AWS athena documentation change
Summary
Updated authentication mechanism to use OAuth 2.0 with PKCE, added security note about shared environments, and introduced DataZone project identifier parameter.
Security assessment
The added security note about shared environments and transition to OAuth 2.0 with PKCE improves security documentation but doesn't fix a specific vulnerability. PKCE enhances authorization code flow security but isn't responding to a known incident.
Diff
diff --git a/athena/latest/ug/jdbc-v3-driver-datazone-idc.md b/athena/latest/ug/jdbc-v3-driver-datazone-idc.md index 2a8415529..e62183925 100644 --- a//athena/latest/ug/jdbc-v3-driver-datazone-idc.md +++ b//athena/latest/ug/jdbc-v3-driver-datazone-idc.md @@ -7 +7 @@ -Credentials providerDataZone domain identifierDataZone environment identifierDataZone domain regionRegionIAM Identity Center issuer URLDataZone endpoint overrideEnable token cachingListen portIdentity provider response time out +Credentials providerDataZone domain identifierDataZone project identifierDataZone environment identifierDataZone domain regionRegionIAM Identity Center issuer URLDataZone endpoint overrideEnable token cachingListen portIdentity provider response time out @@ -9 +9 @@ Credentials providerDataZone domain identifierDataZone environment identifierDat -# DataZone IdC Credentials Provider +# SageMaker Browser IDC Credentials Provider @@ -11 +11,7 @@ Credentials providerDataZone domain identifierDataZone environment identifierDat -An authentication mechanism that enables connecting to DataZone-governed data in Athena using IAM Identity Center. +An authentication plugin that connects to Amazon Athena through SageMaker Unified Studio. It opens a browser for AWS Identity and Access Management Identity Center sign-in using the OAuth 2.0 Authorization Code flow with PKCE, then exchanges the resulting token for temporary credentials scoped to your SageMaker Unified Studio domain and Athena project environment. + +For information on enabling and using IAM Identity Center, see [Step 1: Enable IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/get-started-enable-identity-center.html) in the _AWS IAM Identity Center User Guide_. + +###### Note + +This plugin is designed for single-user desktop environments. In shared environments like Windows Terminal Servers or Remote Desktop Services, system administrators are responsible for establishing and maintaining security boundaries between users. @@ -15 +21 @@ An authentication mechanism that enables connecting to DataZone-governed data in -The credentials provider that will be used to authenticate requests to AWS. Set the value of this parameter to `DataZoneIdc`. Note that the `AWSCredentialsProviderClass` alias is deprecated; use the `CredentialsProvider` parameter name instead. +The credentials provider that will be used to authenticate requests to AWS. Set the value of this parameter to `SageMakerBrowserIdc`. Note that the `AWSCredentialsProviderClass` alias is deprecated; use the `CredentialsProvider` parameter name instead. @@ -19 +25 @@ Parameter name | Alias | Parameter type | Default value | Value to use -CredentialsProvider | AWSCredentialsProviderClass (deprecated) | Required | none | DataZoneIdc +CredentialsProvider | AWSCredentialsProviderClass (deprecated), DataZoneIdc | Required | none | SageMakerBrowserIdc @@ -28,0 +35,8 @@ DataZoneDomainId | none | Required | none +## DataZone project identifier + +Identifier of the DataZone project to use. + +Parameter name | Alias | Parameter type | Default value +---|---|---|--- +DataZoneProjectId | none | Optional | none + @@ -31 +45 @@ DataZoneDomainId | none | Required | none -Identifier of the DataZone environment to use. +Identifier of the DataZone environment to use. Required if `DataZoneProjectId` is not specified. @@ -35 +49 @@ Parameter name | Alias | Parameter type | Default value -DataZoneEnvironmentId | none | Required | none +DataZoneEnvironmentId | none | Optional | none @@ -99 +113 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Browser SAML +Browser SSO OIDC @@ -101 +115 @@ Browser SAML -DataZone IAM +SageMaker IAM