pulumi / pulumi-aws

An Amazon Web Services (AWS) Pulumi resource package, providing multi-language access to AWS
Apache License 2.0
465 stars 157 forks source link

Lake Formation Permissions issue not resolved by release 4.19 #1744

Closed ArnoPauw closed 1 year ago

ArnoPauw commented 2 years ago

Release 4.19 did not resolve issue [#1531 ] where AWS Lake Formation Permissions do not work.

It would seem from the pull request, #1614, that the contributor might not have included the intended changes. Intended changes might have been included in a different pull request but I was unable to find any such PR.

Reproduction steps and result remains the same as stated in [#1531 ] while running @pulumi/aws version 4.32 Input

    new aws.lakeformation.Permissions(
        `xxxxxxxxxxxxxxxxxxxaaaaaaaaaaaxxxxxxxx`,
        {
            permissions: ['ALL'],
            principal:
                'arn:aws:iam::xxxxxxxxxxxxxx:role/service-role/AWSGlueServiceRole-xxxxxxxxx',
            database: {
                name: 'xxxxxxxxxxxxxxxxxxxxxxxxxx',
            },
        },
    );

Output and Version Untitled

I've also tested with pulumi/aws version 4.19 and got the same results.

XanManZA commented 2 years ago

Still no comment or updates? Lodged 17 Dec 2021...

mikhailshilkov commented 1 year ago

It looks like the bridge issue got resolved. I tested the following repro today with 6.4.0 and it deploys just fine:

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const bucket = new aws.s3.Bucket("demo-bucket", {
});

const awsGlueCatalogDatabase = new aws.glue.CatalogDatabase("demo_aws_glue_catalog_database", {
    name: "mycatalogdatabase",
});

const awsGlueCatalogTable = new aws.glue.CatalogTable("demo_aws_glue_catalog_table", {
    databaseName: awsGlueCatalogDatabase.name,
    name: "mycatalogtable",
});

const lakeformations = new aws.lakeformation.Resource("demo-lakeformation", {arn: bucket.arn});

const datalakeuser = new aws.iam.User("demo-datalakeuser");

// Export the resources
export const bucketName = bucket.id;
export const glue_database_name = awsGlueCatalogDatabase.name;
export const glue_database_catalog_name = awsGlueCatalogTable.name;
export const lakeformations_name = lakeformations.id;
export const datalakeuser_name = datalakeuser.name;

const lakeformation_permissions = new aws.lakeformation.Permissions("demo-lakepermissions", {
 permissions: ["DESCRIBE"],
 principal: datalakeuser.arn,
 database: {
     name: awsGlueCatalogDatabase.name,
 }
});

I'll go ahead and resolve the issue.