Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(aws-glue): expose grant API for glue Table #17935

Closed
1 of 2 tasks
kaizencc opened this issue Dec 9, 2021 · 1 comment · Fixed by #17941
Closed
1 of 2 tasks

(aws-glue): expose grant API for glue Table #17935

kaizencc opened this issue Dec 9, 2021 · 1 comment · Fixed by #17941
Assignees
@kaizencc
Labels
@aws-cdk/aws-glue Related to AWS Glue effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p1

Comments

@kaizencc
Copy link
Contributor

kaizencc commented Dec 9, 2021

Description

Currently the table.grant() API is private:

aws-cdk/packages/@aws-cdk/aws-glue/lib/table.ts

Lines 328 to 334 in 42cf186

private grant(grantee: iam.IGrantable, actions: string[]) {
return iam.Grant.addToPrincipal({
grantee,
resourceArns: [this.tableArn],
actions,
});
}

AFAIK that is not the typical CDK behavior. We usually expose grant APIs to unblock users who want to grant custom permissions.

Use Case

I want to grant a custom permission to a glue table. Specifically I want to do:

table.grant(customResource, ['glue:UpdateTable']);

Proposed Solution

Expose the API as public.

Other information

No response

Acknowledge

  • I may be able to implement this feature request
  • This feature might incur a breaking change
@kaizencc kaizencc added feature-request A feature should be added or improved. needs-triage This issue or PR still needs to be triaged. labels Dec 9, 2021
@github-actions github-actions bot added the @aws-cdk/aws-glue Related to AWS Glue label Dec 9, 2021
@kaizencc kaizencc added effort/small Small work item – less than a day of effort p1 @aws-cdk/aws-glue Related to AWS Glue and removed @aws-cdk/aws-glue Related to AWS Glue needs-triage This issue or PR still needs to be triaged. labels Dec 9, 2021
@kaizencc kaizencc mentioned this issue Dec 10, 2021
Merged
@mergify mergify bot closed this as completed in #17941 Dec 10, 2021
mergify bot pushed a commit that referenced this issue Dec 10, 2021
@kaizencc
fix(glue): remove batchDeletePartition from grantRead() permissio…
3d64f9b 
…ns (#17941)

It is convention in the CDK to expose the underlying `grant()` API to make it simple for users to grant custom permissions to their resource. 

In addition, this PR removes 'glue:BatchDeletePartition' from `readPermissions`, which was previously erroneously added.

closes #17935 and #15116.

BREAKING CHANGE: the grantRead API previously included 'glue:BatchDeletePartition', and now it does not.


 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@github-actions
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

TikiTDO pushed a commit to TikiTDO/aws-cdk that referenced this issue Feb 21, 2022
@kaizencc @TikiTDO
fix(glue): remove batchDeletePartition from grantRead() permissio…
4ea9f33 
…ns (aws#17941)

It is convention in the CDK to expose the underlying `grant()` API to make it simple for users to grant custom permissions to their resource. 

In addition, this PR removes 'glue:BatchDeletePartition' from `readPermissions`, which was previously erroneously added.

closes aws#17935 and aws#15116.

BREAKING CHANGE: the grantRead API previously included 'glue:BatchDeletePartition', and now it does not.


 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kaizencc kaizencc

Labels
@aws-cdk/aws-glue Related to AWS Glue effort/small Small work item – less than a day of effort feature-request A feature should be added or improved. p1
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(glue): remove batchDeletePartition from grantRead() permissions
1 participant
@kaizencc