aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::LakeFormation::BatchPrincipalPermissions] - [Missing Resource]
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
Other
### Resource name
AWS::LakeFormation::BatchPrincipalPermissions
### Description
AWS Lake Formation provides `BatchGrantPermissions` and `BatchRevokePermissions` APIs that enable bulk permission operations and prevent `ConcurrentModificationException` errors that occur
with individual permission grants. However, CloudFormation currently only supports individual permission operations through `AWS::LakeFormation::PrincipalPermissions`.
This creates a significant limitation for production deployments where multiple Lake Formation permissions need to be granted simultaneously, as individual `GrantPermissions` calls can fail
with concurrent modification exceptions.
**Problem scenario**:
When deploying Lake Formation permissions for 10+ users/groups, CloudFormation stacks fail with:
ConcurrentModificationException: Permission update/Delete failed for Resource
**AWS Service APIs that need CloudFormation support**:
- [`BatchGrantPermissions`](https://docs.aws.amazon.com/lake-formation/latest/api/API_BatchGrantPermissions.html)
- [`BatchRevokePermissions`](https://docs.aws.amazon.com/lake-formation/latest/api/API_BatchRevokePermissions.html)
**Proposed CloudFormation resource**:
`AWS::LakeFormation::BatchPrincipalPermissions` with properties:
- `GrantEntries` (array of permission entries)
- `RevokeEntries` (array of permission entries)
**Current workaround limitations**:
- Must use `AWS::CloudFormation::CustomResource` with Lambda functions
- Increases deployment complexity and maintenance overhead
- No native CloudFormation lifecycle management
**Downstream impact**:
- Enables AWS CDK to provide L2 constructs for reliable Lake Formation permission management
- Related CDK feature request: [aws/aws-cdk#36215](https://github.com/aws/aws-cdk/issues/36215)
**AWS Documentation references**:
- [Troubleshooting ConcurrentModificationException](https://docs.aws.amazon.com/lake-formation/latest/dg/troubleshooting.html#troubleshooting-problem6)
- AWS officially recommends using batch APIs to solve concurrent modification issues
Describe the scope of your request
**Category**: **(b) new resource type for an existing service is desired**
**Service**: AWS Lake Formation (existing service with CloudFormation support)
**Requested new resource type**: `AWS::LakeFormation::BatchPrincipalPermissions`
**Scope**: Add CloudFormation resource type that maps to existing AWS Lake Formation batch permission APIs (`BatchGrantPermissions` and `BatchRevokePermissions`).
**Justification**:
- AWS Lake Formation service already provides these batch APIs
- Current `AWS::LakeFormation::PrincipalPermissions` only supports individual operations
- Batch operations are AWS-recommended solution for avoiding concurrent modification exceptions
- No CloudFormation resource currently exists for bulk permission management
This would enable reliable Lake Formation deployments at scale without custom resource workarounds.
### Other Details
_No response_
Contributor guide
Research direction
Start with the requested AWS::LakeFormation::BatchPrincipalPermissions resource and read the linked BatchGrantPermissions and BatchRevokePermissions API documentation. Compare their permission-entry inputs with the existing AWS::LakeFormation::PrincipalPermissions resource. Done means CloudFormation supports the requested batch grant and revoke lifecycle without the custom-resource workaround; the related aws/aws-cdk#36215 issue gives downstream context.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100