aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::Glue::ResourcePolicy

Open
#243 20 comments 90 reactions 0 assignees View on GitHub
analytics enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

## 1. Title

New resource: `AWS::Glue::ResourcePolicy`

## 2. Scope of request

Glue Resource Policies can be used to grant other AWS accounts access to an account's Glue Data Catalog, or to restrict access within the same account ([Read Documentation](https://docs.aws.amazon.com/glue/latest/dg/glue-resource-policies.html)).

These resource policies can be set using the API or the console (see API calls linked in the documentation), but this resource is not available in CloudFormation currently.

## 3. Expected behavior

Pretty straightforward, accept at least a policy document which would be used to create a new resource policy or update an existing one. I'm not entirely sure if the `PolicyHashCondition` value would need to be user input, or if it would be logic internal to the operation of the resource.

On delete, would delete the resource policy, unless a `Retain` DeletionPolicy was specified.

## 4. Suggest specific test cases

* Create a new resource policy, including a policy where the policy document contains intrinsic functions like a Ref or Fn::Sub
* Update an existing policy created in the same stack
* Update a policy resource although a resource policy was already defined
* Delete a resource policy
* Drift detection to see if the policy matches what is defined in the template

## 5. Helpful Links to speed up research and evaluation

See documentation link above

## 6. Category

Analytics (Glue)

Contributor guide

Open the contributing guide

Research direction

Start with the linked AWS Glue resource policy documentation and its API calls, then determine how the requested CloudFormation resource should create, update, delete, and detect drift for a policy document. Done should cover the listed cases: intrinsic functions, creation and updates, replacement of an existing policy, deletion, Retain behavior, and drift detection.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
43/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.