Lakeformation permission for external account access fails validation

[vadivelselvaraj]

When sharing glue catalog database or tables with external AWS accounts, the principal argument for the AWS LakeFormation Permissions API should accept a valid AWS account ID. Currently, only a valid AWS role or user ARN is accepted and a code like the below would fail because of this validation.

resource "aws_lakeformation_permissions" "high_fidelity_db_external_access" {
  principal = "259712912613"
  permissions = ["SELECT"]
  permissions_with_grant_option = ["SELECT"]

  database {
    name = aws_glue_catalog_database.sample_db.name
  }
}

ValidationError: Error: "principal" doesn't look like a user or role: "259712912613"

The validation for the principal argument is done here and needs to be changed to allow AWS account ID as valid input.

Additionally, the principal argument can also be an organization as can be seen here.

[chrisbulgaria]

Hi , this is the same as https://github.com/hashicorp/terraform-provider-aws/issues/16848 And the linked pull request fixes it . Just needs to be merged . Maybe add a vote there such that it has a chance to receive attention ? (Well not exactly the same , but the pull request fixes your case as well) Thanks , Chris

[YakDriver]

Additional Principals	Perm Delete/Revoke
Related #16848 (Issue) Related #16916 Related #18034 (Issue) Related #18374	Related #17633 (Issue) Related #18446 (Issue) Related #18505 Related #19063 (Issue) Related #19064 (Issue)

[ghost]

This has been released in version 3.38.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.