AWS redshift high security documentation change
Summary
Added documentation about new permission requirements for Iceberg DELETE operations on Lake Formation tables starting with Patch 202
Security assessment
This change explicitly documents a security fix where DELETE operations previously worked with only INSERT permission (an access control vulnerability). Now explicit DELETE permission is required, correcting improper access control. The documentation warns about permission errors and provides remediation steps.
Diff
diff --git a/redshift/latest/mgmt/behavior-changes.md b/redshift/latest/mgmt/behavior-changes.md index 707b1659e..d9dde7a8b 100644 --- a//redshift/latest/mgmt/behavior-changes.md +++ b//redshift/latest/mgmt/behavior-changes.md @@ -22,0 +23,2 @@ The following describes upcoming behavior changes. + * Iceberg DELETE on Lake Formation tables requires DELETE permission starting with Patch 202 + @@ -49,0 +52,14 @@ For more information about snapshot pricing, see [Amazon Redshift pricing](https +### Iceberg DELETE on Lake Formation tables requires DELETE permission starting with Patch 202 + +Starting with Amazon Redshift Patch 202, Iceberg DELETE operations on Lake Formation (LF) managed tables require the DELETE Lake Formation permission. UPDATE and MERGE operations require both INSERT and DELETE permissions. All Iceberg DML operations require ALTER permission. + +You may be impacted by this if you perform DELETE, UPDATE, or MERGE operations against Iceberg tables managed by AWS Lake Formation. + +Previously, principals with only INSERT permission (and no DELETE permission) could perform delete operations on LF-managed Iceberg tables. Starting with Patch 202, DELETE operations require the DELETE Lake Formation permission. Principals relying solely on INSERT permission to perform deletes will receive a permission error until DELETE permission is explicitly granted. S3 Tables are not affected by this change. + +To continue performing DELETE operations after this change, review your Lake Formation permission grants for Iceberg tables and ensure that principals performing delete operations have the DELETE Lake Formation permission granted. You can verify existing grants using the AWS Lake Formation console or the `aws lakeformation list-permissions` AWS CLI command. + +If you need to temporarily revert to the previous behavior, contact AWS Support to disable this change on your cluster without requiring a code deployment. + +For more information about patch versions, see [Cluster versions for Amazon Redshift](./cluster-versions.html). +