Lake Formation Permissions
Closed this issue · 6 comments
User Story
The data sharing with lake formation sits within the data engineering role, but long term it probably makes separate into a distinct role that data engineers may also be able to assume, but could equally sit with the data owner or whatever.
Value / Purpose
Security.
Useful Contacts
No response
Additional Information
No response
Definition of Done
- Reviewed Role
- Decided if a new role should be required
- Created Role
Assuming that a large part of this is a requirement to add LakeFormation administrators, could this be solved by customers using the aws_lakeformation_data_lake_settings resource?
So having a specific role for this is because..
makes separate into a distinct role that data engineers may also be able to assume, but could equally sit with the data owner or whatever.
that way data owners dont have total power?
Initially we said this about RAM permissions in the slack thread..
We've had a chat within the team regarding this PR and we're declining to approve it for the following two reasons:
It would allow cross-account sharing of data (e.g. from production to sandbox) which is something we specifically try and avoid.
The permissions would allow a user of that sandbox account to destroy any existing RAM shares.
I have reached out to Matthew Price about this to confirm the current blockers, I dont think there are any as they can do what is required in the data engineering role, but I wanted to know the drive for separating that out to another role that could be assumed
I have also discussed this with @matt-heery and @pricemg . They have tried to make use of the aws_lakeformation_data_lake_settings resource but their needs go beyond simple creation of administrators. I can see on the AWS Provider GitHub issues tracker a number of issues related to how this resource fails to properly strip permissions which explains the need to be able to intervene through the AWS Console. Those requirements are covered in both our sandbox and data-engineer roles.
The requirement for permissions to create RAM shares comes down to how they are embedded within the LakeFormation actions - you can see the AWS Managed Policy AWSLakeFormationCrossAccountManager for more detail.
The easiest way to meet the customer need in the short term would be to either attach AWSLakeFormationCrossAccountManager to the data engineering SSO role through aws_ssoadmin_managed_policy_attachment, or replicating the content of that policy into the attached IAM policy.
NB. Matt & Matthew will raise a GitHub issue in this repository detailing their longer-term needs for us to evaluate and act on.
I've reviewed this issue & moving to done.