System administrators can mitigate potential port hijacking risks by: + + * Configuring different port numbers for different user groups + + * Using Windows security policies to restrict port access + + * Implementing network isolation between user sessions + + + + +**Connection string name** | **Parameter type** | **Default value** | **Connection string example** +---|---|---|--- +listen_port | Optional | `7890` | `listen_port=8080;` + @@ -79,0 +105,4 @@ Enables a temporary credentials cache. This connection parameter enables tempora +###### Note + +Starting in v2.1.0.0, cached credentials are stored as plaintext JSON in the `user-profile/.athena-odbc/` directory with file permissions restricted to the owning user, consistent with how the AWS CLI protects locally stored credentials. +