Redshift's redacted logs can now be unmasked with the DEBUG permission
Hi everyone, it's Shii-chan! Today's news is about Redshift logs getting a little smarter!
AWS What's New
aws.amazon.com
What was announced?
AWS What's New announced a new DEBUG permission for Amazon Redshift. It makes it easier to troubleshoot and audit queries on data protected by fine-grained access control (FGAC).
The story so far
With Redshift federated permissions, you define data permissions once, and Redshift enforces them automatically across every Redshift warehouse in your AWS account.
When a query touches FGAC-protected data, secure logging redacts sensitive values in system table records:
- Rewritten query text
- Error messages
- Object names
This protects the producer's data from consumers. But auditors and administrators need to see those records for troubleshooting and compliance, and that was the tension.
What changes
You don't have to turn off secure logging anymore. A superuser or database owner can choose which identities see the records unredacted.
Dive Deep
- You grant DEBUG with the standard GRANT command
- Typical grantees are IAM users, IAM roles, and IAM Identity Center users or groups
- A granted identity can see unredacted records for its own queries
- You can also grant it to the administrators of a consumer account for full log visibility during troubleshooting and audit
- Records authorized for account administrators stay unredacted when you export system table data to Amazon S3 Tables
It's available in all AWS Regions where Redshift is available.
Wrap-up
- Logs for FGAC-protected data are redacted by secure logging
- The new DEBUG permission lets chosen identities see them unredacted
- You grant it with GRANT, to IAM users, roles, or Identity Center identities
- Administrator-authorized records stay unredacted in S3 Tables exports
This one is for anyone handling audit and debugging in shared-data environments!
