feat: grant query permissions from CDK - #91
Merged
Conversation
A downstream project retyped a fourteen-action PolicyStatement out of
docs/query-workgroup/, and kept whatever was true on the day it copied.
Two grants replace that with one line per identity.
queries.grantQuerying(role, table);
summaries.grantReadingSummaries(role);
grantQuerying attaches everything one query touches, scoped to this
deployment. Athena on the workgroup, Glue on the catalog, the database
and the table, reads on the log bucket, and reads and writes on the
results bucket. grantReadingSummaries attaches the one GetObject the
summary path sends. Either call hands out kms:Decrypt for a bucket kept
under a customer key.
The statements live beside the ones the scheduled job already held, so
one definition now covers both callers. That gained the results bucket,
which the job was taking through Bucket.grantReadWrite, and the job
therefore loses the s3:DeleteObject it never sent. It gained the two
named-query actions rainlytics saved-query needs as well, kept apart
from the job, which is handed its SQL at deploy time.
docs/query-workgroup/ now opens its permissions section with the four
actions ReadOnlyAccess denies, measured on 2026-08-28 with
aws iam simulate-principal-policy against an AWSReservedSSO_ReadOnly
role. The written-out policy stays below, for an identity built outside
CDK, and gains athena:GetWorkGroup and the two named-query actions.
SummariesBucket gains bucketArn and encryptionKey. IBucket and Bucket
both still satisfy it, and a consumer assembling one by hand has two
more fields to supply.
Closes #83
|
Warning Review limit reachedNext included review available in 53 minutes. View limit detailsLimit details: You’ve used all 2 included reviews currently available. Your 88 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour. Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (12)
Comment |
This was referenced Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Downstream projects have been retyping a fourteen-action
PolicyStatementout of the prose indocs/query-workgroup/, keeping whatever was true on the day they copied it. Two grants replace that with one line per identity.queries.grantQuerying(role, table)attaches everything one query touches, scoped to this deployment: Athena on the workgroup, Glue on the catalog, the database and the table, reads on the log bucket, and reads and writes on the results bucket.summaries.grantReadingSummaries(role)attaches the ones3:GetObjectthe summary path sends. Either call hands outkms:Decryptfor a bucket kept under a customer key. The statements sit beside the ones the scheduled job already held, so one definition now covers both callers, which gained the results bucket (the job was taking that throughBucket.grantReadWrite, and so loses thes3:DeleteObjectit never sent) and the two named-query actionsrainlytics saved-queryneeds.docs/query-workgroup/now opens its permissions section with the four actionsReadOnlyAccessdenies, measured on 2026-08-28 withaws iam simulate-principal-policyagainst anAWSReservedSSO_ReadOnlyrole, with the written-out policy below it for an identity built outside CDK.SummariesBucketgainsbucketArnandencryptionKey, whichIBucketandBucketboth still satisfy.No new AWS service, so nothing changes about the pricing shape. IAM carries no charge.
Resolves #83
Conventional commit message, used as the title
Conventional branch name, like
feat/concise-descriptionFull check with
pnpm run checkpassedRebased off latest main
User-facing behaviour is documented in
docs/