aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::LakeFormation::DataLakeSettings] - [BUG] - Can not clear permissions

Open
#2,197 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::LakeFormation::DataLakeSettings

### Resource Name

_No response_

### Issue Description

The `CreateDatabaseDefaultPermissions` and `CreateTableDefaultPermissions` properties does not clear the values, it is as if it does a no-op. The [docs state](https://docs.aws.amazon.com/lake-formation/latest/dg/change-settings.html) that empty arrays OR omitting the properties will clear the boolean fields on the UI, but it does not, it is just ignored. So these properties can not be unset after they have been set.

```
LakeFormationSettings:
Type: AWS::LakeFormation::DataLakeSettings
Properties:
Admins:
- DataLakePrincipalIdentifier: "arn:aws:iam::*****:*****"
CreateDatabaseDefaultPermissions: []
CreateTableDefaultPermissions: []
```

![image](https://github.com/user-attachments/assets/f2690292-f452-48e5-adf3-7d3d22be9cf3)

### Expected Behavior

The empty array or omitting the property should actually work

### Observed Behavior

The values can not be unset

### Test Cases

1. Deploy with
```
LakeFormationSettings:
Type: AWS::LakeFormation::DataLakeSettings
Properties:
Admins:
- DataLakePrincipalIdentifier: "arn:aws:iam::*****:*****"
CreateDatabaseDefaultPermissions:
- Permissions:
- ALL
Principal:
DataLakePrincipalIdentifier: IAM_ALLOWED_PRINCIPALS
CreateTableDefaultPermissions:
- Permissions:
- ALL
Principal:
DataLakePrincipalIdentifier: IAM_ALLOWED_PRINCIPALS
```
2. Then remove them, observe the values have not changed via the AWS Console or API
```
LakeFormationSettings:
Type: AWS::LakeFormation::DataLakeSettings
Properties:
Admins:
- DataLakePrincipalIdentifier: "arn:aws:iam::*****:*****"
```
3. Attempt number two, set them as empty arrays, observe the values have not changed via the AWS Console or API
```
LakeFormationSettings:
Type: AWS::LakeFormation::DataLakeSettings
Properties:
Admins:
- DataLakePrincipalIdentifier: "arn:aws:iam::*****:*****"
CreateDatabaseDefaultPermissions: []
CreateTableDefaultPermissions: []
```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the AWS::LakeFormation::DataLakeSettings deployment sequence in the issue, first setting the default permissions and then removing them or supplying empty arrays. Compare the resulting values in the AWS Console or API with the expected cleared state. Done means both properties can be unset through omission or empty arrays.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.