[HADOOP-16741] Document `dynamodb:TagResource` an explicit client-side permission for S3Guard

• Type: Sub-task
• Status: Resolved
• Priority: Minor
• Resolution: Won't Fix
• Affects Version/s: 3.3.0
• Component/s: fs/s3
• Assignee: Gabor Bota
• Reporter: Steve Loughran
• Created: 03/Dec/19 11:15
• Updated: 04/Oct/22 16:43
• Resolved: 04/Oct/22 16:43

Description

We now attempt to tag a DDB table on init if it is untagged (HADOOP-16520). This isn't covered in the documentation (assumed_roles.md), or in the set of permissions generated in RolePolicies.allowS3GuardClientOperations() where it is used to create assumed role permissions.