-
Notifications
You must be signed in to change notification settings - Fork 9.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix athena database read #18141
Fix athena database read #18141
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Welcome @harsimranmaan 👋
It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTING guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.
Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.
Thanks again, and welcome to the community! 😃
428bc04
to
0f0f682
Compare
The current athena database implements a query on read. This means that the terraform plan needs the permission to execute queries against athena as well as permission to write to the s3 bucket where the execution results are stored. This makes it hard to run plan in an environment where we don't want it to modify any aws resources. The StartQueryExecution also does not have a way to restrict the queries. This means that it is possible to use the permissions set up for a terraform plan to run any queries against athena. The fix here is to read the database name from the AwsDataCatalog. In the future, this can be extended to include other catalogs as the support for creating athena catalogs is added to the provider
0f0f682
to
55d4d26
Compare
Hi @bflad, Can you take a look when you get a chance. Thanks |
Replaced by #19765. |
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
The current athena database implements a query on read. This means that the terraform plan needs
the permission to execute queries against athena as well as permission to write to the
s3 bucket where the execution results are stored. This makes it hard to run plan in an
environment where we don't want it to modify any aws resources. The StartQueryExecution
also does not have a way to restrict the queries. This means that it is possible to use
the permissions set up for a terraform plan to run any queries against athena.
The fix here is to read the database name from the AwsDataCatalog. In the future, this can
be extended to include other catalogs as the support for creating athena catalogs is added to
the provider
Community Note
Relates OR Closes #0000
Output from acceptance testing: