feat: name the actions a refused query takes - #92
Merged
Conversation
A caller who could not start a query got whatever the SDK threw, with a sentence about the region on the end. On a permissions failure that pointed the reader at the one thing that was already right. `queryRows` now recognises a refusal AWS gave for want of a permission. It answers with the four actions running a query takes. Those are athena:StartQueryExecution and athena:StopQueryExecution on the workgroup, and s3:PutObject and s3:AbortMultipartUpload on the bucket that workgroup writes results to. #83 measured them. The message goes on to name the summary path. The five named questions answer from a precomputed summary on s3:GetObject alone. An identity refused a query usually still has an answer available, and --summaries and RAINLYTICS_SUMMARY_BUCKET are where that bucket is named. The message lives in the command line. `refusalIn` is shared with the scheduled job, and the job has no summary to offer. A refusal about anything else keeps the region sentence and reaches the reader as Athena wrote it. `refusalFor` in summary-lookup.ts gets the same treatment for an S3 Access Denied. It names s3:GetObject and the bucket, and drops the two options for finding a bucket somewhere else. The cases are end to end. Simulated IAM refuses a role that may read Athena and do nothing else, through `rainlytics query`, `rainlytics saved-query`, a named question given --query, and a summary read. Closes #84
The command line page covers the credentials and says nothing about what the identity behind them has to be allowed. The two halves of the command surface need different permissions, and the four a query takes are the ones a read-only role is missing.
|
Warning Review limit reachedNext included review available in 49 minutes. View limit detailsLimit details: You’ve used all 2 included reviews currently available. Your 89 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour. Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A caller who could not start a query got whatever the SDK threw with a sentence about the region on the end, which on a permissions failure pointed at the one thing that was already right. The command line now recognises a refusal AWS gave for want of a permission and names the four actions running a query takes, being
athena:StartQueryExecutionandathena:StopQueryExecutionon the workgroup ands3:PutObjectands3:AbortMultipartUploadon the bucket that workgroup writes results to, then points at the summary path, since the five named questions answer from a precomputed summary ons3:GetObjectalone and an identity refused a query usually still has an answer available. The message lives inqueryRowsrather than inrefusalIn, which the scheduled job shares and which has no summary to offer, so a refusal about anything else keeps the region sentence and reaches the reader as Athena wrote it.refusalForinsummary-lookup.tsgets the same treatment for an S3Access Denied. The cases are end to end, with simulated IAM refusing a role that may read Athena and do nothing else throughrainlytics query,rainlytics saved-query, a named question given--query, and a summary read.Resolves #84
Conventional commit message, used as the title
Conventional branch name, like
feat/concise-descriptionFull check with
pnpm run checkpassedRebased off latest main
User-facing behaviour is documented in
docs/See https://www.conventionalcommits.org/en/v1.0.0/