Amazon Redshift simplifies access to secure logging with federated permissions

Amazon Redshift simplifies troubleshooting and auditing queries on fine-grained access control-protected data. The new DEBUG permission lets data owners view unaltered secure logs across multiple Redshift data warehouses for specific identities. Consolidated permissions allow defining data permissions once, with Amazon Redshift automatically applying them across all warehouses in the AWS account. When a query accesses FGAC-protected data, sensitive values such as rewritten query text, error messages, and object names are masked in secure logs, protecting producer data from consumers. Authorized auditors and administrators can view these records without disabling secure logs to troubleshoot queries and meet compliance requirements. The DEBUG permission, granted via standard Redshift GRANT commands, is typically assigned to IAM users, roles, or IAM Identity Center users and groups, enabling those identities to view unaltered records of their own queries. Granting DEBUG to consumer account administrators provides full log visibility during troubleshooting and auditing. Permitted records remain unaltered when exported from Redshift system tables to Amazon S3 tables. This functionality is available in all AWS regions supported by Amazon Redshift. For more information, see the Amazon Redshift documentation on consolidated permissions, usage notes, and secure logs.

Why it matters

This update benefits Redshift administrators and auditors by enabling unredacted log access for troubleshooting without disabling secure logging, particularly useful for users employing federated permissions.