Chagned LF permissions from hms to variable arn (#314)

Author: javsanbel2

CHANGELOG.md

@@ -3,6 +3,10 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## [7.10.12] - 2025-05-19
+### Added
+- Changed from LF permissions `aws_iam_role.apiary_hms_readwrite.arn` to `var.lf_catalog_glue_sync_arn`.
+
 ## [7.10.11] - 2025-05-16
 ### Added
 - Added variables to support adding custom log4j configuration for readonly,readwrite and housekeeper hms when deployed in Kubernetes.

lf.tf

@@ -27,7 +27,7 @@ resource "aws_lakeformation_permissions" "hms_db_permissions" {
     for schema in local.schemas_info : "${schema["schema_name"]}" => schema
   } : {}
 
-  principal   = aws_iam_role.apiary_hms_readwrite.arn
+  principal   = var.lf_catalog_glue_sync_arn
   permissions = ["DESCRIBE", "CREATE_TABLE"]
 
   database {
@@ -40,7 +40,7 @@ resource "aws_lakeformation_permissions" "hms_tbl_permissions" {
     for schema in local.schemas_info : "${schema["schema_name"]}" => schema
   } : {}
 
-  principal   = aws_iam_role.apiary_hms_readwrite.arn
+  principal   = var.lf_catalog_glue_sync_arn
   permissions = ["ALL", "DESCRIBE"]
 
   table {
@@ -54,7 +54,7 @@ resource "aws_lakeformation_permissions" "hms_loc_permissions" {
     for schema in local.schemas_info : "${schema["schema_name"]}" => schema
   } : {}
 
-  principal   = aws_iam_role.apiary_hms_readwrite.arn
+  principal   = var.lf_catalog_glue_sync_arn
   permissions = ["DATA_LOCATION_ACCESS"]
 
   data_location {
@@ -66,7 +66,7 @@ resource "aws_lakeformation_permissions" "hms_loc_permissions" {
 resource "aws_lakeformation_permissions" "hms_system_db_permissions" {
   count = var.disable_glue_db_init && var.create_lf_resource ? 1 : 0
 
-  principal   = aws_iam_role.apiary_hms_readwrite.arn
+  principal   = var.lf_catalog_glue_sync_arn
   permissions = ["DESCRIBE", "CREATE_TABLE"]
 
   database {
@@ -77,7 +77,7 @@ resource "aws_lakeformation_permissions" "hms_system_db_permissions" {
 resource "aws_lakeformation_permissions" "hms_system_tbl_permissions" {
   count = var.disable_glue_db_init && var.create_lf_resource ? 1 : 0
 
-  principal   = aws_iam_role.apiary_hms_readwrite.arn
+  principal   = var.lf_catalog_glue_sync_arn
   permissions = ["ALL", "DESCRIBE"]
 
   table {
@@ -89,7 +89,7 @@ resource "aws_lakeformation_permissions" "hms_system_tbl_permissions" {
 resource "aws_lakeformation_permissions" "hms_sys_loc_permissions" {
   count = var.disable_glue_db_init && var.create_lf_resource ? 1 : 0
 
-  principal   = aws_iam_role.apiary_hms_readwrite.arn
+  principal   = var.lf_catalog_glue_sync_arn
   permissions = ["DATA_LOCATION_ACCESS"]
 
   data_location {

variables.tf

@@ -615,6 +615,12 @@ variable "lf_catalog_producer_arns" {
   default     = []
 }
 
+variable "lf_catalog_glue_sync_arn" {
+  description = "AWS IAM role ARN for glue sync to update table metadata."
+  type        = string
+  default     = ""
+}
+
 variable "lf_customer_accounts" {
   description = "AWS account IDs granted describe permissions on all glue databases using LakeFormation."
   type        = list(string)