dataEngineerRoles get read-only access to /athena-results prefix despite comment stating read/write

dataEngineerRoles only get read access to /athena-results prefix in dataops-project-l3-construct (comment says read/write)

Summary

In the dataops-project module, the /athena-results prefix of the project S3 bucket has a code comment stating that Data Engineers can read and write to it, but the actual IAM policy statements only grant dataEngineerRoles read access (s3:GetObject*). s3:PutObject on /athena-results is only reachable by dataAdminRoles (indirectly, via the bucket-root policy) and by a separate DataZone environment role (datazoneUserRole), not by dataEngineerRoles directly.

Location

packages/constructs/L3/dataops/dataops-project-l3-construct/lib/dataops-project-l3-construct.ts, createProjectBucket method, roughly lines 1449-1532.

Current behavior

Bucket-root policy (lines ~1467-1475) — grants read to engineers and read-write-super to admins across the entire bucket:

//Data Admins can read/write the entire bucket
//Data Engineers can read the entire bucket
const rootPolicy = new RestrictObjectPrefixToRoles({
  s3Bucket: projectBucket,
  s3Prefix: '/',
  readRoleIds: dataEngineerRoleIds,
  readWriteSuperRoleIds: dataAdminRoleIds,
});
rootPolicy.statements().forEach(statement => projectBucket.addToResourcePolicy(statement));

/athena-results-specific policy (lines ~1477-1484):

//Datazone env role and Data Engineers can read/write /athena-results
const athenaPolicy = new RestrictObjectPrefixToRoles({
  s3Bucket: projectBucket,
  s3Prefix: '/athena-results',
  readRoleIds: dataEngineerRoleIds,
  readWritePrincipals: [datazoneUserRole],
});
athenaPolicy.statements().forEach(statement => projectBucket.addToResourcePolicy(statement));

Note the comment says "Data Engineers can read/write /athena-results", but dataEngineerRoleIds is only passed as readRoleIds (read-only) in this block — it is never passed as a read-write role list. The only read-write grant in this block goes to datazoneUserRole, a separate DataZone environment service role unrelated to dataEngineerRoles/dataAdminRoles.

dataAdminRoles do get read-write (in fact "read-write-super", including s3:DeleteObjectVersion) on /athena-results, but only because the bucket-root policy above covers /*, which includes /athena-results/*. There is no dedicated dataAdminRoleIds reference inside the athenaPolicy block itself.

Evidence

Synthesized CloudFormation in the test snapshots confirms this, e.g.:

packages/apps/dataops/dataops-project-app/test/__snapshots__/sample-config-minimal.test-org-test-env-test-domain-test-dataops-project-minimal.baseline.json

• Sid: "/athena-results_Read" — RoleResDataEngineer0 gets s3:GetObject* on .../athena-results/* only.
• Sid: "/athena-results_ReadWrite" — dzuserrole (DataZone user role) gets ["s3:GetObject*","s3:PutObject","s3:PutObjectTagging","s3:DeleteObject"] on .../athena-results/*. No dataAdminRoles or dataEngineerRoles role appears in this statement.

The same pattern repeats in the sample-config-datazone, sample-config-sagemaker, and sample-config-comprehensive baseline snapshots.

Expected behavior

One of:

1. If read-only for engineers is intentional: fix the misleading comment to say something like "Data Engineers can read; Data Admins (via bucket-root policy) and the DataZone environment role can read/write /athena-results", so the code matches the comment.
2. If engineers are supposed to write Athena query results themselves: add dataEngineerRoleIds as a read-write role list (e.g. readWriteRoleIds or via readWritePrincipals) on the /athena-results policy block, consistent with how the /data prefix already grants dataEngineerRoleIds full read-write (lines ~1495-1502):

//Lake Formation role can read/write /data
//Data Engineers and project execution role can read/write /data
const dataPolicy = new RestrictObjectPrefixToRoles({
  s3Bucket: projectBucket,
  s3Prefix: '/data',
  readWriteRoleIds: [...dataEngineerRoleIds, ...projectExecutionRoleIds],
  readWritePrincipals: [lakeFormationRole],
});

Contrast with other prefixes (same method, for reference)

• /data (lines ~1495-1502): dataEngineerRoleIds get full read-write.
• /deployment (lines ~1486-1494): projectExecutionRoleIds get read; projectDeploymentRole gets read-write.
• /temp (lines ~1504-1510): projectExecutionRoleIds get read-write.
• /athena-results (lines ~1477-1484): dataEngineerRoleIds get read-only — inconsistent with the /data prefix pattern, and inconsistent with the comment directly above it.

Worth deciding whether the narrower /athena-results access for Data Engineers is an intentional design choice (least-privilege — engineers query but don't need to write raw result files directly, since Athena itself writes the results under the query-issuing role's permissions) or an oversight from when the comment was written but the grant wasn't updated.