AWS datazone: DataZone doc history: subscription target authz and IAM policy update
Summary
Adds two changelog entries: one clarifying that CreateSubscriptionTarget, UpdateSubscriptionTarget, and DeleteSubscriptionTarget are authorized at the AWS account level and do not require project membership; and one noting the AmazonDataZoneRedshiftGlueProvisioningPolicy now includes cloudformation:UntagResource for removing tags from managed CloudFormation stacks.
Security assessment
The entries document authorization semantics for subscription target APIs (account-level authorization rather than project membership) and a change to an AWS managed IAM policy (adding cloudformation:UntagResource), which is directly relevant to IAM permissions and least-privilege review, though it documents behavior rather than fixing a disclosed vulnerability.
Evidence
+Authorization model for subscription target APIs| Clarified that `CreateSubscriptionTarget`, `UpdateSubscriptionTarget`, and `DeleteSubscriptionTarget` are authorized at the AWS account level and do not require project membership. For more information, see [Using existing IAM roles to fulfill Amazon DataZone subscriptions](https://docs.aws.amazon.com/datazone/latest/userguide/use-your-own-role.html).| October 7, 2026
Diff
diff --git a/datazone/latest/userguide/doc-history.md b/datazone/latest/userguide/doc-history.md index 9f83e65..0cf8859 100644 --- a//datazone/latest/userguide/doc-history.md +++ b//datazone/latest/userguide/doc-history.md @@ -12,0 +13,2 @@ Change| Description| Date +Authorization model for subscription target APIs| Clarified that `CreateSubscriptionTarget`, `UpdateSubscriptionTarget`, and `DeleteSubscriptionTarget` are authorized at the AWS account level and do not require project membership. For more information, see [Using existing IAM roles to fulfill Amazon DataZone subscriptions](https://docs.aws.amazon.com/datazone/latest/userguide/use-your-own-role.html).| October 7, 2026 +AmazonDataZoneRedshiftGlueProvisioningPolicy policy updates| Policy updates to the **AmazonDataZoneRedshiftGlueProvisioningPolicy**. This update adds the `cloudformation:UntagResource` permission. Amazon DataZone uses this permission to remove tags from the AWS CloudFormation stacks it manages during environment provisioning. For more information, see [Amazon DataZone updates to AWS managed policies](https://docs.aws.amazon.com/datazone/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-updates).| September 10, 2026