AWS redshift: Redshift Iceberg MV SELECT permission no longer Lake Formation-only
Summary
Removes the requirement that the MV definer role's SELECT permission on source tables be granted via AWS Lake Formation when creating an Iceberg materialized view.
Security assessment
The change relaxes the documented authorization mechanism for the MV definer role (the Lake Formation-only qualifier is dropped), which is an authorization-modelling detail rather than a fix for an exploitable flaw, so it warrants only low severity.
Evidence
+To create an Iceberg materialized view, you must have CREATE TABLE permission in the target AWS Glue Data Catalog database. The IAM role associated with the external schema (the MV definer role) must have SELECT permission on all source tables referenced in the query.
Diff
diff --git a/redshift/latest/dg/materialized-view-create-sql-command.md b/redshift/latest/dg/materialized-view-create-sql-command.md index 55f273b..76cb74e 100644 --- a//redshift/latest/dg/materialized-view-create-sql-command.md +++ b//redshift/latest/dg/materialized-view-create-sql-command.md @@ -122 +122 @@ You can create a materialized view from a remote datasharing cluster by providin -To create an Iceberg materialized view, you must have CREATE TABLE permission in the target AWS Glue Data Catalog database. The IAM role associated with the external schema (the MV definer role) must have SELECT permission via AWS Lake Formation on all source tables referenced in the query. +To create an Iceberg materialized view, you must have CREATE TABLE permission in the target AWS Glue Data Catalog database. The IAM role associated with the external schema (the MV definer role) must have SELECT permission on all source tables referenced in the query.