AWS lake-formation high security documentation change

Service: lake-formation · 2026-06-04 · Security-related high

File: lake-formation/latest/dg/register-location.md

Summary

Added requirement to specify S3 bucket owner account during location registration and updated CLI commands with new '--expected-resource-owner-account' flag

Security assessment

The changes enforce explicit bucket owner verification during S3 location registration, preventing potential unauthorized access when registering cross-account locations. This addresses security risks by ensuring Lake Formation validates the registration role's access rights and prevents credential vending for improperly owned locations.

Diff

diff --git a/lake-formation/latest/dg/register-location.md b/lake-formation/latest/dg/register-location.md
index b10032d18..86d2503d2 100644
--- a//lake-formation/latest/dg/register-location.md
+++ b//lake-formation/latest/dg/register-location.md
@@ -47 +47,3 @@ For more information on setting up hybrid access mode, see [Hybrid access mode](
-  8. Select **Register location**.
+  8. Choose **Register S3 path with Owner Account** and provide the S3 bucket owner account to allow Lake Formation to verify the registration role's access on the Amazon S3 location and enable Lake Formation to vend temporary credentials for Amazon S3 files under the registered location.
+
+  9. Select **Register location**.
@@ -104,0 +107,14 @@ You can edit a registered location only if it is registered using a custom IAM r
+  4. ###### Register a location with expected owner account
+
+Use the `--expected-resource-owner-account` flag to allow Lake Formation to verify the registration role's access on the Amazon S3 location and vend temporary credentials for Amazon S3 files under the registered location.
+    
+        aws lakeformation register-resource \
+     --resource-arn arn:aws:s3:::<s3-path> \
+     --role-arn arn:aws:iam::<123456789012>:role/<s3-access-role> \
+     --expected-resource-owner-account <123456789012>
+    
+        aws lakeformation update-resource \
+     --resource-arn arn:aws:s3:::<s3-path> \
+     --role-arn arn:aws:iam::<123456789012>:role/<s3-access-role> \
+     --expected-resource-owner-account <123456789012>
+