AWS glue medium security documentation change

Service: glue · 2026-07-04 · Security-related medium

File: glue/latest/dg/catalog-metadata-forms.md

Summary

Added documentation for managing column-level metadata attachments: viewing asset forms/attachments, attaching sensitivity classifications to columns, and deleting column attachments.

Security assessment

Explicitly documents handling of sensitive data classifications (PII) with HIGH sensitivity at column level. Provides security-relevant commands for attaching/deleting sensitivity metadata, enabling better data governance.

Diff

diff --git a/glue/latest/dg/catalog-metadata-forms.md b/glue/latest/dg/catalog-metadata-forms.md
index 589cd3ff4..1517020fa 100644
--- a//glue/latest/dg/catalog-metadata-forms.md
+++ b//glue/latest/dg/catalog-metadata-forms.md
@@ -66,0 +67,28 @@ Use `PutAttachment` with the asset identifier, attachment name, form type ID, an
+### To view an asset's forms and attachments
+
+Use `GetAsset` to retrieve an asset along with its forms and attachments.
+
+The following command retrieves an asset:
+    
+    
+    aws glue get-asset --asset-identifier asset-id
+
+### To attach a form to a column
+
+You can attach a form to a single column of an asset.
+
+Each column is a single item of the `columns` iterable form with column name as the item identifier.
+
+The following command attaches a form to a specific column:
+    
+    
+    aws glue put-attachment \
+        --asset-identifier asset-id \
+        --iterable-form-name columns \
+        --item-identifier region \
+        --attachment-name sensitivity \
+        --form-type-id DataClassification \
+        --content '{"classification":"PII","sensitivity":"HIGH"}'
+
+After you attach the form, use `SearchAssets` to discover the asset by any searchable fields on the form.
+
@@ -95,0 +124,11 @@ Use `BatchGetIterableForms` to retrieve columns and attached forms in a single r
+### To delete an attachment from a specific column
+
+To remove a form attached to a single column, run the following command. Pass the iterable form name, item identifier, and attachment name:
+    
+    
+    aws glue delete-attachment \
+        --asset-identifier asset-id \
+        --iterable-form-name columns \
+        --item-identifier region \
+        --attachment-name sensitivity
+