separated in own var

Author: patduin

VARIABLES.md

@@ -34,6 +34,8 @@
 | lf\_readonly\_client\_arns                                          | AWS IAM role ARNs granted describe and select permissions on all glue databases and tables using LakeFormation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `list(string)`                   | `[]`                                                                                                                                                                                                                                                                                        |    no    |
 | lf\_catalog\_client\_arns                                          | AWS IAM role ARNs granted describe permissions on all glue databases and tables using LakeFormation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `list(string)`                   | `[]`                                                                                                                                                                                                                                                                                        |    no    |
 | lf\_customer\_accounts                                          | AWS account IDs granted describe permissions on all glue databases using LakeFormation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `list(string)`                   | `[]`                                                                                                                                                                                                                                                                                        |    no    |
+| lf\_catalog\_producer\_arns                               | AWS IAM role ARNs granted ALL permissions on all glue databases and tables using LakeFormation. | `list(string)`                   | `[]`                                                                                                                                                                                                                                                                                        |    no    |
+| lf\_catalog\_data\_location\_access\_producer\_arns       | AWS IAM role ARNs granted `DATA_LOCATION_ACCESS` permissions on all database s3 locations using LakeFormation. NOTE this permission is not granted by `lf_catalog_producer_arns` | `list(string)`                   | `[]`                                                                                                                                                                                                                                                                                        |    no    |
 | dashboard\_namespace                                      | k8s namespace to deploy grafana dashboard.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `string`                 | `"monitoring"`                                                                                                                                                                                                                                                                                 |    no    |
 | db\_apply\_immediately                                    | Specifies whether any cluster modifications are applied immediately, or during the next maintenance window.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `bool`                   | `false`                                                                                                                                                                                                                                                                                        |    no    |
 | db\_backup\_retention                                     | The number of days to retain backups for the RDS Metastore DB.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `string`                 | `"7"`                                                                                                                                                                                                                                                                                          |   yes    |

lf.tf

@@ -101,9 +101,9 @@ resource "aws_lakeformation_permissions" "hms_sys_loc_permissions" {
   }
 }
 
-resource "aws_lakeformation_permissions" "producer_loc_permissions" {
+resource "aws_lakeformation_permissions" "data_location_access_permissions" {
     for_each = var.disable_glue_db_init && var.create_lf_resource ? {
-      for schema in local.catalog_producer_schemas : "${schema["schema_name"]}-${schema["producer_arn"]}"  => schema
+      for schema in local.catalog_data_location_access_producer_schemas : "${schema["schema_name"]}-${schema["producer_arn"]}"  => schema
     } : {}
 
   principal   = each.value.producer_arn
@@ -142,6 +142,12 @@ locals {
       producer_arn = pair[1]
     }
   ]
+  catalog_data_location_access_producer_schemas = [
+    for pair in setproduct(local.schemas_info[*]["schema_name"], var.lf_catalog_data_location_access_producer_arns) : {
+      schema_name  = pair[0]
+      producer_arn = pair[1]
+    }
+  ]
 }
 
 resource "aws_lakeformation_permissions" "catalog_client_permissions" {

variables.tf

@@ -627,6 +627,12 @@ variable "lf_catalog_producer_arns" {
   default     = []
 }
 
+variable lf_catalog_data_location_access_producer_arns {
+  description = "AWS IAM role ARNs granted `DATA_LOCATION_ACCESS` permissions on all database s3 locations using LakeFormation. NOTE this permission is not granted by `lf_catalog_producer_arns`"
+  type        = list(string)
+  default     = []
+}
+
 variable "lf_catalog_glue_sync_arn" {
   description = "AWS IAM role ARN for glue sync to update table metadata. If empty, aws_iam_role.apiary_hms_readwrite.arn will be used."
   type        = string