AWS solutions documentation change

Service: solutions · 2026-06-07 · Documentation low

File: solutions/latest/spatial-data-management-on-aws/connector-lambda.md

Summary

Updated IAM trust policy from single ARN to two ARNs (<CONNECTOR_INVOCATION_ROLE_ARN> and <ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>) and added CLI/Lambda console instructions for retrieval

Security assessment

The change improves documentation for IAM role configuration by specifying exact Lambda execution roles required for connector invocation. This enhances security by promoting least privilege access but doesn't address a specific vulnerability.

Diff

diff --git a/solutions/latest/spatial-data-management-on-aws/connector-lambda.md b/solutions/latest/spatial-data-management-on-aws/connector-lambda.md
index f84b22da1..561c67b03 100644
--- a//solutions/latest/spatial-data-management-on-aws/connector-lambda.md
+++ b//solutions/latest/spatial-data-management-on-aws/connector-lambda.md
@@ -39 +39,4 @@ Step type |  Participates in multi-step triggers alongside other step types. A `
-                "AWS": "arn:aws:iam::<SDMA_ACCOUNT_ID>:role/SpatialDataManagement-ConnectorInvocationFunctionRole"
+                "AWS": [
+                  "<CONNECTOR_INVOCATION_ROLE_ARN>",
+                  "<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>"
+                ]
@@ -45,0 +49,14 @@ Step type |  Participates in multi-step triggers alongside other step types. A `
+Replace `<CONNECTOR_INVOCATION_ROLE_ARN>` and `<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>` with the execution role ARNs of the connector invocation Lambda functions in your SDMA deployment.
+
+If you have AWS CLI access, you can find these values by running:
+        
+                aws lambda get-function \
+          --function-name SpatialDataManagement-ConnectorInvocationFunction \
+          --query 'Configuration.Role' --output text
+        
+        aws lambda get-function \
+          --function-name SpatialDataManagement-ConnectorInvocationAsyncFunction \
+          --query 'Configuration.Role' --output text
+
+Alternatively, in the [Lambda console](https://console.aws.amazon.com/lambda/), open the `SpatialDataManagement-ConnectorInvocationFunction` and `SpatialDataManagement-ConnectorInvocationAsyncFunction` functions and find the role name for each under **Configuration** > **Permissions**. Use these names to construct the full ARNs (for example, `arn:aws:iam::<ACCOUNT_ID>:role/<CONNECTOR_INVOCATION_ROLE_NAME>`).
+