aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::LakeFormation::PrincipalPermissions] - [BUG] - Cannot grant Lake Formation permissions for S3Tables Catalog

Open
#2,316 8 comments 13 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::LakeFormation::PrincipalPermissions

### Resource Name

_No response_

### Issue Description

Quote from: https://github.com/aws/aws-cdk/issues/34467

> I got the following error when I tried to deploy CfnPrincipalPermissions construct.
>
> ```
> ...
> 8:19:34 PM | CREATE_FAILED | AWS::LakeFormation::PrincipalPermissions | snowflakes3tablesl...ermissionsAE1D5D28
> Properties validation failed for resource snowflakes3tableslakeformationpermissionstablepermissionsAE1D5D28 with message:
> [#/Resource/Table/CatalogId: expected maxLength: 12, actual: 59]
> Here’s how the construct is defined:
> ```
>
> ```typescript
> new lakeformation.CfnPrincipalPermissions(this, 'database-permissions', {
> principal: {
> dataLakePrincipalIdentifier: "",
> },
> permissions: ["ALL"],
> permissionsWithGrantOption: [],
> resource: {
> database: {
> catalogId: ":s3tablescatalog/",
> name: "",
> }
> }
> })
> ```
>
> This seems that the error is caused by overly strict validation that assumes catalogId is given as 12-digit AWS account ID. However, catalog IDs for S3 tables catalog (:s3tablescatalog/) should also be accepted.
>

### Expected Behavior

`CatalogId` should accept IDs of the form `":s3tablescatalog/"`.

### Observed Behavior

CloudFormation only accepts 12-digit `CatalogId`.

### Test Cases

LakeFormation resources with `CatalogId: ":s3tablescatalog/"` should be deployable.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::LakeFormation::PrincipalPermissions resource and the reported CatalogId validation behavior. Confirm whether values in the form ":s3tablescatalog/" are accepted, with deployment of the stated Lake Formation resource serving as the completion check.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.