AWS athena documentation change
Summary
Updated documentation for creating Athena data source connections, including clarifications on naming, AWS Glue connection usage, and resource creation. Changed a note to a warning about VPC configuration updates requiring new connections, and added details about resources created for different connector types.
Security assessment
The change adds security documentation by including a warning about VPC configuration properties (security_group_ids, subnet_ids) that cannot be updated in existing Glue Connections, requiring new connections instead. This has security implications as it clarifies that VPC security configurations are immutable after creation, which could impact network security posture if administrators attempt to modify existing connections. However, there is no evidence this addresses a specific security vulnerability or incident.
Diff
diff --git a/athena/latest/ug/connect-to-a-data-source-console-steps.md b/athena/latest/ug/connect-to-a-data-source-console-steps.md index 3a1dd03ba..fa5ac1fd7 100644 --- a//athena/latest/ug/connect-to-a-data-source-console-steps.md +++ b//athena/latest/ug/connect-to-a-data-source-console-steps.md @@ -35 +35 @@ You can use the Athena console to create and configure a data source connection. - 7. On the **Enter data source details** page, for **Data source name** , use the name autogenerated name, or enter a unique name that you want to use in your SQL statements when you query the data source from Athena. The name can be up to 127 characters and must be unique within your account. It cannot be changed after you create it. Valid characters are a-z, A-Z, 0-9, _ (underscore), @ (at sign) and - (hyphen). The names `awsdatacatalog`, `hive`, `jmx`, and `system` are reserved by Athena and cannot be used for data source names. + 7. On the **Enter data source details** page, for **Data source name** , use the autogenerated name, or enter a unique name that you want to use in your SQL statements when you query the data source from Athena. The name can be up to 127 characters and must be unique within your account. It cannot be changed after you create it. Valid characters are a-z, A-Z, 0-9, _ (underscore), @ (at sign) and - (hyphen). The names `awsdatacatalog`, `hive`, `jmx`, and `system` are reserved by Athena and cannot be used for data source names. @@ -37 +37 @@ You can use the Athena console to create and configure a data source connection. - 8. If the data source you choose integrates with AWS Glue connections. + 8. If the data source you choose uses an AWS Glue connection. @@ -41 +41 @@ You can use the Athena console to create and configure a data source connection. -###### Note +###### Warning @@ -43 +43 @@ You can use the Athena console to create and configure a data source connection. - * When you update the Glue connection properties, the Lambda connector needs to be restarted to get the updated properties. To do this, edit the environment properties and save it without actually changing anything. + * The following properties are not allowed to be updated in the Glue Connection. You must create a new connection. @@ -45 +45 @@ You can use the Athena console to create and configure a data source connection. - * When you update a Glue connection, the following properties will not automatically get updated in the corresponding Lambda function. You must manually update your Lambda function for these properties. + * VPC configuration – `security_group_ids`, `subnet_ids` @@ -47 +47 @@ You can use the Athena console to create and configure a data source connection. - * Lambda VPC configuration – `security_group_ids`, `subnet_ids` + 2. For **Glue Data Catalog IAM Role** , see [AWS Glue Data Catalog federated connectors without Lambda permissions](./connect-to-a-data-source-permissions.html#connect-to-a-data-source-permissions-managed). @@ -49 +49 @@ You can use the Athena console to create and configure a data source connection. - * Lambda execution role – `spill_bucket`, `secret_name`, `spill_kms_key_id` +###### Note @@ -51 +51 @@ You can use the Athena console to create and configure a data source connection. - 2. For **Lambda execution IAM role** , choose one of the following: +For **Lambda execution IAM role** , choose one of the following: @@ -57 +57 @@ You can use the Athena console to create and configure a data source connection. - 9. If the data source you choose does not integrate with AWS Glue connections. + 9. If the data source you choose does not use an AWS Glue connection. @@ -93 +93,15 @@ After you deploy the data source connector to your account, you can connect Athe - 14. Choose **Create data source**. **Athena** will create the following resources for you. + 14. Choose **Create data source**. **Athena** will create the following resources in your account. + + * For **AWS Glue Data Catalog federated connectors without Lambda** + +###### Note + +If your data source is in a VPC, Athena also creates an Elastic Network Interface (ENI) in your account to connect to the VPC. + + * AWS Glue connection + + * AWS Glue catalog + + * For **AWS Glue Data Catalog federated connectors with Lambda** + + * AWS Glue connection @@ -97 +111,5 @@ After you deploy the data source connector to your account, you can connect Athe - * AWS Glue connection (only if the data source is compatible with AWS Glue Connections) + * Lambda function + + * For **Athena data catalog federated connectors** + + * Lambda execution IAM role