AWS cli documentation change
Summary
Added documentation for SET_SOURCE_IDENTITY parameter that enables tracking of IAM roles in CloudTrail logs for S3 GetObject calls
Security assessment
This change adds documentation for a new configuration parameter (SET_SOURCE_IDENTITY) that enhances security auditing capabilities by including IAM role identifiers in CloudTrail logs. This improves audit trail visibility for S3 data access but does not address a specific security vulnerability or incident.
Diff
diff --git a/cli/latest/reference/lakeformation/get-data-lake-settings.md b/cli/latest/reference/lakeformation/get-data-lake-settings.md index 703a31a59..bdc2aee3d 100644 --- a//cli/latest/reference/lakeformation/get-data-lake-settings.md +++ b//cli/latest/reference/lakeformation/get-data-lake-settings.md @@ -15 +15 @@ - * [AWS CLI 2.34.19 Command Reference](../../index.html) » + * [AWS CLI 2.34.20 Command Reference](../../index.html) » @@ -447 +447,6 @@ DataLakeSettings -> (structure) ->> A key-value map that provides an additional configuration on your data lake. CROSS_ACCOUNT_VERSION is the key you can configure in the Parameters field. Accepted values for the CrossAccountVersion key are 1, 2, 3, 4 and 5. +>> A key-value map that provides an additional configuration on your data lake. The following key-value pairs are supported: +>> +>> * `CROSS_ACCOUNT_VERSION` \- Accepted values are 1, 2, 3, 4, and 5. +>> * `SET_SOURCE_IDENTITY` \- Accepted values are `TRUE` and `FALSE` . When set to `TRUE` , Lake Formation includes the IAM role identifier that was used to query in the S3 data event CloudTrail logs for `s3:GetObject` calls. For more information, see [Tracking query engine IAM roles in S3 data events](https://docs.aws.amazon.com/lake-formation/latest/dg/cloudtrail-logging.html#source-identity-cloudtrail) . +>> + @@ -547 +552 @@ DataLakeSettings -> (structure) - * [AWS CLI 2.34.19 Command Reference](../../index.html) » + * [AWS CLI 2.34.20 Command Reference](../../index.html) »