AWS redshift: Redshift: GRANT/REVOKE DEBUG examples for secure logging
Summary
Adds examples and a section describing how to grant/revoke the DEBUG permission on a federated-permissions database to global identities, IdC groups, or consumer account admins, controlling visibility of unredacted secure logging records.
Security assessment
Documents an authorization permission that governs access to unredacted audit/secure logging data, with restricted grantee forms. It is security-relevant access-control documentation rather than a fix for a known vulnerability.
Evidence
+The DEBUG permission controls visibility of unredacted secure logging records on a database that uses fine-grained access control in an Amazon Redshift warehouse with federated permissions.
Diff
diff --git a/redshift/latest/dg/federated-permissions-managing-access.md b/redshift/latest/dg/federated-permissions-managing-access.md index 1229ff715..f05cc1851 100644 --- a//redshift/latest/dg/federated-permissions-managing-access.md +++ b//redshift/latest/dg/federated-permissions-managing-access.md @@ -41,0 +42,13 @@ You can define grant / revoke access permissions on database. +You can grant the DEBUG permission to allow selected entities to see unredacted secure logging records for a database that uses fine-grained access control in an Amazon Redshift warehouse with federated permissions. You can grant DEBUG to a global identity, an IdC group, or the administrators of a consumer account. For more information, see [Usage notes for granting the DEBUG permission](./r_GRANT-usage-notes.html#r_GRANT-usage-notes-debug). + + + GRANT DEBUG ON DATABASE "sales_db@finance-catalog" TO "IAM:sales_auditor"; + + GRANT DEBUG ON DATABASE "sales_db@finance-catalog" TO "IAMR:audit_role"; + + GRANT DEBUG ON DATABASE "sales_db@finance-catalog" TO ROLE "myidc:audit_team"; + + GRANT DEBUG ON DATABASE "sales_db@finance-catalog" TO ADMINS OF ACCOUNT '123456789012'; + + REVOKE DEBUG ON DATABASE "sales_db@finance-catalog" FROM "IAM:sales_auditor"; + @@ -171,0 +185,14 @@ SQL statements to support permission management on database with Amazon Redshift +#### Secure logging DEBUG permission + +The DEBUG permission controls visibility of unredacted secure logging records on a database that uses fine-grained access control in an Amazon Redshift warehouse with federated permissions. You can grant it to a global identity (an IAM user, IAM role, or IdC user specified by a provider-prefixed name), to an IdC group (specified with ROLE), or to the administrators of a consumer account. For an account grantee, you can specify only the same account that owns the producer. For usage notes and restrictions, see [Usage notes for granting the DEBUG permission](./r_GRANT-usage-notes.html#r_GRANT-usage-notes-debug). + + + GRANT DEBUG + ON DATABASE database@catalog + TO { prefix:name | ROLE idc_prefix:group_name | ADMINS OF ACCOUNT 'account_id' } + + REVOKE DEBUG + ON DATABASE database@catalog + FROM { prefix:name | ROLE idc_prefix:group_name | ADMINS OF ACCOUNT 'account_id' } + +