Amazon QLDB Update: Support STANDARD permissions mode in CreateLedger and DescribeLedger. Add UpdateLedgerPermissionsMode to update permissions mode on existing ledgers.

Author: AWS

.changes/next-release/feature-AmazonQLDB-015fbc3.json

@@ -0,0 +1,6 @@
+{
+    "type": "feature",
+    "category": "Amazon QLDB",
+    "contributor": "",
+    "description": "Support STANDARD permissions mode in CreateLedger and DescribeLedger. Add UpdateLedgerPermissionsMode to update permissions mode on existing ledgers."
+}

services/qldb/src/main/resources/codegen-resources/service-2.json

@@ -275,6 +275,20 @@
         {"shape":"ResourceNotFoundException"}
       ],
       "documentation":"<p>Updates properties on a ledger.</p>"
+    },
+    "UpdateLedgerPermissionsMode":{
+      "name":"UpdateLedgerPermissionsMode",
+      "http":{
+        "method":"PATCH",
+        "requestUri":"/ledgers/{name}/permissions-mode"
+      },
+      "input":{"shape":"UpdateLedgerPermissionsModeRequest"},
+      "output":{"shape":"UpdateLedgerPermissionsModeResponse"},
+      "errors":[
+        {"shape":"InvalidParameterException"},
+        {"shape":"ResourceNotFoundException"}
+      ],
+      "documentation":"<p>Updates the permissions mode of a ledger.</p>"
     }
   },
   "shapes":{
@@ -331,7 +345,7 @@
         },
         "PermissionsMode":{
           "shape":"PermissionsMode",
-          "documentation":"<p>The permissions mode to assign to the ledger that you want to create.</p>"
+          "documentation":"<p>The permissions mode to assign to the ledger that you want to create. This parameter can have one of the following values:</p> <ul> <li> <p> <code>ALLOW_ALL</code>: A legacy permissions mode that enables access control with API-level granularity for ledgers.</p> <p>This mode allows users who have <code>SendCommand</code> permissions for this ledger to run all PartiQL commands (hence, <code>ALLOW_ALL</code>) on any tables in the specified ledger. This mode disregards any table-level or command-level IAM permissions policies that you create for the ledger.</p> </li> <li> <p> <code>STANDARD</code>: (<i>Recommended</i>) A permissions mode that enables access control with finer granularity for ledgers, tables, and PartiQL commands.</p> <p>By default, this mode denies all user requests to run any PartiQL commands on any tables in this ledger. To allow PartiQL commands to run, you must create IAM permissions policies for specific table resources and PartiQL actions, in addition to <code>SendCommand</code> API permissions for the ledger.</p> </li> </ul> <note> <p>We strongly recommend using the <code>STANDARD</code> permissions mode to maximize the security of your ledger data.</p> </note>"
         },
         "DeletionProtection":{
           "shape":"DeletionProtection",
@@ -358,6 +372,10 @@
           "shape":"Timestamp",
           "documentation":"<p>The date and time, in epoch time format, when the ledger was created. (Epoch time format is the number of seconds elapsed since 12:00:00 AM January 1, 1970 UTC.)</p>"
         },
+        "PermissionsMode":{
+          "shape":"PermissionsMode",
+          "documentation":"<p>The permissions mode of the ledger that you created.</p>"
+        },
         "DeletionProtection":{
           "shape":"DeletionProtection",
           "documentation":"<p>The flag that prevents a ledger from being deleted by any user. If not provided on ledger creation, this feature is enabled (<code>true</code>) by default.</p> <p>If deletion protection is enabled, you must first disable it before you can delete the ledger using the QLDB API or the AWS Command Line Interface (AWS CLI). You can disable it by calling the <code>UpdateLedger</code> operation to set the flag to <code>false</code>. The QLDB console disables deletion protection for you when you use it to delete a ledger.</p>"
@@ -469,6 +487,10 @@
           "shape":"Timestamp",
           "documentation":"<p>The date and time, in epoch time format, when the ledger was created. (Epoch time format is the number of seconds elapsed since 12:00:00 AM January 1, 1970 UTC.)</p>"
         },
+        "PermissionsMode":{
+          "shape":"PermissionsMode",
+          "documentation":"<p>The permissions mode of the ledger.</p>"
+        },
         "DeletionProtection":{
           "shape":"DeletionProtection",
           "documentation":"<p>The flag that prevents a ledger from being deleted by any user. If not provided on ledger creation, this feature is enabled (<code>true</code>) by default.</p> <p>If deletion protection is enabled, you must first disable it before you can delete the ledger using the QLDB API or the AWS Command Line Interface (AWS CLI). You can disable it by calling the <code>UpdateLedger</code> operation to set the flag to <code>false</code>. The QLDB console disables deletion protection for you when you use it to delete a ledger.</p>"
@@ -1012,7 +1034,10 @@
     "ParameterName":{"type":"string"},
     "PermissionsMode":{
       "type":"string",
-      "enum":["ALLOW_ALL"]
+      "enum":[
+        "ALLOW_ALL",
+        "STANDARD"
+      ]
     },
     "ResourceAlreadyExistsException":{
       "type":"structure",
@@ -1288,6 +1313,42 @@
       "members":{
       }
     },
+    "UpdateLedgerPermissionsModeRequest":{
+      "type":"structure",
+      "required":[
+        "Name",
+        "PermissionsMode"
+      ],
+      "members":{
+        "Name":{
+          "shape":"LedgerName",
+          "documentation":"<p>The name of the ledger.</p>",
+          "location":"uri",
+          "locationName":"name"
+        },
+        "PermissionsMode":{
+          "shape":"PermissionsMode",
+          "documentation":"<p>The permissions mode to assign to the ledger. This parameter can have one of the following values:</p> <ul> <li> <p> <code>ALLOW_ALL</code>: A legacy permissions mode that enables access control with API-level granularity for ledgers.</p> <p>This mode allows users who have <code>SendCommand</code> permissions for this ledger to run all PartiQL commands (hence, <code>ALLOW_ALL</code>) on any tables in the specified ledger. This mode disregards any table-level or command-level IAM permissions policies that you create for the ledger.</p> </li> <li> <p> <code>STANDARD</code>: (<i>Recommended</i>) A permissions mode that enables access control with finer granularity for ledgers, tables, and PartiQL commands.</p> <p>By default, this mode denies all user requests to run any PartiQL commands on any tables in this ledger. To allow PartiQL commands to run, you must create IAM permissions policies for specific table resources and PartiQL actions, in addition to <code>SendCommand</code> API permissions for the ledger.</p> </li> </ul> <note> <p>We strongly recommend using the <code>STANDARD</code> permissions mode to maximize the security of your ledger data.</p> </note>"
+        }
+      }
+    },
+    "UpdateLedgerPermissionsModeResponse":{
+      "type":"structure",
+      "members":{
+        "Name":{
+          "shape":"LedgerName",
+          "documentation":"<p>The name of the ledger.</p>"
+        },
+        "Arn":{
+          "shape":"Arn",
+          "documentation":"<p>The Amazon Resource Name (ARN) for the ledger.</p>"
+        },
+        "PermissionsMode":{
+          "shape":"PermissionsMode",
+          "documentation":"<p>The current permissions mode of the ledger.</p>"
+        }
+      }
+    },
     "UpdateLedgerRequest":{
       "type":"structure",
       "required":["Name"],