aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::LakeFormation::PrincipalPermissions] - [BUG] - Cannot grant Lake Formation permissions for S3Tables Catalog
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::LakeFormation::PrincipalPermissions
### Resource Name
_No response_
### Issue Description
Quote from: https://github.com/aws/aws-cdk/issues/34467
> I got the following error when I tried to deploy CfnPrincipalPermissions construct.
>
> ```
> ...
> 8:19:34 PM | CREATE_FAILED | AWS::LakeFormation::PrincipalPermissions | snowflakes3tablesl...ermissionsAE1D5D28
> Properties validation failed for resource snowflakes3tableslakeformationpermissionstablepermissionsAE1D5D28 with message:
> [#/Resource/Table/CatalogId: expected maxLength: 12, actual: 59]
> Here’s how the construct is defined:
> ```
>
> ```typescript
> new lakeformation.CfnPrincipalPermissions(this, 'database-permissions', {
> principal: {
> dataLakePrincipalIdentifier: "",
> },
> permissions: ["ALL"],
> permissionsWithGrantOption: [],
> resource: {
> database: {
> catalogId: ":s3tablescatalog/",
> name: "",
> }
> }
> })
> ```
>
> This seems that the error is caused by overly strict validation that assumes catalogId is given as 12-digit AWS account ID. However, catalog IDs for S3 tables catalog (:s3tablescatalog/) should also be accepted.
>
### Expected Behavior
`CatalogId` should accept IDs of the form `":s3tablescatalog/"`.
### Observed Behavior
CloudFormation only accepts 12-digit `CatalogId`.
### Test Cases
LakeFormation resources with `CatalogId: ":s3tablescatalog/"` should be deployable.
### Other Details
_No response_
Contributor guide
Research direction
Start with the AWS::LakeFormation::PrincipalPermissions resource and the reported CatalogId validation behavior. Confirm whether values in the form ":s3tablescatalog/" are accepted, with deployment of the stated Lake Formation resource serving as the completion check.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100