AWS solutions medium security documentation change

Service: solutions · 2026-06-07 · Security-related medium

File: solutions/latest/spatial-data-management-on-aws/connector-dynamodb.md

Summary

Updated IAM role reference from single account-based ARN to dual Lambda execution role ARNs. Added CLI/Lambda console instructions for retrieving correct role ARNs.

Security assessment

Replacing account ID with explicit execution role ARNs prevents overly permissive trust policies. Adding retrieval instructions ensures correct IAM configuration, reducing risk of privilege escalation through role misconfiguration.

Diff

diff --git a/solutions/latest/spatial-data-management-on-aws/connector-dynamodb.md b/solutions/latest/spatial-data-management-on-aws/connector-dynamodb.md
index 205e9173c..79c6f97bd 100644
--- a//solutions/latest/spatial-data-management-on-aws/connector-dynamodb.md
+++ b//solutions/latest/spatial-data-management-on-aws/connector-dynamodb.md
@@ -38 +38,4 @@ Field provider for templates |  Serves values from a DynamoDB table as selectabl
-                "AWS": "arn:aws:iam::<SDMA_ACCOUNT_ID>:role/SpatialDataManagement-ConnectorInvocationFunctionRole"
+                "AWS": [
+                  "<CONNECTOR_INVOCATION_ROLE_ARN>",
+                  "<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>"
+                ]
@@ -44,0 +48,14 @@ Field provider for templates |  Serves values from a DynamoDB table as selectabl
+Replace `<CONNECTOR_INVOCATION_ROLE_ARN>` and `<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>` with the execution role ARNs of the connector invocation Lambda functions in your SDMA deployment.
+
+If you have AWS CLI access, you can find these values by running:
+        
+                aws lambda get-function \
+          --function-name SpatialDataManagement-ConnectorInvocationFunction \
+          --query 'Configuration.Role' --output text
+        
+        aws lambda get-function \
+          --function-name SpatialDataManagement-ConnectorInvocationAsyncFunction \
+          --query 'Configuration.Role' --output text
+
+Alternatively, in the [Lambda console](https://console.aws.amazon.com/lambda/), open the `SpatialDataManagement-ConnectorInvocationFunction` and `SpatialDataManagement-ConnectorInvocationAsyncFunction` functions and find the role name for each under **Configuration** > **Permissions**. Use these names to construct the full ARNs (for example, `arn:aws:iam::<ACCOUNT_ID>:role/<CONNECTOR_INVOCATION_ROLE_NAME>`).
+