AWS redshift high security documentation change

Service: redshift · 2026-04-04 · Security-related high

File: redshift/latest/mgmt/cross-service-confused-deputy-prevention.md

Summary

Added an example IAM trust policy for Amazon Redshift Serverless to prevent confused deputy attacks by restricting the sts:AssumeRole action to a specific Redshift Serverless workgroup ARN and source account.

Security assessment

The change explicitly adds documentation for preventing confused deputy attacks, a security vulnerability where a service might be tricked into using its permissions on behalf of an unauthorized principal. The example policy uses conditions on aws:SourceArn and aws:SourceAccount to restrict the trust relationship, which is a direct security control.

Diff

diff --git a/redshift/latest/mgmt/cross-service-confused-deputy-prevention.md b/redshift/latest/mgmt/cross-service-confused-deputy-prevention.md
index c2e008162..dd0505c61 100644
--- a//redshift/latest/mgmt/cross-service-confused-deputy-prevention.md
+++ b//redshift/latest/mgmt/cross-service-confused-deputy-prevention.md
@@ -35,0 +36,23 @@ The following example shows a policy that you can apply to limit the confused de
+The following example shows a policy for Amazon Redshift Serverless.
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": {
+        "Sid": "ConfusedDeputyPreventionForRedshiftServerless",
+        "Effect": "Allow",
+        "Principal": {
+          "Service": "redshift-serverless.amazonaws.com"
+        },
+        "Action": "sts:AssumeRole",
+        "Condition": {
+          "ArnLike": {
+            "aws:SourceArn": "arn:aws:redshift-serverless:us-east-1:123456789012:workgroup/my-workgroup"
+          },
+          "StringEquals": {
+            "aws:SourceAccount": "123456789012"
+          }
+        }
+      }
+    }
+