aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::LakeFormation::BatchPrincipalPermissions] - [Missing Resource]

Open
#2,432 0 comments 2 reactions 0 assignees View on GitHub
Coverage
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

Other

### Resource name

AWS::LakeFormation::BatchPrincipalPermissions

### Description

AWS Lake Formation provides `BatchGrantPermissions` and `BatchRevokePermissions` APIs that enable bulk permission operations and prevent `ConcurrentModificationException` errors that occur
with individual permission grants. However, CloudFormation currently only supports individual permission operations through `AWS::LakeFormation::PrincipalPermissions`.

This creates a significant limitation for production deployments where multiple Lake Formation permissions need to be granted simultaneously, as individual `GrantPermissions` calls can fail
with concurrent modification exceptions.

**Problem scenario**:
When deploying Lake Formation permissions for 10+ users/groups, CloudFormation stacks fail with:
ConcurrentModificationException: Permission update/Delete failed for Resource

**AWS Service APIs that need CloudFormation support**:
- [`BatchGrantPermissions`](https://docs.aws.amazon.com/lake-formation/latest/api/API_BatchGrantPermissions.html)
- [`BatchRevokePermissions`](https://docs.aws.amazon.com/lake-formation/latest/api/API_BatchRevokePermissions.html)

**Proposed CloudFormation resource**:
`AWS::LakeFormation::BatchPrincipalPermissions` with properties:
- `GrantEntries` (array of permission entries)
- `RevokeEntries` (array of permission entries)

**Current workaround limitations**:
- Must use `AWS::CloudFormation::CustomResource` with Lambda functions
- Increases deployment complexity and maintenance overhead
- No native CloudFormation lifecycle management

**Downstream impact**:
- Enables AWS CDK to provide L2 constructs for reliable Lake Formation permission management
- Related CDK feature request: [aws/aws-cdk#36215](https://github.com/aws/aws-cdk/issues/36215)

**AWS Documentation references**:
- [Troubleshooting ConcurrentModificationException](https://docs.aws.amazon.com/lake-formation/latest/dg/troubleshooting.html#troubleshooting-problem6)
- AWS officially recommends using batch APIs to solve concurrent modification issues

Describe the scope of your request

**Category**: **(b) new resource type for an existing service is desired**

**Service**: AWS Lake Formation (existing service with CloudFormation support)

**Requested new resource type**: `AWS::LakeFormation::BatchPrincipalPermissions`

**Scope**: Add CloudFormation resource type that maps to existing AWS Lake Formation batch permission APIs (`BatchGrantPermissions` and `BatchRevokePermissions`).

**Justification**:
- AWS Lake Formation service already provides these batch APIs
- Current `AWS::LakeFormation::PrincipalPermissions` only supports individual operations
- Batch operations are AWS-recommended solution for avoiding concurrent modification exceptions
- No CloudFormation resource currently exists for bulk permission management

This would enable reliable Lake Formation deployments at scale without custom resource workarounds.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the requested AWS::LakeFormation::BatchPrincipalPermissions resource and read the linked BatchGrantPermissions and BatchRevokePermissions API documentation. Compare their permission-entry inputs with the existing AWS::LakeFormation::PrincipalPermissions resource. Done means CloudFormation supports the requested batch grant and revoke lifecycle without the custom-resource workaround; the related aws/aws-cdk#36215 issue gives downstream context.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.