apache / apache/iceberg

Allow AccessDeniedExceptions To Fail Silently On Auto Creating Tables

Open
#13,758 2 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
9.2k
Forks
3.5k
Avg merge
2d 11h
Merged PRs (30d)
132

Description

### Apache Iceberg version

None

### Query engine

None

### Please describe the bug 🐞

# Problem
I noticed that when we enabled the `iceberg.tables.auto-create-enabled` configuration that we were failing to create tables automatically, even when the Database exists already.

I noticed in this part of the code there is an explicit catching and ignoring of `AlreadyExistsException` and `ForbiddenException` to check if the database already exists.
https://github.com/apache/iceberg/blob/main/kafka-connect/kafka-connect/src/main/java/org/apache/iceberg/connect/data/IcebergWriterFactory.java

Now, we are on aws and when we are missing the CreateDatabase permission using Glue, we get this error

```
Caused by: software.amazon.awssdk.services.glue.model.AccessDeniedException: User: XXXXX is not authorized to perform: glue:CreateDatabase on resource: XXXXXX because no identity-based policy allows the glue:CreateDatabase action (Service: Glue, Status Code: 400, Request ID: XXXX)
```
And this does not extend the `ForbiddenException`. https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/glue/model/AccessDeniedException.html

# Expectation
I would expect this access denied permission to also be a type of forbidden exception, even though it's wrapped around a 400 error instead of 403.

# Proposal/Solution
I would propose catching also AccessDeniedExceptions in this block. As our current workaround, for permission reasons, is to disable the flag altogether and create the tables manually.

### Willingness to contribute

- [ ] I can contribute a fix for this bug independently
- [x] I would be willing to contribute a fix for this bug with guidance from the Iceberg community
- [x] I cannot contribute a fix for this bug at this time

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.