Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

LF-Tag support for aws_lakeformation_permissions #24315

Closed
wants to merge 7 commits into from
Closed

LF-Tag support for aws_lakeformation_permissions #24315

wants to merge 7 commits into from

Conversation

stevenayers
Copy link
Contributor

@stevenayers stevenayers commented Apr 20, 2022 •
edited
Loading

Community Note

  • Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Closes #19648 #20996 #19640
Relates #21306

THIS PR DEPENDS ON #24314
This PR fixes @danielcmessias PR #19648 following a large refactor of the main codebase in PR #21306

Adds the two new resources to aws_lakeformation_permissions that were made available with the TBAC workflow, LFTag and LFTagPolicy. This is essentially steps 4 and 5 in AWS TBAC documentation.

lf_tag
Allows granting ASSOCIATE and DESCRIBE permissions to Lake Formation Policy Tags, and reading those permissions from a data source.

Example:

resource "aws_lakeformation_permissions" "environment" {
  principal = aws_iam_role.some_role.arn

  permissions = ["ASSOCIATE", "DESCRIBE"]

  lf_tag {
    key = "Team"
    values = ["Sales", "Marketing"]
  }
}

lf_tag_policy
Allows granting LF-Tag policies that give permissions to principals based on a set of tag expressions.

Example:

resource "aws_lakeformation_permissions" "sales" {
  principal = aws_iam_role.sales_role.arn

  permissions = ["CREATE_TABLE", "DROP"]

  lf_tag_policy {
    resource_type = "DATABASE"

    expression {
      key = "Team"
      values = ["Sales"]
    }

    expression {
      key = "Environment"
      values = ["Dev", "Production"]
    }

  }
}

Output from acceptance testing:

$ make testacc TESTS=TestAccLakeFormation_serial PKG=lakeformation

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/lakeformation/... -v -count 1 -parallel 20 -run='TestAccLakeFormation_serial'  -timeout 180m
=== RUN   TestAccLakeFormation_serial
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/table
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/tableWithColumns
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/basic
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/database
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/dataLocation
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/lfTag
=== RUN   TestAccLakeFormation_serial/PermissionsDataSource/lfTagPolicy
=== RUN   TestAccLakeFormation_serial/PermissionsTable
=== RUN   TestAccLakeFormation_serial/PermissionsTable/selectPlus
=== RUN   TestAccLakeFormation_serial/PermissionsTable/wildcardNoSelect
=== RUN   TestAccLakeFormation_serial/PermissionsTable/wildcardSelectOnly
=== RUN   TestAccLakeFormation_serial/PermissionsTable/basic
=== RUN   TestAccLakeFormation_serial/PermissionsTable/implicit
=== RUN   TestAccLakeFormation_serial/PermissionsTable/selectOnly
=== RUN   TestAccLakeFormation_serial/PermissionsTable/wildcardSelectPlus
=== RUN   TestAccLakeFormation_serial/PermissionsTable/iamAllowed
=== RUN   TestAccLakeFormation_serial/PermissionsTable/multipleRoles
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns/implicit
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardExcludedColumns
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardSelectOnly
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardSelectPlus
=== RUN   TestAccLakeFormation_serial/PermissionsTableWithColumns/basic
=== RUN   TestAccLakeFormation_serial/LFTags
=== RUN   TestAccLakeFormation_serial/LFTags/basic
=== RUN   TestAccLakeFormation_serial/LFTags/disappears
=== RUN   TestAccLakeFormation_serial/LFTags/values
=== RUN   TestAccLakeFormation_serial/DataLakeSettings
=== RUN   TestAccLakeFormation_serial/DataLakeSettings/basic
=== RUN   TestAccLakeFormation_serial/DataLakeSettings/dataSource
=== RUN   TestAccLakeFormation_serial/DataLakeSettings/disappears
=== RUN   TestAccLakeFormation_serial/DataLakeSettings/withoutCatalogId
=== RUN   TestAccLakeFormation_serial/PermissionsBasic
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/database
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/databaseIAMAllowed
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/databaseMultiple
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/dataLocation
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/disappears
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/lfTag
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/lfTagPolicy
=== RUN   TestAccLakeFormation_serial/PermissionsBasic/basic
--- PASS: TestAccLakeFormation_serial (1169.13s)
    --- PASS: TestAccLakeFormation_serial/PermissionsDataSource (220.80s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/table (34.66s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/tableWithColumns (35.30s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/basic (28.62s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/database (30.51s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/dataLocation (33.23s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/lfTag (29.52s)
        --- PASS: TestAccLakeFormation_serial/PermissionsDataSource/lfTagPolicy (28.97s)
    --- PASS: TestAccLakeFormation_serial/PermissionsTable (284.42s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/selectPlus (30.11s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/wildcardNoSelect (27.87s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/wildcardSelectOnly (30.42s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/basic (27.03s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/implicit (29.92s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/selectOnly (29.83s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/wildcardSelectPlus (29.11s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/iamAllowed (50.30s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTable/multipleRoles (29.85s)
    --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns (197.04s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns/implicit (29.83s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardExcludedColumns (29.48s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardSelectOnly (29.86s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns/wildcardSelectPlus (29.99s)
        --- PASS: TestAccLakeFormation_serial/PermissionsTableWithColumns/basic (77.88s)
    --- PASS: TestAccLakeFormation_serial/LFTags (79.97s)
        --- PASS: TestAccLakeFormation_serial/LFTags/basic (20.45s)
        --- PASS: TestAccLakeFormation_serial/LFTags/disappears (18.02s)
        --- PASS: TestAccLakeFormation_serial/LFTags/values (41.50s)
    --- PASS: TestAccLakeFormation_serial/DataLakeSettings (72.65s)
        --- PASS: TestAccLakeFormation_serial/DataLakeSettings/basic (18.07s)
        --- PASS: TestAccLakeFormation_serial/DataLakeSettings/dataSource (18.58s)
        --- PASS: TestAccLakeFormation_serial/DataLakeSettings/disappears (17.25s)
        --- PASS: TestAccLakeFormation_serial/DataLakeSettings/withoutCatalogId (18.75s)
    --- PASS: TestAccLakeFormation_serial/PermissionsBasic (314.25s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/database (28.20s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/databaseIAMAllowed (51.85s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/databaseMultiple (30.75s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/dataLocation (31.58s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/disappears (89.13s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/lfTag (27.51s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/lfTagPolicy (27.35s)
        --- PASS: TestAccLakeFormation_serial/PermissionsBasic/basic (27.87s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/lakeformation	1170.588s

@github-actions github-actions bot added documentation Introduces or discusses updates to documentation. provider Pertains to the provider itself, rather than any interaction with AWS. service/lakeformation Issues and PRs that pertain to the lakeformation service. tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure. size/XL Managed by automation to categorize the size of a PR. needs-triage Waiting for first response or review from a maintainer. labels Apr 20, 2022
@stevenayers stevenayers mentioned this pull request Apr 20, 2022
Closed
@stevenayers stevenayers marked this pull request as ready for review April 20, 2022 08:36
This was referenced Apr 20, 2022
Closed
Merged
@stevenayers
Copy link
Contributor Author

Original author has cherry picked the refactor commits - closing.

@github-actions github-actions bot removed the needs-triage Waiting for first response or review from a maintainer. label Apr 20, 2022
@github-actions
Copy link

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators May 21, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
documentation Introduces or discusses updates to documentation. provider Pertains to the provider itself, rather than any interaction with AWS. service/lakeformation Issues and PRs that pertain to the lakeformation service. size/XL Managed by automation to categorize the size of a PR. tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@stevenayers