AWS redshift high security documentation change
Summary
Updated ODBC driver configuration options documentation with new parameters, renamed existing parameters, added detailed logging explanations, and fixed typos.
Security assessment
The change adds explicit warnings that DEBUG/TRACE log levels (5-6) capture sensitive information like credentials and query data. It documents security best practices for logging and credential handling, addressing potential information exposure risks. The severity is high due to the risk of credential leakage in logs.
Diff
diff --git a/redshift/latest/mgmt/odbc20-configuration-options.md b/redshift/latest/mgmt/odbc20-configuration-options.md index 3c3c88977..203bb03b0 100644 --- a//redshift/latest/mgmt/odbc20-configuration-options.md +++ b//redshift/latest/mgmt/odbc20-configuration-options.md @@ -7 +7 @@ -AccessKeyIDapp_idApplicationNameapp_nameAuthProfileAuthTypeAutoCreateCaFileclient_idclient_ secretClusterIdcompressionDatabaseDatabaseMetadataCurrentDbOnlydbgroups_filterDriverDSNEndpointUrlForceLowercasegroup_federationhttps_proxy_hosthttps_proxy_passwordhttps_proxy_porthttps_proxy_usernameIAMidc_client_display_nameidc_regionidp_hostidp_portidp_response_timeoutidp_tenantidp_partitionidp_use_https_proxyInstanceProfileissuer_urlKeepAliveKeepAliveCountKeepAliveIntervalKeepAliveTimelisten_portlogin_urlloginToRpLogLevelLogPathMaxLongVarcharSizeMaxVarcharSizeMin_TLSpartner_spidPassword | PWSplugin_namePort | PortNumberpreferred_roleProfileprovider_nameProxyHostProxyPortProxyPwdProxyUidReadOnlyregionSecretAccessKeySessionTokenServer | HostName | Hostssl_insecureSSLModeStsConnectionTimeoutStsEndpointUrltokentoken_typeUID | User | LogonIDUseUnicodeweb_identity_token +AccessKeyIDapp_idApplicationNameapp_nameAuthProfileAuthTypeAutoCreateCaFileclient_idclient_ secretClusterIdcompressionDatabaseDatabaseMetadataCurrentDbOnlydbgroups_filterDriverDSNEndpointUrlForceLowercasegroup_federationhttps_proxy_hosthttps_proxy_passwordhttps_proxy_porthttps_proxy_usernameIAMidc_client_display_nameidc_regionidp_hostidp_portidp_response_timeoutidp_tenantidp_partitionidp_use_https_proxyInstanceProfileissuer_urlKeepAliveKeepAliveCountKeepAliveIntervalKeepAliveIdlelisten_portlogin_urlloginToRpLogLevelLogPathLoginTimeoutMaxLongVarcharSizeMaxVarcharSizeMin_TLSpartner_spidPassword | PWDplugin_namePort | PortNumberpreferred_roleProfileprovider_nameProxyHostProxyPortProxyPwdProxyUidReadOnlyregionSecretAccessKeySessionTokenServer | HostName | Hostssl_insecureSSLModeStreamingCursorRowsStsConnectionTimeoutStsEndpointUrltokentoken_typeUID | User | LogonIDUseUnicodeweb_identity_token @@ -20,0 +21,153 @@ Following are descriptions for the options that you can specify for the Amazon R +###### Topics + + * AccessKeyID + + * app_id + + * ApplicationName + + * app_name + + * AuthProfile + + * AuthType + + * AutoCreate + + * CaFile + + * client_id + + * client_ secret + + * ClusterId + + * compression + + * Database + + * DatabaseMetadataCurrentDbOnly + + * dbgroups_filter + + * Driver + + * DSN + + * EndpointUrl + + * ForceLowercase + + * group_federation + + * https_proxy_host + + * https_proxy_password + + * https_proxy_port + + * https_proxy_username + + * IAM + + * idc_client_display_name + + * idc_region + + * idp_host + + * idp_port + + * idp_response_timeout + + * idp_tenant + + * idp_partition + + * idp_use_https_proxy + + * InstanceProfile + + * issuer_url + + * KeepAlive + + * KeepAliveCount + + * KeepAliveInterval + + * KeepAliveIdle + + * listen_port + + * login_url + + * loginToRp + + * LogLevel + + * LogPath + + * LoginTimeout + + * MaxLongVarcharSize + + * MaxVarcharSize + + * Min_TLS + + * partner_spid + + * Password | PWD + + * plugin_name + + * Port | PortNumber + + * preferred_role + + * Profile + + * provider_name + + * ProxyHost + + * ProxyPort + + * ProxyPwd + + * ProxyUid + + * ReadOnly + + * region + + * SecretAccessKey + + * SessionToken + + * Server | HostName | Host + + * ssl_insecure + + * SSLMode + + * StreamingCursorRows + + * StsConnectionTimeout + + * StsEndpointUrl + + * token + + * token_type + + * UID | User | LogonID + + * UseUnicode + + * web_identity_token + + + + @@ -616 +769 @@ This parameter is optional. -## KeepAliveTime +## KeepAliveIdle @@ -676,0 +830,17 @@ This string is optional. +###### Note + +`LogLevel` and `LogPath` are global settings. The driver reads them in the following order of precedence: + + 1. **Connection string** (`LogLevel=6;LogPath=/path;`) — highest priority, overrides all other settings at connect time. + + 2. **On Windows:** The DSN Setup dialog (Advanced tab). + +**On Linux and macOS:** `[ODBC]` section in your `odbc.ini` file. + + 3. **`[DRIVER]` section** in the `amazon.redshiftodbc.ini` file — used as a fallback if logging is not enabled from the above source. + + + + +Setting `LogLevel` or `LogPath` in an individual DSN section (for example, `[MyDSN]`) has no effect. These options are not read from per-DSN sections. + @@ -683 +853,3 @@ Set the property to one of the following values: - * 1: ERROR. Logs error events that might allow the driver to continue running but produce an error. + * 1: FATAL. Reserved for fatal errors. + + * 2: ERROR. Logs error events such as connection failures and authentication errors. @@ -685 +857 @@ Set the property to one of the following values: - * 2: API_CALL. Logs ODBC API function calls with function argument values. + * 3: WARN. Logs warnings and unexpected conditions in addition to errors. @@ -687 +859 @@ Set the property to one of the following values: - * 3: INFO. Logs general information that describes the progress of the driver. + * 4: INFO. Logs general progress information such as connection status and server parameters. @@ -689 +861 @@ Set the property to one of the following values: - * 4: MSG_PROTOCOL. Logs detailed information of the driver's message procotol. + * 5: DEBUG. Logs all driver activity including ODBC API function calls with arguments and return values. @@ -691 +863 @@ Set the property to one of the following values: - * 5: DEBUG. Logs all driver activity + * 6: TRACE. Logs all driver activity including additional low-level protocol and internal state details. @@ -693 +864,0 @@ Set the property to one of the following values: