AWS redshift: Document REVOKE DEBUG permission syntax for federated permissions

Service: redshift · 2026-09-29 · Documentation medium

File: redshift/latest/dg/r_REVOKE.md · Type: authz

Summary

Adds syntax and reference documentation for revoking the DEBUG permission on a database in an Amazon Redshift warehouse with federated permissions, including the new ADMINS OF ACCOUNT grantee form, and notes that revocation is prospective only (previously generated unredacted log records remain visible).

Security assessment

The change documents how to revoke the DEBUG privilege, which controls access to unredacted secure logging records, and introduces an ADMINS OF ACCOUNT grantee form for that privilege. This is authorization/permission-management documentation with data-exposure implications, but it documents an existing capability rather than fixing a specific vulnerability.

Evidence

+Revokes permission to see unredacted secure logging records for a database in an Amazon Redshift warehouse with federated permissions. Revoking DEBUG is prospective only: it prevents new log records from being generated with DEBUG access, but records generated while DEBUG was active remain visible.

Diff

diff --git a/redshift/latest/dg/r_REVOKE.md b/redshift/latest/dg/r_REVOKE.md
index e32c44633..f8d9424e5 100644
--- a//redshift/latest/dg/r_REVOKE.md
+++ b//redshift/latest/dg/r_REVOKE.md
@@ -250,0 +251,9 @@ The following is the syntax for revoking SELECT permissions from the specified s
+The following is the syntax for revoking the DEBUG permission on a database in an Amazon Redshift warehouse with federated permissions. Revoking DEBUG is prospective only: it prevents new log records from being generated with DEBUG access, but log records generated while DEBUG was active remain visible. For more information about the DEBUG permission, see [Usage notes for granting the DEBUG permission](./r_GRANT-usage-notes.html#r_GRANT-usage-notes-debug).
+    
+    
+    REVOKE DEBUG
+        ON DATABASE federated_db_name
+        FROM { <prefix>:<name>
+             | ROLE <idc_prefix>:<group_name>
+             | ADMINS OF ACCOUNT 'account_id' }
+
@@ -413,0 +423,10 @@ Revokes the permissions on the specified database.
+DEBUG 
+    
+
+Revokes permission to see unredacted secure logging records for a database in an Amazon Redshift warehouse with federated permissions. Revoking DEBUG is prospective only: it prevents new log records from being generated with DEBUG access, but records generated while DEBUG was active remain visible. For more information, see [Usage notes for granting the DEBUG permission](./r_GRANT-usage-notes.html#r_GRANT-usage-notes-debug).
+
+ADMINS OF ACCOUNT '_account_id_ ' 
+    
+
+For the DEBUG permission, revokes the permission from the administrators of the specified consumer account. This grantee form is supported only for the DEBUG permission.
+