AWS glue medium security documentation change
Summary
Added a markdown link reference and a 'Known issues' section documenting a bug where tables may not correctly inherit disabled optimizer state from catalog-level configuration
Security assessment
The change documents a known issue where optimizer configurations may not be properly disabled at the table level when disabled at the catalog level. This could lead to unintended optimizer execution, potentially causing data integrity issues, performance impacts, or unexpected costs. While not explicitly labeled as a security vulnerability, improper access control or unintended data processing could have security implications.
Diff
diff --git a/glue/latest/dg/optimizer-notes.md b/glue/latest/dg/optimizer-notes.md index aa6a72a99..74b348a54 100644 --- a//glue/latest/dg/optimizer-notes.md +++ b//glue/latest/dg/optimizer-notes.md @@ -0,0 +1,2 @@ +[View a markdown version of this page](optimizer-notes.md) + @@ -5 +7 @@ -Durability and correctnessSupported formats and limitations for managed data compactionConsiderations for snapshot retention and orphan file deletion optimizersDebugging OversizedAllocationException exception +Durability and correctnessKnown issuesSupported formats and limitations for managed data compactionConsiderations for snapshot retention and orphan file deletion optimizersDebugging OversizedAllocationException exception @@ -20,0 +23,4 @@ Amazon S3 lifecycle expiration rules that apply to Iceberg table storage locatio +## Known issues + +The [Catalog-level table optimizers](https://docs.aws.amazon.com/glue/latest/dg/catalog-level-optimizers.html) documentation states that "tables without their own optimizer configurations will inherit the disabled state from the catalog level." There is a known issue where some tables without their own optimizer configuration may not correctly inherit the disabled state from the catalog-level configuration. Use the AWS Glue console and optimizer execution logs to verify which optimizers are currently enabled and running in your account, and disable any that you do not require. +