-
Notifications
You must be signed in to change notification settings - Fork 9.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix athena db reader #19765
Fix athena db reader #19765
Conversation
The current athena database implements a query on read. This means that the terraform plan needs the permission to execute queries against athena as well as permission to write to the s3 bucket where the execution results are stored. This makes it hard to run plan in an environment where we don't want it to modify any aws resources. The StartQueryExecution also does not have a way to restrict the queries. This means that it is possible to use the permissions set up for a terraform plan to run any queries against athena. The fix here is to read the database name from the AwsDataCatalog. In the future, this can be extended to include other catalogs as the support for creating athena catalogs is added to the provider
94c64f6
to
ec02f6f
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 🚀.
% make testacc TESTARGS='-run=TestAccAWSAthenaDatabase_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSAthenaDatabase_ -timeout 180m
=== RUN TestAccAWSAthenaDatabase_basic
=== PAUSE TestAccAWSAthenaDatabase_basic
=== RUN TestAccAWSAthenaDatabase_encryption
=== PAUSE TestAccAWSAthenaDatabase_encryption
=== RUN TestAccAWSAthenaDatabase_nameStartsWithUnderscore
=== PAUSE TestAccAWSAthenaDatabase_nameStartsWithUnderscore
=== RUN TestAccAWSAthenaDatabase_nameCantHaveUppercase
=== PAUSE TestAccAWSAthenaDatabase_nameCantHaveUppercase
=== RUN TestAccAWSAthenaDatabase_destroyFailsIfTablesExist
=== PAUSE TestAccAWSAthenaDatabase_destroyFailsIfTablesExist
=== RUN TestAccAWSAthenaDatabase_forceDestroyAlwaysSucceeds
=== PAUSE TestAccAWSAthenaDatabase_forceDestroyAlwaysSucceeds
=== CONT TestAccAWSAthenaDatabase_basic
=== CONT TestAccAWSAthenaDatabase_destroyFailsIfTablesExist
=== CONT TestAccAWSAthenaDatabase_nameStartsWithUnderscore
=== CONT TestAccAWSAthenaDatabase_encryption
=== CONT TestAccAWSAthenaDatabase_nameCantHaveUppercase
=== CONT TestAccAWSAthenaDatabase_forceDestroyAlwaysSucceeds
--- PASS: TestAccAWSAthenaDatabase_nameCantHaveUppercase (2.48s)
--- PASS: TestAccAWSAthenaDatabase_nameStartsWithUnderscore (41.30s)
--- PASS: TestAccAWSAthenaDatabase_basic (42.55s)
--- PASS: TestAccAWSAthenaDatabase_encryption (46.01s)
--- PASS: TestAccAWSAthenaDatabase_forceDestroyAlwaysSucceeds (46.73s)
--- PASS: TestAccAWSAthenaDatabase_destroyFailsIfTablesExist (54.44s)
PASS
ok github.com/terraform-providers/terraform-provider-aws/aws 57.941s
@harsimranmaan Thanks for the contribution 🎉 👏. |
This functionality has been released in v3.57.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you! |
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
Closes #19085
The current athena database implements a query on read. This means that the terraform plan needs
the permission to execute queries against athena as well as permission to write to the
s3 bucket where the execution results are stored. This makes it hard to run plan in an
environment where we don't want it to modify any aws resources. The StartQueryExecution
also does not have a way to restrict the queries. This means that it is possible to use
the permissions set up for a terraform plan to run any queries against athena.
The fix here is to read the database name from the AwsDataCatalog. In the future, this can
be extended to include other catalogs as the support for creating athena catalogs is added to
the provider
Community Note
Relates OR Closes #0000
Output from acceptance testing: