Skip to content

Commit 56ea894

Browse files
bfladbflad
authored
resource/aws_kinesis_firehose_delivery_stream: Use IAM timeout constant for retries, add LakeFormation permissions retries and configuration to tests (#17254)
* resource/aws_kinesis_firehose_delivery_stream: Use IAM timeout constant for retries, add LakeFormation permissions retries and configuration to tests Reference: #16752 Previously: ``` === CONT TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_HiveJsonSerDe_Empty resource_aws_kinesis_firehose_delivery_stream_test.go:638: Step 1/2 error: Error running apply: Error: error creating Kinesis Firehose Delivery Stream: InvalidArgumentException: Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions. Insufficient Lake Formation permission(s) on tf-acc-test-4731441258578020859 (Service: AWSGlue; Status Code: 400; Error Code: AccessDeniedException; Request ID: 67116cf3-6102-4d1e-9229-a8c0e63cf9f7; Proxy: null) --- FAIL: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_HiveJsonSerDe_Empty (21.32s) === CONT TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Deserializer_Update resource_aws_kinesis_firehose_delivery_stream_test.go:596: Step 1/3 error: Error running apply: Error: error creating Kinesis Firehose Delivery Stream: InvalidArgumentException: Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions. Insufficient Lake Formation permission(s) on tf-acc-test-1453880257072042205 (Service: AWSGlue; Status Code: 400; Error Code: AccessDeniedException; Request ID: a5a8ef8d-e7c8-419b-a5a3-b762145c6783; Proxy: null) --- FAIL: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Deserializer_Update (30.13s) === CONT TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_OpenXJsonSerDe_Empty resource_aws_kinesis_firehose_delivery_stream_test.go:669: Step 1/2 error: Error running apply: Error: error creating Kinesis Firehose Delivery Stream: InvalidArgumentException: Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions. Insufficient Lake Formation permission(s) on tf-acc-test-4296742326842474514 (Service: AWSGlue; Status Code: 400; Error Code: AccessDeniedException; Request ID: 67b204a4-290f-4b8b-bba7-ec850759a4fe; Proxy: null) --- FAIL: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_OpenXJsonSerDe_Empty (18.58s) === CONT TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_OrcSerDe_Empty resource_aws_kinesis_firehose_delivery_stream_test.go:700: Step 1/2 error: Error running apply: Error: error creating Kinesis Firehose Delivery Stream: InvalidArgumentException: Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions. Insufficient Lake Formation permission(s) on tf-acc-test-4205955522949248362 (Service: AWSGlue; Status Code: 400; Error Code: AccessDeniedException; Request ID: 9cd73bb5-9a58-4c35-b2da-4e3f12e17415; Proxy: null) --- FAIL: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_OrcSerDe_Empty (21.11s) === CONT TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_ParquetSerDe_Empty resource_aws_kinesis_firehose_delivery_stream_test.go:731: Step 1/2 error: Error running apply: Error: error creating Kinesis Firehose Delivery Stream: InvalidArgumentException: Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions. Insufficient Lake Formation permission(s) on tf-acc-test-2371862365551213044 (Service: AWSGlue; Status Code: 400; Error Code: AccessDeniedException; Request ID: 2e0188ba-98ba-496b-99f1-804376dc5862; Proxy: null) --- FAIL: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_ParquetSerDe_Empty (25.47s) === CONT TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Serializer_Update resource_aws_kinesis_firehose_delivery_stream_test.go:762: Step 1/3 error: Error running apply: Error: error creating Kinesis Firehose Delivery Stream: InvalidArgumentException: Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions. Insufficient Lake Formation permission(s) on tf-acc-test-2168117662921768660 (Service: AWSGlue; Status Code: 400; Error Code: AccessDeniedException; Request ID: aa73610e-cac0-44a6-8e0a-fded3e5c6bd9; Proxy: null) --- FAIL: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Serializer_Update (25.85s) === CONT TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Enabled resource_aws_kinesis_firehose_delivery_stream_test.go:490: Step 3/4 error: Error running apply: Error: Error Updating Kinesis Firehose Delivery Stream: "tf-acc-test-8695271398619453258" InvalidArgumentException: Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions. Insufficient Lake Formation permission(s) on tf-acc-test-8695271398619453258 (Service: AWSGlue; Status Code: 400; Error Code: AccessDeniedException; Request ID: c6b9cf64-3918-4140-b85b-fe53c0a4406b; Proxy: null) --- FAIL: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Enabled (111.38s) ``` Output from acceptance testing in AWS Commercial: ``` --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_basic (131.86s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_disappears (90.21s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ElasticsearchConfigEndpointUpdates (678.89s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ElasticsearchConfigUpdates (975.34s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ElasticsearchWithVpcConfigUpdates (1432.78s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Deserializer_Update (160.49s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Enabled (176.11s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_HiveJsonSerDe_Empty (135.95s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_OpenXJsonSerDe_Empty (131.68s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_OrcSerDe_Empty (120.16s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_ParquetSerDe_Empty (136.73s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Serializer_Update (120.12s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_ErrorOutputPrefix (124.47s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_ExternalUpdate (162.47s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_KinesisStreamSource (95.95s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_ProcessingConfiguration_Empty (126.45s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3basic (136.44s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3KmsKeyArn (124.11s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3Updates (176.36s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_HttpEndpointConfiguration (135.22s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_HttpEndpointConfiguration_RetryDuration (126.68s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_missingProcessingConfiguration (126.21s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_RedshiftConfigUpdates (437.94s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3basic (104.37s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3basicWithSSE (295.11s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3basicWithSSEAndKeyArn (260.98s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3basicWithSSEAndKeyType (248.31s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3basicWithTags (140.47s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3ConfigUpdates (197.64s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3KinesisStreamSource (94.39s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3WithCloudwatchLogging (81.40s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_SplunkConfigUpdates (156.62s) ``` Output from acceptance testing in AWS GovCloud (US): ``` --- FAIL: TestAccAWSKinesisFirehoseDeliveryStream_RedshiftConfigUpdates (18.19s) # unrelated; did not succeed while acquiring capacity --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_basic (112.04s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_disappears (82.08s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ElasticsearchConfigEndpointUpdates (727.48s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ElasticsearchConfigUpdates (640.24s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ElasticsearchWithVpcConfigUpdates (1538.54s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Deserializer_Update (134.15s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Enabled (162.17s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_HiveJsonSerDe_Empty (96.38s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_OpenXJsonSerDe_Empty (101.65s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_OrcSerDe_Empty (101.56s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_ParquetSerDe_Empty (110.19s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_DataFormatConversionConfiguration_Serializer_Update (95.24s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_ErrorOutputPrefix (127.33s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_ExternalUpdate (122.80s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_KinesisStreamSource (103.54s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3_ProcessingConfiguration_Empty (91.54s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3basic (120.64s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3KmsKeyArn (107.85s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_ExtendedS3Updates (158.79s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_HttpEndpointConfiguration (108.81s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_HttpEndpointConfiguration_RetryDuration (113.39s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_missingProcessingConfiguration (101.69s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3basic (66.63s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3basicWithSSE (212.50s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3basicWithSSEAndKeyArn (191.54s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3basicWithSSEAndKeyType (218.06s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3basicWithTags (126.11s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3ConfigUpdates (169.25s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3KinesisStreamSource (105.90s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_s3WithCloudwatchLogging (94.65s) --- PASS: TestAccAWSKinesisFirehoseDeliveryStream_SplunkConfigUpdates (148.60s) ``` * Update CHANGELOG for #17254
1 parent ddd0d84 commit 56ea894

3 files changed

Lines changed: 96 additions & 29 deletions

File tree

‎.changelog/17254.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
resource/aws_kinesis_firehose_delivery_stream: Use standard retry timeout for IAM eventual consistency and retry on LakeFormation access errors
3+
```

‎aws/resource_aws_kinesis_firehose_delivery_stream.go‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,12 @@ import (
1010
"github.com/aws/aws-sdk-go/aws"
1111
"github.com/aws/aws-sdk-go/aws/arn"
1212
"github.com/aws/aws-sdk-go/service/firehose"
13+
"github.com/hashicorp/aws-sdk-go-base/tfawserr"
1314
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
1415
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
1516
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
1617
"github.com/terraform-providers/terraform-provider-aws/aws/internal/keyvaluetags"
18+
iamwaiter "github.com/terraform-providers/terraform-provider-aws/aws/internal/service/iam/waiter"
1719
)
1820

1921
const (
@@ -2515,30 +2517,31 @@ func resourceAwsKinesisFirehoseDeliveryStreamCreate(d *schema.ResourceData, meta
25152517
createInput.Tags = keyvaluetags.New(v.(map[string]interface{})).IgnoreAws().FirehoseTags()
25162518
}
25172519

2518-
err := resource.Retry(1*time.Minute, func() *resource.RetryError {
2520+
err := resource.Retry(iamwaiter.PropagationTimeout, func() *resource.RetryError {
25192521
_, err := conn.CreateDeliveryStream(createInput)
25202522
if err != nil {
2521-
log.Printf("[DEBUG] Error creating Firehose Delivery Stream: %s", err)
2523+
// Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions.
2524+
if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Access was denied") {
2525+
return resource.RetryableError(err)
2526+
}
25222527

2523-
// Retry for IAM eventual consistency
2524-
if isAWSErr(err, firehose.ErrCodeInvalidArgumentException, "is not authorized to") {
2528+
if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "is not authorized to") {
25252529
return resource.RetryableError(err)
25262530
}
2527-
// Retry for IAM eventual consistency
2528-
if isAWSErr(err, firehose.ErrCodeInvalidArgumentException, "Please make sure the role specified in VpcConfiguration has permissions") {
2531+
2532+
if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Please make sure the role specified in VpcConfiguration has permissions") {
25292533
return resource.RetryableError(err)
25302534
}
2535+
25312536
// InvalidArgumentException: Verify that the IAM role has access to the ElasticSearch domain.
2532-
if isAWSErr(err, firehose.ErrCodeInvalidArgumentException, "Verify that the IAM role has access") {
2537+
if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Verify that the IAM role has access") {
25332538
return resource.RetryableError(err)
25342539
}
2535-
// IAM roles can take ~10 seconds to propagate in AWS:
2536-
// http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#launch-instance-with-role-console
2537-
if isAWSErr(err, firehose.ErrCodeInvalidArgumentException, "Firehose is unable to assume role") {
2538-
log.Printf("[DEBUG] Firehose could not assume role referenced, retrying...")
2540+
2541+
if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Firehose is unable to assume role") {
25392542
return resource.RetryableError(err)
25402543
}
2541-
// Not retryable
2544+
25422545
return resource.NonRetryableError(err)
25432546
}
25442547

@@ -2660,30 +2663,31 @@ func resourceAwsKinesisFirehoseDeliveryStreamUpdate(d *schema.ResourceData, meta
26602663
}
26612664
}
26622665

2663-
err := resource.Retry(1*time.Minute, func() *resource.RetryError {
2666+
err := resource.Retry(iamwaiter.PropagationTimeout, func() *resource.RetryError {
26642667
_, err := conn.UpdateDestination(updateInput)
26652668
if err != nil {
2666-
log.Printf("[DEBUG] Error updating Firehose Delivery Stream: %s", err)
2669+
// Access was denied when calling Glue. Please ensure that the role specified in the data format conversion configuration has the necessary permissions.
2670+
if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Access was denied") {
2671+
return resource.RetryableError(err)
2672+
}
26672673

2668-
// Retry for IAM eventual consistency
2669-
if isAWSErr(err, firehose.ErrCodeInvalidArgumentException, "is not authorized to") {
2674+
if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "is not authorized to") {
26702675
return resource.RetryableError(err)
26712676
}
2672-
// Retry for IAM eventual consistency
2673-
if isAWSErr(err, firehose.ErrCodeInvalidArgumentException, "Please make sure the role specified in VpcConfiguration has permissions") {
2677+
2678+
if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Please make sure the role specified in VpcConfiguration has permissions") {
26742679
return resource.RetryableError(err)
26752680
}
2681+
26762682
// InvalidArgumentException: Verify that the IAM role has access to the ElasticSearch domain.
2677-
if isAWSErr(err, firehose.ErrCodeInvalidArgumentException, "Verify that the IAM role has access") {
2683+
if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Verify that the IAM role has access") {
26782684
return resource.RetryableError(err)
26792685
}
2680-
// IAM roles can take ~10 seconds to propagate in AWS:
2681-
// http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#launch-instance-with-role-console
2682-
if isAWSErr(err, firehose.ErrCodeInvalidArgumentException, "Firehose is unable to assume role") {
2683-
log.Printf("[DEBUG] Firehose could not assume role referenced, retrying...")
2686+
2687+
if tfawserr.ErrMessageContains(err, firehose.ErrCodeInvalidArgumentException, "Firehose is unable to assume role") {
26842688
return resource.RetryableError(err)
26852689
}
2686-
// Not retryable
2690+
26872691
return resource.NonRetryableError(err)
26882692
}
26892693

‎aws/resource_aws_kinesis_firehose_delivery_stream_test.go‎

Lines changed: 65 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1833,11 +1833,21 @@ resource "aws_iam_role_policy" "firehose" {
18331833
"Sid": "GlueAccess",
18341834
"Effect": "Allow",
18351835
"Action": [
1836+
"glue:GetTable",
1837+
"glue:GetTableVersion",
18361838
"glue:GetTableVersions"
18371839
],
18381840
"Resource": [
18391841
"*"
18401842
]
1843+
},
1844+
{
1845+
"Sid": "LakeFormationDataAccess",
1846+
"Effect": "Allow",
1847+
"Action": [
1848+
"lakeformation:GetDataAccess"
1849+
],
1850+
"Resource": "*"
18411851
}
18421852
]
18431853
}
@@ -2226,6 +2236,16 @@ resource "aws_glue_catalog_table" "test" {
22262236
}
22272237
}
22282238
2239+
resource "aws_lakeformation_permissions" "test" {
2240+
permissions = ["ALL"]
2241+
principal = aws_iam_role.firehose.arn
2242+
2243+
table {
2244+
database_name = aws_glue_catalog_database.test.name
2245+
name = aws_glue_catalog_table.test.name
2246+
}
2247+
}
2248+
22292249
resource "aws_kinesis_firehose_delivery_stream" "test" {
22302250
destination = "extended_s3"
22312251
name = %[1]q
@@ -2259,7 +2279,7 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
22592279
}
22602280
}
22612281
2262-
depends_on = [aws_iam_role_policy.firehose]
2282+
depends_on = [aws_iam_role_policy.firehose, aws_lakeformation_permissions.test]
22632283
}
22642284
`, rName, enabled)
22652285
}
@@ -2282,6 +2302,16 @@ resource "aws_glue_catalog_table" "test" {
22822302
}
22832303
}
22842304
2305+
resource "aws_lakeformation_permissions" "test" {
2306+
permissions = ["ALL"]
2307+
principal = aws_iam_role.firehose.arn
2308+
2309+
table {
2310+
database_name = aws_glue_catalog_database.test.name
2311+
name = aws_glue_catalog_table.test.name
2312+
}
2313+
}
2314+
22852315
resource "aws_kinesis_firehose_delivery_stream" "test" {
22862316
destination = "extended_s3"
22872317
name = %[1]q
@@ -2313,7 +2343,7 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
23132343
}
23142344
}
23152345
2316-
depends_on = [aws_iam_role_policy.firehose]
2346+
depends_on = [aws_iam_role_policy.firehose, aws_lakeformation_permissions.test]
23172347
}
23182348
`, rName)
23192349
}
@@ -2350,6 +2380,16 @@ resource "aws_glue_catalog_table" "test" {
23502380
}
23512381
}
23522382
2383+
resource "aws_lakeformation_permissions" "test" {
2384+
permissions = ["ALL"]
2385+
principal = aws_iam_role.firehose.arn
2386+
2387+
table {
2388+
database_name = aws_glue_catalog_database.test.name
2389+
name = aws_glue_catalog_table.test.name
2390+
}
2391+
}
2392+
23532393
resource "aws_kinesis_firehose_delivery_stream" "test" {
23542394
destination = "extended_s3"
23552395
name = %[1]q
@@ -2381,7 +2421,7 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
23812421
}
23822422
}
23832423
2384-
depends_on = [aws_iam_role_policy.firehose]
2424+
depends_on = [aws_iam_role_policy.firehose, aws_lakeformation_permissions.test]
23852425
}
23862426
`, rName)
23872427
}
@@ -2404,6 +2444,16 @@ resource "aws_glue_catalog_table" "test" {
24042444
}
24052445
}
24062446
2447+
resource "aws_lakeformation_permissions" "test" {
2448+
permissions = ["ALL"]
2449+
principal = aws_iam_role.firehose.arn
2450+
2451+
table {
2452+
database_name = aws_glue_catalog_database.test.name
2453+
name = aws_glue_catalog_table.test.name
2454+
}
2455+
}
2456+
24072457
resource "aws_kinesis_firehose_delivery_stream" "test" {
24082458
destination = "extended_s3"
24092459
name = %[1]q
@@ -2435,7 +2485,7 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
24352485
}
24362486
}
24372487
2438-
depends_on = [aws_iam_role_policy.firehose]
2488+
depends_on = [aws_iam_role_policy.firehose, aws_lakeformation_permissions.test]
24392489
}
24402490
`, rName)
24412491
}
@@ -2458,6 +2508,16 @@ resource "aws_glue_catalog_table" "test" {
24582508
}
24592509
}
24602510
2511+
resource "aws_lakeformation_permissions" "test" {
2512+
permissions = ["ALL"]
2513+
principal = aws_iam_role.firehose.arn
2514+
2515+
table {
2516+
database_name = aws_glue_catalog_database.test.name
2517+
name = aws_glue_catalog_table.test.name
2518+
}
2519+
}
2520+
24612521
resource "aws_kinesis_firehose_delivery_stream" "test" {
24622522
destination = "extended_s3"
24632523
name = %[1]q
@@ -2489,7 +2549,7 @@ resource "aws_kinesis_firehose_delivery_stream" "test" {
24892549
}
24902550
}
24912551
2492-
depends_on = [aws_iam_role_policy.firehose]
2552+
depends_on = [aws_iam_role_policy.firehose, aws_lakeformation_permissions.test]
24932553
}
24942554
`, rName)
24952555
}

0 commit comments

Comments
 (0)
⚡