feat: limit dataset role permissions

backend/dataall/aws/handlers/glue.py

@@ -473,7 +473,7 @@ def start_glue_crawler(data):
             glue = session.client('glue', region_name=data.get('region', 'eu-west-1'))
             if data.get('location'):
                 Glue._update_existing_crawler(
-                    glue, accountid, crawler_name, targets, database
+                    glue, crawler_name, targets, database
                 )
             crawler = Glue._get_crawler(glue, crawler_name)
             glue.start_crawler(Name=crawler_name)
@@ -496,7 +496,7 @@ def _get_crawler(glue, crawler_name):
         return crawler.get('Crawler') if crawler else None
 
     @staticmethod
-    def _update_existing_crawler(glue, accountid, crawler_name, targets, database):
+    def _update_existing_crawler(glue, crawler_name, targets, database):
         try:
             glue.stop_crawler(Name=crawler_name)
         except ClientError as e:
@@ -508,7 +508,6 @@ def _update_existing_crawler(glue, accountid, crawler_name, targets, database):
         try:
             glue.update_crawler(
                 Name=crawler_name,
-                Role=SessionHelper.get_delegation_role_arn(accountid=accountid),
                 DatabaseName=database,
                 Targets=targets,
             )

backend/dataall/aws/handlers/lakeformation.py

@@ -6,7 +6,7 @@
 from .sts import SessionHelper
 
 log = logging.getLogger('aws:lakeformation')
-PIVOT_ROLE_NAME_PREFIX = "datallPivotRole"
+PIVOT_ROLE_NAME_PREFIX = "dataallPivotRole"
 
 
 class LakeFormation:

backend/dataall/cdkproxy/requirements.txt

@@ -1,4 +1,4 @@
-aws-cdk-lib==2.61.1
+aws-cdk-lib==2.77.0
 aws_cdk.aws_redshift_alpha==2.14.0a0
 boto3==1.24.85
 boto3-stubs==1.24.85

backend/dataall/cdkproxy/stacks/dataset.py

@@ -194,91 +194,125 @@ def __init__(self, scope, id, target_uri: str = None, **kwargs):
             policy_name=dataset.S3BucketName,
             statements=[
                 iam.PolicyStatement(
-                    actions=['s3:List*'], resources=['*'], effect=iam.Effect.ALLOW
-                ),
-                iam.PolicyStatement(
-                    actions=['logs:*'], resources=['*'], effect=iam.Effect.ALLOW
-                ),
-                iam.PolicyStatement(
-                    actions=['tag:*'], resources=['*'], effect=iam.Effect.ALLOW
+                    sid="ListAll",
+                    actions=[
+                        "s3:ListAllMyBuckets",
+                        "s3:ListAccessPoints",
+                    ],
+                    resources=["*"],
+                    effect=iam.Effect.ALLOW
                 ),
                 iam.PolicyStatement(
-                    actions=['s3:List*', 's3:Get*'],
+                    sid="ListDatasetBucket",
+                    actions=[
+                        "s3:ListBucket",
+                        "s3:GetBucketLocation"
+                    ],
                     resources=[dataset_bucket.bucket_arn],
                     effect=iam.Effect.ALLOW,
                 ),
                 iam.PolicyStatement(
-                    actions=['s3:*'],
+                    sid="ReadWriteDatasetBucket",
+                    actions=[
+                        "s3:PutObject",
+                        "s3:PutObjectAcl",
+                        "s3:GetObject",
+                        "s3:GetObjectAcl",
+                        "s3:GetObjectVersion",
+                        "s3:DeleteObject"
+                    ],
                     effect=iam.Effect.ALLOW,
                     resources=[dataset_bucket.bucket_arn + '/*'],
                 ),
                 iam.PolicyStatement(
+                    sid="KMSAccess",
+                    actions=[
+                        "kms:Decrypt",
+                        "kms:Encrypt",
+                        "kms:GenerateDataKey"
+                    ],
+                    effect=iam.Effect.ALLOW,
+                    resources=[dataset_key.key_arn],
+                ),
+                iam.PolicyStatement(
+                    sid="ReadAccessPointsDatasetBucket",
                     actions=[
                         's3:GetAccessPoint',
                         's3:GetAccessPointPolicy',
-                        's3:ListAccessPoints',
-                        's3:CreateAccessPoint',
-                        's3:DeleteAccessPoint',
                         's3:GetAccessPointPolicyStatus',
-                        's3:DeleteAccessPointPolicy',
-                        's3:PutAccessPointPolicy',
                     ],
                     effect=iam.Effect.ALLOW,
                     resources=[
-                        f'arn:aws:s3:{dataset.region}:{dataset.AwsAccountId}:accesspoint/*',
+                        f'arn:aws:s3:{dataset.region}:{dataset.AwsAccountId}:accesspoint/{dataset.datasetUri}*',
                     ],
                 ),
                 iam.PolicyStatement(
-                    actions=['s3:List*', 's3:Get*'],
-                    resources=[f'arn:aws:s3:::{env.EnvironmentDefaultBucketName}'],
-                    effect=iam.Effect.ALLOW,
-                ),
-                iam.PolicyStatement(
-                    actions=['s3:*'],
-                    effect=iam.Effect.ALLOW,
-                    resources=[f'arn:aws:s3:::{env.EnvironmentDefaultBucketName}/*'],
-                ),
-                iam.PolicyStatement(
-                    effect=iam.Effect.ALLOW,
-                    resources=['arn:aws:s3:::aws-glue-*'],
-                    actions=['s3:CreateBucket'],
-                ),
-                iam.PolicyStatement(
-                    actions=['s3:GetObject', 's3:PutObject', 's3:DeleteObject'],
+                    sid="GlueAccessCrawler",
+                    actions=[
+                        "glue:GetDatabase",
+                        "glue:GetTableVersion",
+                        "glue:CreateTable",
+                        "glue:GetTables",
+                        "glue:GetTableVersions",
+                        "glue:UpdateTable",
+                        "glue:DeleteTableVersion",
+                        "glue:DeleteTable",
+                        "glue:GetTable"
+                    ],
                     effect=iam.Effect.ALLOW,
                     resources=[
-                        'arn:aws:s3:::aws-glue-*/*',
-                        'arn:aws:s3:::*/*aws-glue-*/*',
-                    ],
+                        f"arn:aws:glue:*:{dataset.AwsAccountId}:catalog",
+                        f"arn:aws:glue:{dataset.region}:{dataset.AwsAccountId}:database/{dataset.GlueDatabaseName}",
+                        f"arn:aws:glue:{dataset.region}:{dataset.AwsAccountId}:table/{dataset.GlueDatabaseName}/*"
+                    ]
                 ),
                 iam.PolicyStatement(
-                    actions=['s3:GetObject'],
+                    sid="CreateLoggingGlueCrawler",
+                    actions=[
+                        'logs:CreateLogGroup',
+                        'logs:CreateLogStream',
+                    ],
                     effect=iam.Effect.ALLOW,
                     resources=[
-                        'arn:aws:s3:::crawler-public*',
-                        'arn:aws:s3:::aws-glue-*',
+                        f'arn:aws:logs:{dataset.region}:{dataset.AwsAccountId}:log-group:/aws-glue/crawlers*',
                     ],
                 ),
                 iam.PolicyStatement(
+                    sid="LoggingGlueCrawler",
                     actions=[
-                        'logs:CreateLogGroup',
-                        'logs:CreateLogStream',
                         'logs:PutLogEvents',
                     ],
                     effect=iam.Effect.ALLOW,
-                    resources=['arn:aws:logs:*:*:/aws-glue/*'],
+                    resources=[
+                        f'arn:aws:logs:{dataset.region}:{dataset.AwsAccountId}:log-group:/aws-glue/crawlers:log-stream:{dataset.GlueCrawlerName}',
+                    ],
                 ),
                 iam.PolicyStatement(
-                    actions=['kms:*'], effect=iam.Effect.ALLOW, resources=['*']
+                    actions=['s3:ListEnvironmentBucket'],
+                    resources=[f'arn:aws:s3:::{env.EnvironmentDefaultBucketName}'],
+                    effect=iam.Effect.ALLOW,
                 ),
                 iam.PolicyStatement(
-                    actions=['glue:*', 'athena:*', 'lakeformation:*'],
-                    resources=['*'],
+                    sid="ReadEnvironmentBucketProfiling",
+                    actions=[
+                        "s3:GetObject",
+                        "s3:GetObjectAcl",
+                        "s3:GetObjectVersion"
+                    ],
                     effect=iam.Effect.ALLOW,
+                    resources=[f'arn:aws:s3:::{env.EnvironmentDefaultBucketName}/profiling*'],
                 ),
                 iam.PolicyStatement(
-                    actions=['cloudformation:*'],
-                    resources=['*'],
+                    sid="ReadWriteEnvironmentBucketProfiling",
+                    actions=[
+                        "s3:PutObject",
+                        "s3:PutObjectAcl",
+                        "s3:GetObject",
+                        "s3:GetObjectAcl",
+                        "s3:GetObjectVersion",
+                        "s3:DeleteObject"
+                    ],
+                    resources=[f'arn:aws:s3:::{env.EnvironmentDefaultBucketName}/profiling/results/{dataset.datasetUri}/*'],
                     effect=iam.Effect.ALLOW,
                 ),
             ],
@@ -290,17 +324,10 @@ def __init__(self, scope, id, target_uri: str = None, **kwargs):
             'DatasetAdminRole',
             role_name=dataset.IAMDatasetAdminRoleArn.split('/')[-1],
             assumed_by=iam.CompositePrincipal(
-                iam.ServicePrincipal('glue.amazonaws.com'),
-                iam.ServicePrincipal('lakeformation.amazonaws.com'),
-                iam.ServicePrincipal('athena.amazonaws.com'),
-                iam.ServicePrincipal('sagemaker.amazonaws.com'),
-                iam.ServicePrincipal('lambda.amazonaws.com'),
-                iam.ServicePrincipal('ec2.amazonaws.com'),
-                iam.AccountPrincipal(str(os.environ.get('CURRENT_AWS_ACCOUNT'))),
-                iam.AccountPrincipal(dataset.AwsAccountId),
                 iam.ArnPrincipal(
                     f'arn:aws:iam::{dataset.AwsAccountId}:role/{self.pivot_role_name}'
                 ),
+                iam.ServicePrincipal('glue.amazonaws.com'),
             ),
         )
         dataset_admin_policy.attach_to_role(dataset_admin_role)
@@ -441,9 +468,7 @@ def __init__(self, scope, id, target_uri: str = None, **kwargs):
             self,
             'DatasetGlueProfilingJob',
             name=dataset.GlueProfilingJobName,
-            role=iam.ArnPrincipal(
-                f'arn:aws:iam::{env.AwsAccountId}:role/{self.pivot_role_name}'
-            ).arn,
+            role=dataset_admin_role.role_arn,
             allocated_capacity=10,
             execution_property=glue.CfnJob.ExecutionPropertyProperty(
                 max_concurrent_runs=100

backend/dataall/db/api/environment.py

@@ -392,6 +392,23 @@ def remove_group(session, username, groups, uri, data=None, check_perm=None):
                 message=f'Team: {group} has created {group_env_objects_count} resources on this environment.',
             )
 
+        shares_count = (
+            session.query(models.ShareObject)
+            .filter(
+                and_(
+                    models.ShareObject.principalId == group,
+                    models.ShareObject.principalType == PrincipalType.Group.value
+                )
+            )
+            .count()
+        )
+
+        if shares_count > 0:
+            raise exceptions.EnvironmentResourcesFound(
+                action='Remove Team',
+                message=f'Team: {group} has created {shares_count} share requests on this environment.',
+            )
+
         group_membership = Environment.find_environment_group(
             session, group, environment.environmentUri
         )
@@ -529,6 +546,23 @@ def remove_consumption_role(session, username, groups, uri, data=None, check_per
 
         consumption_role = Environment.get_environment_consumption_role(session, uri, data.get('environmentUri'))
 
+        shares_count = (
+            session.query(models.ShareObject)
+            .filter(
+                and_(
+                    models.ShareObject.principalId == uri,
+                    models.ShareObject.principalType == PrincipalType.ConsumptionRole.value
+                )
+            )
+            .count()
+        )
+
+        if shares_count > 0:
+            raise exceptions.EnvironmentResourcesFound(
+                action='Remove Consumption Role',
+                message=f'Consumption role: {consumption_role.consumptionRoleName} has created {shares_count} share requests on this environment.',
+            )
+
         if consumption_role:
             session.delete(consumption_role)
             session.commit()

deploy/requirements.txt

@@ -1,4 +1,4 @@
-aws-cdk-lib==2.61.1
+aws-cdk-lib==2.77.0
 boto3-stubs==1.20.20
 boto3==1.24.85
 botocore==1.27.85