aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::LakeFormation::DataLakeSettings] - [BUG] - Can not clear permissions
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::LakeFormation::DataLakeSettings
### Resource Name
_No response_
### Issue Description
The `CreateDatabaseDefaultPermissions` and `CreateTableDefaultPermissions` properties does not clear the values, it is as if it does a no-op. The [docs state](https://docs.aws.amazon.com/lake-formation/latest/dg/change-settings.html) that empty arrays OR omitting the properties will clear the boolean fields on the UI, but it does not, it is just ignored. So these properties can not be unset after they have been set.
```
LakeFormationSettings:
Type: AWS::LakeFormation::DataLakeSettings
Properties:
Admins:
- DataLakePrincipalIdentifier: "arn:aws:iam::*****:*****"
CreateDatabaseDefaultPermissions: []
CreateTableDefaultPermissions: []
```

### Expected Behavior
The empty array or omitting the property should actually work
### Observed Behavior
The values can not be unset
### Test Cases
1. Deploy with
```
LakeFormationSettings:
Type: AWS::LakeFormation::DataLakeSettings
Properties:
Admins:
- DataLakePrincipalIdentifier: "arn:aws:iam::*****:*****"
CreateDatabaseDefaultPermissions:
- Permissions:
- ALL
Principal:
DataLakePrincipalIdentifier: IAM_ALLOWED_PRINCIPALS
CreateTableDefaultPermissions:
- Permissions:
- ALL
Principal:
DataLakePrincipalIdentifier: IAM_ALLOWED_PRINCIPALS
```
2. Then remove them, observe the values have not changed via the AWS Console or API
```
LakeFormationSettings:
Type: AWS::LakeFormation::DataLakeSettings
Properties:
Admins:
- DataLakePrincipalIdentifier: "arn:aws:iam::*****:*****"
```
3. Attempt number two, set them as empty arrays, observe the values have not changed via the AWS Console or API
```
LakeFormationSettings:
Type: AWS::LakeFormation::DataLakeSettings
Properties:
Admins:
- DataLakePrincipalIdentifier: "arn:aws:iam::*****:*****"
CreateDatabaseDefaultPermissions: []
CreateTableDefaultPermissions: []
```
### Other Details
_No response_
Contributor guide
Research direction
Start by reproducing the AWS::LakeFormation::DataLakeSettings deployment sequence in the issue, first setting the default permissions and then removing them or supplying empty arrays. Compare the resulting values in the AWS Console or API with the expected cleared state. Done means both properties can be unset through omission or empty arrays.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100