AWS redshift: Redshift: DEBUG permission usage notes for secure logging
Summary
Removes the list of unsupported Regions and adds detailed usage notes for the DEBUG permission, restricting who can grant it (superuser/database owner), limiting grantees (no PUBLIC/local users), and requiring explicit grants per database.
Security assessment
The added notes constrain who may grant DEBUG (which exposes unredacted secure logging records) and explicitly forbid granting to PUBLIC, reducing risk of sensitive log exposure. This is access-control hardening documentation, not a specific vulnerability fix.
Evidence
+ * DEBUG can be granted only to a global identity, an IdC group, or the administrators of a consumer account. It can't be granted to PUBLIC, to a local user, or to a local group.
Diff
diff --git a/redshift/latest/dg/federated-permissions-considerations.md b/redshift/latest/dg/federated-permissions-considerations.md index e84b29cb1..74b3cabfe 100644 --- a//redshift/latest/dg/federated-permissions-considerations.md +++ b//redshift/latest/dg/federated-permissions-considerations.md @@ -15,15 +14,0 @@ This feature is supported only with [ cluster versions 197 and onwards](https:// -**Unsupported Regions** - - * Africa (Cape Town) - - * Asia Pacific (Hyderabad) - - * Europe (Milan) - - * Europe (Spain) - - * Middle East (UAE) - - - - @@ -131,0 +117,21 @@ Note: In current release of Redshift, metadata of FGAC related tables accessed o +**Secure logging DEBUG permission** + + * The DEBUG permission can be granted only on a database in an Amazon Redshift warehouse with federated permissions, not on a local database or a database created from an AWS Lake Formation or AWS Glue Data Catalog catalog. + + * Only a superuser or the database owner can grant or revoke DEBUG. + + * DEBUG can be granted only to a global identity, an IdC group, or the administrators of a consumer account. It can't be granted to PUBLIC, to a local user, or to a local group. + + * For the ADMINS OF ACCOUNT grantee form, only the same account that owns the producer can be specified. + + * DEBUG isn't included in GRANT ALL ON DATABASE and must be granted explicitly. It can be granted on only one database per statement and can't be combined with other permissions in the same statement. + + * DEBUG is prospective only. Records generated while DEBUG was active remain visible for the lifetime of the log. + + * For a query that joins multiple databases with federated permissions, DEBUG must be granted on every database that contributes FGAC-protected data to the query. Otherwise, the records for the query remain redacted. + + * For more information, see [Usage notes for granting the DEBUG permission](./r_GRANT-usage-notes.html#r_GRANT-usage-notes-debug). + + + +