AWS redshift: Redshift Iceberg MV refresh behavior and permission wording updated
Summary
Removes UNION ALL from incremental-refresh support and from the allowed set-operations list, changes concurrent-refresh behavior from returning success to aborting, removes the compaction maintenance note, and states SELECT on source tables can be granted via AWS Lake Formation or AWS Glue resource policies.
Security assessment
Mostly functional/behavioral documentation changes (refresh semantics, concurrency handling, supported SQL constructs); the only security-adjacent line broadens the documented ways SELECT can be granted on source tables, an authorization-style detail with no evidence of a specific vulnerability.
Evidence
+ * **CREATE** – The caller needs CREATE TABLE permission in the target AWS Glue database. The IAM role associated with the external schema (the MV definer role) must have SELECT permission on all source tables, granted via AWS Lake Formation or AWS Glue resource policies.
Diff
diff --git a/redshift/latest/dg/materialized-view-iceberg.md b/redshift/latest/dg/materialized-view-iceberg.md index c5319b6..0e07707 100644 --- a//redshift/latest/dg/materialized-view-iceberg.md +++ b//redshift/latest/dg/materialized-view-iceberg.md @@ -81,2 +80,0 @@ Incremental refresh is supported for materialized views that use: - * UNION ALL - @@ -99 +97 @@ Amazon Redshift automatically falls back to full refresh when: -Multiple Amazon Redshift clusters or workgroups can attempt to refresh the same Iceberg materialized view concurrently. Amazon Redshift uses optimistic concurrency control (OCC) through the AWS Glue Data Catalog's conditional update mechanism to ensure that only one refresh succeeds. If a concurrent refresh is detected, Amazon Redshift checks whether the materialized view is still stale. If another cluster has already completed the refresh, the operation returns success without redoing work. +Multiple Amazon Redshift clusters or workgroups can attempt to refresh the same Iceberg materialized view concurrently. Amazon Redshift uses optimistic concurrency control (OCC) through the AWS Glue Data Catalog's conditional update mechanism to ensure that only one refresh succeeds. If a concurrent refresh is detected, Amazon Redshift checks whether the materialized view is still stale. If another cluster has already completed the refresh, the operation aborts. @@ -111,2 +108,0 @@ For materialized views stored in general-purpose Amazon S3 buckets (specified vi - * Amazon Redshift recognizes compaction operations as maintenance activities and doesn't fall back to full refresh when compaction has occurred. - @@ -124 +120 @@ The following permissions are required: - * **CREATE** – The caller needs CREATE TABLE permission in the target AWS Glue database. The IAM role associated with the external schema (the MV definer role) must have SELECT permission via AWS Lake Formation on all source tables. + * **CREATE** – The caller needs CREATE TABLE permission in the target AWS Glue database. The IAM role associated with the external schema (the MV definer role) must have SELECT permission on all source tables, granted via AWS Lake Formation or AWS Glue resource policies. @@ -238 +234 @@ The following SQL constructs are allowed in the materialized view definition but - * Set operations other than UNION ALL (INTERSECT, EXCEPT) + * Set operations