AWS solutions documentation change

Service: solutions · 2026-06-07 · Documentation low

File: solutions/latest/spatial-data-management-on-aws/connector-s3.md

Summary

Modified IAM trust policy to require two specific Lambda role ARNs instead of account-wide role, with added retrieval instructions

Security assessment

Enhances security documentation by specifying exact Lambda execution roles needed for S3 connector operations, reducing potential over-permissioning risks. No evidence of security vulnerability being addressed.

Diff

diff --git a/solutions/latest/spatial-data-management-on-aws/connector-s3.md b/solutions/latest/spatial-data-management-on-aws/connector-s3.md
index 9a215d31a..cd2d1bb50 100644
--- a//solutions/latest/spatial-data-management-on-aws/connector-s3.md
+++ b//solutions/latest/spatial-data-management-on-aws/connector-s3.md
@@ -38 +38,4 @@ Step type |  Participates in multi-step triggers alongside other step types. An
-                "AWS": "arn:aws:iam::<SDMA_ACCOUNT_ID>:role/SpatialDataManagement-ConnectorInvocationFunctionRole"
+                "AWS": [
+                  "<CONNECTOR_INVOCATION_ROLE_ARN>",
+                  "<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>"
+                ]
@@ -44,0 +48,14 @@ Step type |  Participates in multi-step triggers alongside other step types. An
+Replace `<CONNECTOR_INVOCATION_ROLE_ARN>` and `<ASYNC_CONNECTOR_INVOCATION_ROLE_ARN>` with the execution role ARNs of the connector invocation Lambda functions in your SDMA deployment.
+
+If you have AWS CLI access, you can find these values by running:
+        
+                aws lambda get-function \
+          --function-name SpatialDataManagement-ConnectorInvocationFunction \
+          --query 'Configuration.Role' --output text
+        
+        aws lambda get-function \
+          --function-name SpatialDataManagement-ConnectorInvocationAsyncFunction \
+          --query 'Configuration.Role' --output text
+
+Alternatively, in the [Lambda console](https://console.aws.amazon.com/lambda/), open the `SpatialDataManagement-ConnectorInvocationFunction` and `SpatialDataManagement-ConnectorInvocationAsyncFunction` functions and find the role name for each under **Configuration** > **Permissions**. Use these names to construct the full ARNs (for example, `arn:aws:iam::<ACCOUNT_ID>:role/<CONNECTOR_INVOCATION_ROLE_NAME>`).
+