Skip to content

Commit 4ea9f33

Browse files
kaizenccTikiTDO
kaizencc
authored and
TikiTDO
committed
fix(glue): remove batchDeletePartition from grantRead() permissions (aws#17941)
It is convention in the CDK to expose the underlying `grant()` API to make it simple for users to grant custom permissions to their resource. In addition, this PR removes 'glue:BatchDeletePartition' from `readPermissions`, which was previously erroneously added. closes aws#17935 and aws#15116. BREAKING CHANGE: the grantRead API previously included 'glue:BatchDeletePartition', and now it does not. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 678c63f commit 4ea9f33

File tree

5 files changed

+87
-35
lines changed

5 files changed

+87
-35
lines changed

Diff for: ‎packages/@aws-cdk/aws-glue/lib/table.ts

+4-2
Original file line numberDiff line numberDiff line change
@@ -325,7 +325,10 @@ export class Table extends Resource implements ITable {
325325
return ret;
326326
}
327327

328-
private grant(grantee: iam.IGrantable, actions: string[]) {
328+
/**
329+
* Grant the given identity custom permissions.
330+
*/
331+
public grant(grantee: iam.IGrantable, actions: string[]) {
329332
return iam.Grant.addToPrincipal({
330333
grantee,
331334
resourceArns: [this.tableArn],
@@ -400,7 +403,6 @@ function createBucket(table: Table, props: TableProps) {
400403
}
401404

402405
const readPermissions = [
403-
'glue:BatchDeletePartition',
404406
'glue:BatchGetPartition',
405407
'glue:GetPartition',
406408
'glue:GetPartitions',

Diff for: ‎packages/@aws-cdk/aws-glue/test/integ.connection.expected.json

+9-9
Original file line numberDiff line numberDiff line change
@@ -95,15 +95,15 @@
9595
"VpcPublicSubnet1NATGateway4D7517AA": {
9696
"Type": "AWS::EC2::NatGateway",
9797
"Properties": {
98+
"SubnetId": {
99+
"Ref": "VpcPublicSubnet1Subnet5C2D37C4"
100+
},
98101
"AllocationId": {
99102
"Fn::GetAtt": [
100103
"VpcPublicSubnet1EIPD7E02669",
101104
"AllocationId"
102105
]
103106
},
104-
"SubnetId": {
105-
"Ref": "VpcPublicSubnet1Subnet5C2D37C4"
106-
},
107107
"Tags": [
108108
{
109109
"Key": "Name",
@@ -192,15 +192,15 @@
192192
"VpcPublicSubnet2NATGateway9182C01D": {
193193
"Type": "AWS::EC2::NatGateway",
194194
"Properties": {
195+
"SubnetId": {
196+
"Ref": "VpcPublicSubnet2Subnet691E08A3"
197+
},
195198
"AllocationId": {
196199
"Fn::GetAtt": [
197200
"VpcPublicSubnet2EIP3C605A87",
198201
"AllocationId"
199202
]
200203
},
201-
"SubnetId": {
202-
"Ref": "VpcPublicSubnet2Subnet691E08A3"
203-
},
204204
"Tags": [
205205
{
206206
"Key": "Name",
@@ -289,15 +289,15 @@
289289
"VpcPublicSubnet3NATGateway7640CD1D": {
290290
"Type": "AWS::EC2::NatGateway",
291291
"Properties": {
292+
"SubnetId": {
293+
"Ref": "VpcPublicSubnet3SubnetBE12F0B6"
294+
},
292295
"AllocationId": {
293296
"Fn::GetAtt": [
294297
"VpcPublicSubnet3EIP3A666A23",
295298
"AllocationId"
296299
]
297300
},
298-
"SubnetId": {
299-
"Ref": "VpcPublicSubnet3SubnetBE12F0B6"
300-
},
301301
"Tags": [
302302
{
303303
"Key": "Name",

Diff for: ‎packages/@aws-cdk/aws-glue/test/integ.security-configuration.expected.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -158,4 +158,4 @@
158158
}
159159
}
160160
}
161-
}
161+
}

Diff for: ‎packages/@aws-cdk/aws-glue/test/integ.table.expected.json

+6-6
Original file line numberDiff line numberDiff line change
@@ -433,7 +433,6 @@
433433
"Statement": [
434434
{
435435
"Action": [
436-
"glue:BatchDeletePartition",
437436
"glue:BatchGetPartition",
438437
"glue:GetPartition",
439438
"glue:GetPartitions",
@@ -442,6 +441,7 @@
442441
"glue:GetTableVersion",
443442
"glue:GetTableVersions",
444443
"glue:BatchCreatePartition",
444+
"glue:BatchDeletePartition",
445445
"glue:CreatePartition",
446446
"glue:DeletePartition",
447447
"glue:UpdatePartition"
@@ -510,7 +510,6 @@
510510
},
511511
{
512512
"Action": [
513-
"glue:BatchDeletePartition",
514513
"glue:BatchGetPartition",
515514
"glue:GetPartition",
516515
"glue:GetPartitions",
@@ -519,6 +518,7 @@
519518
"glue:GetTableVersion",
520519
"glue:GetTableVersions",
521520
"glue:BatchCreatePartition",
521+
"glue:BatchDeletePartition",
522522
"glue:CreatePartition",
523523
"glue:DeletePartition",
524524
"glue:UpdatePartition"
@@ -622,7 +622,6 @@
622622
"Statement": [
623623
{
624624
"Action": [
625-
"glue:BatchDeletePartition",
626625
"glue:BatchGetPartition",
627626
"glue:GetPartition",
628627
"glue:GetPartitions",
@@ -631,6 +630,7 @@
631630
"glue:GetTableVersion",
632631
"glue:GetTableVersions",
633632
"glue:BatchCreatePartition",
633+
"glue:BatchDeletePartition",
634634
"glue:CreatePartition",
635635
"glue:DeletePartition",
636636
"glue:UpdatePartition"
@@ -699,7 +699,6 @@
699699
},
700700
{
701701
"Action": [
702-
"glue:BatchDeletePartition",
703702
"glue:BatchGetPartition",
704703
"glue:GetPartition",
705704
"glue:GetPartitions",
@@ -708,6 +707,7 @@
708707
"glue:GetTableVersion",
709708
"glue:GetTableVersions",
710709
"glue:BatchCreatePartition",
710+
"glue:BatchDeletePartition",
711711
"glue:CreatePartition",
712712
"glue:DeletePartition",
713713
"glue:UpdatePartition"
@@ -743,7 +743,6 @@
743743
},
744744
{
745745
"Action": [
746-
"glue:BatchDeletePartition",
747746
"glue:BatchGetPartition",
748747
"glue:GetPartition",
749748
"glue:GetPartitions",
@@ -752,6 +751,7 @@
752751
"glue:GetTableVersion",
753752
"glue:GetTableVersions",
754753
"glue:BatchCreatePartition",
754+
"glue:BatchDeletePartition",
755755
"glue:CreatePartition",
756756
"glue:DeletePartition",
757757
"glue:UpdatePartition"
@@ -797,4 +797,4 @@
797797
}
798798
}
799799
}
800-
}
800+
}

Diff for: ‎packages/@aws-cdk/aws-glue/test/table.test.ts

+67-17
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ import { Template } from '@aws-cdk/assertions';
22
import * as iam from '@aws-cdk/aws-iam';
33
import * as kms from '@aws-cdk/aws-kms';
44
import * as s3 from '@aws-cdk/aws-s3';
5+
import { testFutureBehavior } from '@aws-cdk/cdk-build-tools/lib/feature-flag';
56
import * as cdk from '@aws-cdk/core';
67
import * as cxapi from '@aws-cdk/cx-api';
7-
import { testFutureBehavior } from '@aws-cdk/cdk-build-tools/lib/feature-flag';
88
import * as glue from '../lib';
99
import { CfnTable } from '../lib/glue.generated';
1010

@@ -79,7 +79,6 @@ test('unpartitioned JSON table', () => {
7979
TableType: 'EXTERNAL_TABLE',
8080
},
8181
});
82-
8382
});
8483

8584
test('partitioned JSON table', () => {
@@ -157,7 +156,6 @@ test('partitioned JSON table', () => {
157156
TableType: 'EXTERNAL_TABLE',
158157
},
159158
});
160-
161159
});
162160

163161
test('compressed table', () => {
@@ -223,7 +221,6 @@ test('compressed table', () => {
223221
TableType: 'EXTERNAL_TABLE',
224222
},
225223
});
226-
227224
});
228225

229226
test('table.node.defaultChild', () => {
@@ -325,7 +322,6 @@ test('encrypted table: SSE-S3', () => {
325322
],
326323
},
327324
});
328-
329325
});
330326

331327
test('encrypted table: SSE-KMS (implicitly created key)', () => {
@@ -413,7 +409,6 @@ test('encrypted table: SSE-KMS (implicitly created key)', () => {
413409
TableType: 'EXTERNAL_TABLE',
414410
},
415411
});
416-
417412
});
418413

419414
test('encrypted table: SSE-KMS (explicitly created key)', () => {
@@ -506,7 +501,6 @@ test('encrypted table: SSE-KMS (explicitly created key)', () => {
506501
TableType: 'EXTERNAL_TABLE',
507502
},
508503
});
509-
510504
});
511505

512506
test('encrypted table: SSE-KMS_MANAGED', () => {
@@ -585,7 +579,6 @@ test('encrypted table: SSE-KMS_MANAGED', () => {
585579
TableType: 'EXTERNAL_TABLE',
586580
},
587581
});
588-
589582
});
590583

591584
test('encrypted table: CSE-KMS (implicitly created key)', () => {
@@ -654,7 +647,6 @@ test('encrypted table: CSE-KMS (implicitly created key)', () => {
654647
TableType: 'EXTERNAL_TABLE',
655648
},
656649
});
657-
658650
});
659651

660652
test('encrypted table: CSE-KMS (explicitly created key)', () => {
@@ -729,7 +721,6 @@ test('encrypted table: CSE-KMS (explicitly created key)', () => {
729721
TableType: 'EXTERNAL_TABLE',
730722
},
731723
});
732-
733724
});
734725

735726
test('encrypted table: CSE-KMS (explicitly passed bucket and key)', () => {
@@ -806,7 +797,6 @@ test('encrypted table: CSE-KMS (explicitly passed bucket and key)', () => {
806797
TableType: 'EXTERNAL_TABLE',
807798
},
808799
});
809-
810800
});
811801

812802
test('explicit s3 bucket and prefix', () => {
@@ -874,7 +864,6 @@ test('explicit s3 bucket and prefix', () => {
874864
TableType: 'EXTERNAL_TABLE',
875865
},
876866
});
877-
878867
});
879868

880869
test('explicit s3 bucket and with empty prefix', () => {
@@ -942,7 +931,72 @@ test('explicit s3 bucket and with empty prefix', () => {
942931
TableType: 'EXTERNAL_TABLE',
943932
},
944933
});
934+
});
935+
936+
test('grants: custom', () => {
937+
const stack = new cdk.Stack();
938+
const user = new iam.User(stack, 'User');
939+
const database = new glue.Database(stack, 'Database', {
940+
databaseName: 'database',
941+
});
945942

943+
const table = new glue.Table(stack, 'Table', {
944+
database,
945+
tableName: 'table',
946+
columns: [{
947+
name: 'col',
948+
type: glue.Schema.STRING,
949+
}],
950+
compressed: true,
951+
dataFormat: glue.DataFormat.JSON,
952+
});
953+
954+
table.grant(user, ['glue:UpdateTable']);
955+
956+
Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
957+
PolicyDocument: {
958+
Statement: [
959+
{
960+
Action: 'glue:UpdateTable',
961+
Effect: 'Allow',
962+
Resource: {
963+
'Fn::Join': [
964+
'',
965+
[
966+
'arn:',
967+
{
968+
Ref: 'AWS::Partition',
969+
},
970+
':glue:',
971+
{
972+
Ref: 'AWS::Region',
973+
},
974+
':',
975+
{
976+
Ref: 'AWS::AccountId',
977+
},
978+
':table/',
979+
{
980+
Ref: 'DatabaseB269D8BB',
981+
},
982+
'/',
983+
{
984+
Ref: 'Table4C2D914F',
985+
},
986+
],
987+
],
988+
},
989+
},
990+
],
991+
Version: '2012-10-17',
992+
},
993+
PolicyName: 'UserDefaultPolicy1F97781E',
994+
Users: [
995+
{
996+
Ref: 'User00B015A1',
997+
},
998+
],
999+
});
9461000
});
9471001

9481002
test('grants: read only', () => {
@@ -970,7 +1024,6 @@ test('grants: read only', () => {
9701024
Statement: [
9711025
{
9721026
Action: [
973-
'glue:BatchDeletePartition',
9741027
'glue:BatchGetPartition',
9751028
'glue:GetPartition',
9761029
'glue:GetPartitions',
@@ -1048,7 +1101,6 @@ test('grants: read only', () => {
10481101
},
10491102
],
10501103
});
1051-
10521104
});
10531105

10541106
testFutureBehavior('grants: write only', s3GrantWriteCtx, cdk.App, (app) => {
@@ -1151,7 +1203,6 @@ testFutureBehavior('grants: write only', s3GrantWriteCtx, cdk.App, (app) => {
11511203
},
11521204
],
11531205
});
1154-
11551206
});
11561207

11571208
testFutureBehavior('grants: read and write', s3GrantWriteCtx, cdk.App, (app) => {
@@ -1179,7 +1230,6 @@ testFutureBehavior('grants: read and write', s3GrantWriteCtx, cdk.App, (app) =>
11791230
Statement: [
11801231
{
11811232
Action: [
1182-
'glue:BatchDeletePartition',
11831233
'glue:BatchGetPartition',
11841234
'glue:GetPartition',
11851235
'glue:GetPartitions',
@@ -1188,6 +1238,7 @@ testFutureBehavior('grants: read and write', s3GrantWriteCtx, cdk.App, (app) =>
11881238
'glue:GetTableVersion',
11891239
'glue:GetTableVersions',
11901240
'glue:BatchCreatePartition',
1241+
'glue:BatchDeletePartition',
11911242
'glue:CreatePartition',
11921243
'glue:DeletePartition',
11931244
'glue:UpdatePartition',
@@ -1264,7 +1315,6 @@ testFutureBehavior('grants: read and write', s3GrantWriteCtx, cdk.App, (app) =>
12641315
},
12651316
],
12661317
});
1267-
12681318
});
12691319

12701320
test('validate: at least one column', () => {

0 commit comments

Comments
 (0)