AWS datazone: DataZone Redshift Glue provisioning policy adds UntagResource
Summary
Document history entry noting the AmazonDataZoneRedshiftGlueProvisioningPolicy now includes the cloudformation:UntagResource permission used during environment provisioning.
Security assessment
The change records an added IAM permission (cloudformation:UntagResource) to an AWS managed policy. It is an IAM permission change with security impact but does not fix a specific vulnerability.
Evidence
AmazonDataZoneRedshiftGlueProvisioningPolicy policy updates | This update adds the `cloudformation:UntagResource` permission. Amazon DataZone uses this permission to remove tags from the AWS CloudFormation stacks it manages during environment provisioning. | September 10, 2026
Diff
diff --git a/datazone/latest/userguide/security-iam-awsmanpol-updates.md b/datazone/latest/userguide/security-iam-awsmanpol-updates.md index 8814b40..c818e70 100644 --- a//datazone/latest/userguide/security-iam-awsmanpol-updates.md +++ b//datazone/latest/userguide/security-iam-awsmanpol-updates.md @@ -12,0 +13 @@ Change | Description | Date +AmazonDataZoneRedshiftGlueProvisioningPolicy policy updates | This update adds the `cloudformation:UntagResource` permission. Amazon DataZone uses this permission to remove tags from the AWS CloudFormation stacks it manages during environment provisioning. | September 10, 2026