aws-samples / aws-data-mesh-utils

Apache License 2.0
85 stars 22 forks source link

Products not being shown in the consumer side #16

Open bpatoul opened 2 years ago

bpatoul commented 2 years ago

After building the data mesh architecture, with a colleague we are sharing a solution to the problem of the producer tables not showing in the consumer side.

--Context With a colleague we have run end to end the data-mesh library (steps examples). We encounter a few challenges on running this. We had to manually play with some parts of the code or adapt some ways to solve issues we encounter through the journey. We each built the end to end architecture separately and solved the problems we faced in different ways and started communicating at the end when we faced the same final issue.

--Issue The issue is that we were not able to share the product to the consumer side after building the architecture. We were seeing the databases from the producer side created in the central account but we would not be able to share this to the consumer side. The source of the problem seemed to be coming from the resource access manager. When we tried to manually share the resources via resource access manager or the Lake Formation, it would appear as failed without much information about it to deep dive.

--Solution The solution to this is to delete the setting in the Glue of the central account. This harsh solution allowed us to after share the databases and tables from the central account to the consumer side and allow the consumer to link a database and access the data. We do not have/know yet the repercussions (if any) it will bring to the rest of architecture by doing this way. We recommend you as well to save what you are deleting in the settings from the Glue into an external file in case you need to reverse the process.

Once you have deleted the Glue settings, you can remove in the Lake Formation side in the central account any access to the database (the duplicated database) and table that the consumer is suppose to have. You can do this by navigating in the Data lake permissions tab in the lake formation service, select the data permission and click on revoke. After removing it, give back the access with the same permissions (to the consumer account) by clicking on grant and following the steps there. You will need to do it twice, one for the database, and one for the table(s). Once this done, you can go to the consumer account resource access manager and accept the request to share resources sent by the central account. That’s it, you have now access in the consumer side. Make sure to create a link from the database since it will serve you as a base for fine grained permission in the consumer account

IanMeyers commented 1 year ago

Was this a one-off issue that you encountered, or did it recur during multiple rounds of execution?