migrating-hive-tables-to-s3-tables
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- IAM Policy and Privilege Management: The skill provides detailed JSON templates for IAM roles and policies necessary for migration. These templates implement security best practices, such as using
aws:SourceAccountandaws:SourceArnconditions in trust policies to prevent cross-account confused deputy issues. It also includes instructions for usingiam:PassRolewith strictiam:PassedToServiceconditions. - User Approval and Resource Discovery: A core security feature is the requirement for the agent to discover existing resources (like IAM roles and S3 buckets) and present them to the user for confirmation before use. Any action that changes data, metadata, or permissions requires explicit user approval during the conversation.
- KMS Policy Considerations: The skill provides instructions for updating KMS key policies to grant the S3 Tables service access for encrypted data. It correctly recommends reading the existing policy and adding specific statements rather than replacing the entire policy, which minimizes the risk of accidental privilege removal.
- Data Ingestion and Processing (Surface): The skill ingests data from Glue metadata and CSV-based compatibility reports stored in S3. While processing external data is an attack surface for indirect prompt injection, the skill mitigates this by instructing the agent to perform schema normalization (e.g., lowercase conversion) and by relying on human-in-the-loop review for all significant decisions based on that data.
Audit Metadata