Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: aws_quicksight_folder folder permissions #32680

Open
rhiser opened this issue Jul 25, 2023 · 5 comments
Open

[Bug]: aws_quicksight_folder folder permissions #32680

rhiser opened this issue Jul 25, 2023 · 5 comments
Labels
bug Addresses a defect in current functionality. service/quicksight Issues and PRs that pertain to the quicksight service.

Comments

@rhiser
Copy link

rhiser commented Jul 25, 2023

Terraform Core Version

1.5.0

AWS Provider Version

5.9.0

Affected Resource(s)

  • aws_quicksight_folder

Expected Behavior

Resource aws_quicksight_folder and the object permissions should allow for more customized list of actions.

Actual Behavior

│ Error: updating QuickSight Folder (test) permissions: InvalidParameterValueException: ResourcePermission list contains unsupported permission sets [quicksight:DescribeFolder, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]
│ {
│   RespMetadata: {
│     StatusCode: 400,
│     RequestID: "f30fd416-8697-4999-8cde-017a0a7b112b"
│   },
│   Message_: "ResourcePermission list contains unsupported permission sets [quicksight:DescribeFolder, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]"
│ }
│
│   with module.quicksight.aws_quicksight_folder.test,
│   on modules/data_lake/quicksight/folders.tf line 12, in resource "aws_quicksight_folder" "test":
│   12: resource "aws_quicksight_folder" "test" {
│

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

resource "aws_quicksight_folder" "test" {
  folder_id = "test"
  name      = "test"
  permissions {
    actions = [
      "quicksight:DescribeFolder",
      "quicksight:DescribeFolderPermissions",
    ]
    principal = aws_quicksight_group.manage_users["test"].arn
  }
}

Steps to Reproduce

terraform init
terraform apply

Debug Output

No response

Panic Output

No response

Important Factoids

I was able to update the folder permissions using AWS Api successfully.

 aws quicksight update-folder-permissions --aws-account-id xxx --folder-id test
{
    "Status": 200,
    "Arn": "arn:aws:quicksight:us-east-2:xxx:folder/test",
    "FolderId": "test",
    "Permissions": [],
    "RequestId": "9bab9c52-b09c-45b8-b0fe-72bedfe5c4b5"
}

aws quicksight update-folder-permissions --aws-account-id xxx --folder-id test --grant-permissions Principal=arn:aws:quicksight:us-east-1:xxx:group/default/test,Actions="quicksight:DescribeFolder"
{
    "Status": 200,
    "Arn": "arn:aws:quicksight:us-east-1:xxx:folder/test",
    "FolderId": "test",
    "Permissions": [
        {
            "Principal": "arn:aws:quicksight:us-east-1:xxx:group/default/test",
            "Actions": [
                "quicksight:DescribeFolder"
            ]
        }
    ],
    "RequestId": "736f9cc8-0da0-4a1e-9e79-04730d075867"
}

References

No response

Would you like to implement a fix?

None

@rhiser rhiser added bug Addresses a defect in current functionality. needs-triage Waiting for first response or review from a maintainer. labels Jul 25, 2023
@github-actions
Copy link

Community Note

Voting for Prioritization

  • Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
  • Please see our prioritization guide for information on how we prioritize.
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

  • If you are interested in working on this issue, please leave a comment.
  • If this would be your first contribution, please review the contribution guide.

@github-actions github-actions bot added the service/quicksight Issues and PRs that pertain to the quicksight service. label Jul 25, 2023
@justinretzolk
Copy link
Member

Hey @rhiser 👋 Thank you for taking the time to raise this! It looks like this error is coming from the AWS API itself. Looking at your example of a similar action from the AWS CLI, I'm not sure that it's comparable to what you're trying to accomplish with Terraform.

Looking at the error message, the UpdateFolderPermissions reference, and your example from the AWS CLI, it appears to me that you have two options for valid actions values when updating the permissions:

  • [quicksight:DescribeFolder]
  • [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]

The former is what you used when successfully using the AWS CLI, and the latter of the two is what's used in the UpdateFolderPermissions documentation. It doesn't appear that the API allows for any other values, as far as I can tell. Can you test with that in mind and let me know if it resolves the issue?

@justinretzolk justinretzolk added waiting-response Maintainers are waiting on response from community or contributor. and removed needs-triage Waiting for first response or review from a maintainer. labels Jul 26, 2023
@github-actions github-actions bot removed the waiting-response Maintainers are waiting on response from community or contributor. label Jul 26, 2023
@jar-b jar-b added the waiting-response Maintainers are waiting on response from community or contributor. label Jul 31, 2023
@Mannyknp
Copy link

Mannyknp commented Sep 4, 2023

Hi, It is true that API itself expects a predefined set of permissions. But I am facing the same issue when I want to change the folder permission from
[quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]
to
[quicksight:DescribeFolder]

as tf tries to delete the existing permissions excluding quicksight:DescribeFolder and runs into same issue.

module.quicksight.aws_quicksight_folder.departments["XXXX"] will be updated in-place
~ resource "aws_quicksight_folder" "XXXX" {
id = "abdbcba,xxx-xxx-xxx"
name = "XXXX"
tags = {}
# (9 unchanged attributes hidden)

  ~ permissions {
      ~ actions   = [
          - "quicksight:CreateFolder",
          - "quicksight:CreateFolderMembership",
          - "quicksight:DeleteFolder",
          - "quicksight:DeleteFolderMembership",
          - "quicksight:DescribeFolderPermissions",
          - "quicksight:UpdateFolder",
          - "quicksight:UpdateFolderPermissions",
            # (1 unchanged element hidden)
        ]
        # (1 unchanged attribute hidden)
    }
  + permissions {
      + actions   = [
          + "quicksight:CreateFolder",
          + "quicksight:CreateFolderMembership",
          + "quicksight:DeleteFolder",
          + "quicksight:DeleteFolderMembership",
          + "quicksight:DescribeFolder",
          + "quicksight:DescribeFolderPermissions",
          + "quicksight:UpdateFolder",
          + "quicksight:UpdateFolderPermissions",
        ]
      + principal = "arn:aws:quicksight:us-east-1:aaaaaaaa:group/default/xxx-xxxx"
    }
}

│ Error: updating QuickSight Folder (XXXX) permissions: InvalidParameterValueException: ResourcePermission list contains unsupported permission sets [quicksight:CreateFolderMembership, quicksight:CreateFolder, quicksight:UpdateFolderPermissions, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]
│ {
│ RespMetadata: {
│ StatusCode: 400,
│ RequestID: "yyyy-xxxx-asds-adsd-sdsds"
│ },
│ Message_: "ResourcePermission list contains unsupported permission sets [quicksight:CreateFolderMembership, quicksight:CreateFolder, quicksight:UpdateFolderPermissions, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]"
│ }

@github-actions github-actions bot removed the waiting-response Maintainers are waiting on response from community or contributor. label Sep 4, 2023
@Mannyknp
Copy link

Hi, Do we have any update on the issue?

Hi, It is true that API itself expects a predefined set of permissions. But I am facing the same issue when I want to change the folder permission from [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions] to [quicksight:DescribeFolder]

as tf tries to delete the existing permissions excluding quicksight:DescribeFolder and runs into same issue.

module.quicksight.aws_quicksight_folder.departments["XXXX"] will be updated in-place ~ resource "aws_quicksight_folder" "XXXX" { id = "abdbcba,xxx-xxx-xxx" name = "XXXX" tags = {} # (9 unchanged attributes hidden)

  ~ permissions {
      ~ actions   = [
          - "quicksight:CreateFolder",
          - "quicksight:CreateFolderMembership",
          - "quicksight:DeleteFolder",
          - "quicksight:DeleteFolderMembership",
          - "quicksight:DescribeFolderPermissions",
          - "quicksight:UpdateFolder",
          - "quicksight:UpdateFolderPermissions",
            # (1 unchanged element hidden)
        ]
        # (1 unchanged attribute hidden)
    }
  + permissions {
      + actions   = [
          + "quicksight:CreateFolder",
          + "quicksight:CreateFolderMembership",
          + "quicksight:DeleteFolder",
          + "quicksight:DeleteFolderMembership",
          + "quicksight:DescribeFolder",
          + "quicksight:DescribeFolderPermissions",
          + "quicksight:UpdateFolder",
          + "quicksight:UpdateFolderPermissions",
        ]
      + principal = "arn:aws:quicksight:us-east-1:aaaaaaaa:group/default/xxx-xxxx"
    }
}

│ Error: updating QuickSight Folder (XXXX) permissions: InvalidParameterValueException: ResourcePermission list contains unsupported permission sets [quicksight:CreateFolderMembership, quicksight:CreateFolder, quicksight:UpdateFolderPermissions, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions] │ { │ RespMetadata: { │ StatusCode: 400, │ RequestID: "yyyy-xxxx-asds-adsd-sdsds" │ }, │ Message_: "ResourcePermission list contains unsupported permission sets [quicksight:CreateFolderMembership, quicksight:CreateFolder, quicksight:UpdateFolderPermissions, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions] for this resource. Valid sets : [quicksight:DescribeFolder] or [quicksight:CreateFolder, quicksight:DescribeFolder, quicksight:UpdateFolder, quicksight:DeleteFolder, quicksight:CreateFolderMembership, quicksight:DeleteFolderMembership, quicksight:DescribeFolderPermissions, quicksight:UpdateFolderPermissions]" │ }

@shubhanshurastogi
Copy link

I also face the same issue when permitting Topic

I get the error as above for Topic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Addresses a defect in current functionality. service/quicksight Issues and PRs that pertain to the quicksight service.
Projects
None yet
Development

No branches or pull requests

5 participants