ds/lakeformation_effective_permissions: New data source

[YakDriver]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The AWS API supports finding out the Lake Formation permissions for a specified table or database resource located at a path in Amazon S3. Support for this is not available in the AWS provider but could be added.

New or Affected Resource(s)

• data source/aws_lakeformation_effective_permissions

Arguments

• catalog_id - (Optional) Identifier of the Data Catalog. Defaults to account ID.
• resource_arn - (Required) ARN of the resource

Attributes

• details - Any additional details
  • resource_share - Resource share ARN for a catalog resource shared through RAM
• permissions - List of permissions granted or revoked on the resource
• permissions_with_grant_option - List of a subset of permissions the principal can pass
• principal - Identifier for the AWS Lake Formation principal
• catalog_resource - Whether the resource is a catalog
• data_location - Location of an S3 path
  • catalog_id - Identifier for the Data Catalog
  • arn - ARN of the data location resource
• database - Database for the resource.
  • catalog_id - Identifier for the Data Catalog
  • name - Name of the database resource
• table - Table for the resource.
  • catalog_id - Identifier for the Data Catalog
  • database_name - Name fo the database for the resource
  • name - Name of the table
  • wildcard - Whether to use a wildcard
• table_with_columns - Table with columns for the resource.
  • catalog_id - Identifier for the Data Catalog
  • column_names - List of column names for the table
  • excluded_column_names - List of column names to exclude
  • database_name - Name of the database
  • name - Name of the table

Potential Terraform Configuration

data "aws_lakeformation_effective_permissions" "perms" {
  bucket = aws_s3_bucket.bucket.arn
}

References

• New service: AWS Lake Formation #9700
• Lake Formation Permissions #13396
• Lake Formation Data Lake Settings #13250
• Lake Formation Resource #13267
• ds/lakeformation_resources: New data source #16845
• AWS SDK Go Get Effective Permissions For Path (Paginator)
• CLI: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lakeformation/get-effective-permissions-for-path.html

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.