feat: add AthenaQueryPolicy_v2 with current Athena API actions - #3953
feat: add AthenaQueryPolicy_v2 with current Athena API actions#3953roger-zhangg wants to merge 4 commits into
Conversation
![aws-sam-tooling-bot[bot]](https://avatars.githubusercontent.com/b/1290?s=60&v=4){kind=small}
Adds AthenaQueryPolicy_v2 using current (non-deprecated) Athena APIs while preserving the original AthenaQueryPolicy unchanged for backward compatibility. This follows the established _v2 pattern used by KMSEncryptPolicy_v2, StepFunctionsExecutionPolicy_v2, etc. Fixes aws#3785
ac2961c to
0eed981
Compare
roger-zhangg
changed the title
Address security review feedback: - Remove athena:GetWorkGroup from Statement 1 (Resource: *) since it is already granted in Statement 2 scoped to the specific workgroup - Move athena:GetDatabase and athena:GetTableMetadata to Statement 2 (workgroup-scoped) for least-privilege - Keep only list/discover actions in Statement 1 (Resource: *) since those don't support resource-level permissions - Regenerate all 3 partition test expected outputs
These actions operate on the datacatalog resource type, not workgroup. Placing them in the workgroup-scoped statement would result in AccessDenied at runtime since the ARN shapes don't match. Statement 1 (Resource: *) now contains: - List/discover actions (ListWorkGroups, ListDataCatalogs, etc.) - Datacatalog-scoped actions (GetDatabase, GetTableMetadata) - Glue equivalents (GetDatabase, GetDatabases, GetTable, GetTables) Statement 2 (workgroup ARN) contains: - Query execution actions - GetWorkGroup (correctly scoped to specific workgroup) Regenerated all 3 partition test expected outputs.
|
Any reason to create this PR instead of using the previous #3786 ? (That one is more specific since users can pass instead of only the |
|
You're right, and thanks for catching it — #3786 predates this and is the better change. I opened this without finding #3786 first; that was a triage miss on my side. #3786 is strictly more capable: it scopes to Closing this in favour of #3786. I'll move my review over there — #3786 is currently |
2 participants
Summary
Adds
AthenaQueryPolicy_v2with current (non-deprecated) Athena API actions, following the established_v2pattern.The original
AthenaQueryPolicyis preserved unchanged for backward compatibility (per DEVELOPMENT_GUIDE.md: "A specific SAM template should always transform into the same CloudFormation template").Changes
AthenaQueryPolicy_v2with updated actions (athena:GetWorkGroup,athena:ListDataCatalogs,athena:GetDatabase,athena:ListDatabases,athena:ListTableMetadata,athena:GetTableMetadata) + required Glue Data Catalog permissions (glue:GetDatabase,glue:GetDatabases,glue:GetTable,glue:GetTables)AthenaQueryPolicy(deprecated APIs still work, users won't see silent IAM changes on stack update)Migration
Users should update their SAM templates from
AthenaQueryPolicytoAthenaQueryPolicy_v2at their convenience.Fixes #3785