AWS redshift: Add GRANT DEBUG syntax and description to GRANT reference
Summary
Adds the GRANT DEBUG syntax for federated-permissions databases (TO <prefix>:<name> | ROLE <idc_prefix>:<group_name> | ADMINS OF ACCOUNT 'account_id'), a DEBUG permission description explaining it exposes unredacted secure-logging records, and documentation of the ADMINS OF ACCOUNT grantee form that grants all superusers on a consumer account.
Security assessment
The added reference text defines an access-control permission that overrides default redaction of sensitive values in secure-logging records for federated-permissions databases, and explicitly bounds the grantees (global identity, IdC group, or consumer-account admins only). This is security-relevant authorization documentation addressing potential data exposure through logs, but no specific vulnerability, CVE, or incident is cited.
Evidence
+Grants permission to see unredacted secure logging records for a database in an Amazon Redshift warehouse with federated permissions. By default, when a query accesses fine-grained access control (FGAC) protected data in such a database, Amazon Redshift masks sensitive values in the log records that are generated for that query. Granting DEBUG allows the specified grantee to see those log records without redaction. You can grant DEBUG only on a database in an Amazon Redshift warehouse with federated permissions, and only to a global identity, an IdC group, or the administrators of a consumer account. For more information about secure logging, see [Secure logging](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing-secure-logging.html) in the _Amazon Redshift Management Guide_ ; for usage notes, see [Usage notes for granting the DEBUG permission](./r_GRANT-usage-notes.html#r_GRANT-usage-notes-debug).
Diff
diff --git a/redshift/latest/dg/r_GRANT.md b/redshift/latest/dg/r_GRANT.md index 0f168b1b1..86049c1b2 100644 --- a//redshift/latest/dg/r_GRANT.md +++ b//redshift/latest/dg/r_GRANT.md @@ -286,0 +287,9 @@ The following is the syntax for granting permissions for AWS IAM Identity Center +The following is the syntax for granting the DEBUG permission on a database in an Amazon Redshift warehouse with federated permissions. You can grant DEBUG to a global identity, to an IdC (AWS IAM Identity Center) group, or to the administrators of a consumer account. To begin using the DEBUG permission, see [Usage notes for granting the DEBUG permission](./r_GRANT-usage-notes.html#r_GRANT-usage-notes-debug). + + + GRANT DEBUG + ON DATABASE federated_db_name + TO { <prefix>:<name> + | ROLE <idc_prefix>:<group_name> + | ADMINS OF ACCOUNT 'account_id' } + @@ -466,0 +476,10 @@ Grants the specified permissions on a database. +DEBUG + + +Grants permission to see unredacted secure logging records for a database in an Amazon Redshift warehouse with federated permissions. By default, when a query accesses fine-grained access control (FGAC) protected data in such a database, Amazon Redshift masks sensitive values in the log records that are generated for that query. Granting DEBUG allows the specified grantee to see those log records without redaction. You can grant DEBUG only on a database in an Amazon Redshift warehouse with federated permissions, and only to a global identity, an IdC group, or the administrators of a consumer account. For more information about secure logging, see [Secure logging](https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing-secure-logging.html) in the _Amazon Redshift Management Guide_ ; for usage notes, see [Usage notes for granting the DEBUG permission](./r_GRANT-usage-notes.html#r_GRANT-usage-notes-debug). + +ADMINS OF ACCOUNT '_account_id_ ' + + +For the DEBUG permission, grants the permission to all superusers on the specified consumer account. Records authorized this way are also unredacted when Amazon Redshift exports system table data to Amazon S3 Tables. This grantee form is supported only for the DEBUG permission, and the account that you specify must be the same account that owns the producer. +