Policy tag support for aws_lakeformation_permissions

Author: danielcmessias

aws/data_source_aws_lakeformation_permissions.go

@@ -85,6 +85,45 @@ func dataSourceAwsLakeFormationPermissions() *schema.Resource {
 					Type: schema.TypeString,
 				},
 			},
+			"policy_tag": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				MaxItems: 1,
+				ExactlyOneOf: []string{
+					"catalog_resource",
+					"data_location",
+					"database",
+					"table",
+					"table_with_columns",
+					"policy_tag",
+				},
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"key": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: validation.StringLenBetween(1, 128),
+						},
+						"values": {
+							Type:     schema.TypeSet,
+							Required: true,
+							MinItems: 1,
+							MaxItems: 15,
+							Elem: &schema.Schema{
+								Type:         schema.TypeString,
+								ValidateFunc: validatePolicyTagValues(),
+							},
+							Set: schema.HashString,
+						},
+						"catalog_id": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Computed: true,
+						},
+					},
+				},
+			},
 			"principal": {
 				Type:         schema.TypeString,
 				Required:     true,
@@ -194,6 +233,10 @@ func dataSourceAwsLakeFormationPermissionsRead(d *schema.ResourceData, meta inte
 		input.Resource.Database = expandLakeFormationDatabaseResource(v.([]interface{})[0].(map[string]interface{}))
 	}
 
+	if v, ok := d.GetOk("policy_tag"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
+		input.Resource.LFTag = expandLakeFormationLFTagKeyResource(v.([]interface{})[0].(map[string]interface{}))
+	}
+
 	tableType := ""
 
 	if v, ok := d.GetOk("table"); ok && len(v.([]interface{})) > 0 && v.([]interface{})[0] != nil {
@@ -264,6 +307,10 @@ func dataSourceAwsLakeFormationPermissionsRead(d *schema.ResourceData, meta inte
 		cleanPermissions = filterLakeFormationDatabasePermissions(allPermissions)
 	}
 
+	if input.Resource.LFTag != nil {
+		cleanPermissions = filterLakeFormationLFTagPermissions(allPermissions)
+	}
+
 	if tableType == TableTypeTable {
 		cleanPermissions = filterLakeFormationTablePermissions(
 			aws.StringValue(input.Resource.Table.Name),
@@ -310,6 +357,14 @@ func dataSourceAwsLakeFormationPermissionsRead(d *schema.ResourceData, meta inte
 		d.Set("database", nil)
 	}
 
+	if cleanPermissions[0].Resource.LFTag != nil {
+		if err := d.Set("policy_tag", []interface{}{flattenLakeFormationLFTagKeyResource(cleanPermissions[0].Resource.LFTag)}); err != nil {
+			return fmt.Errorf("error setting policy tag: %w", err)
+		}
+	} else {
+		d.Set("policy_tag", nil)
+	}
+
 	tableSet := false
 
 	if v, ok := d.GetOk("table"); ok && len(v.([]interface{})) > 0 {

aws/data_source_aws_lakeformation_permissions_test.go

@@ -87,6 +87,36 @@ func testAccAWSLakeFormationPermissionsDataSource_database(t *testing.T) {
 	})
 }
 
+func testAccAWSLakeFormationPermissionsDataSource_policy_tag(t *testing.T) {
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_lakeformation_permissions.test"
+	dataSourceName := "data.aws_lakeformation_permissions.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t); testAccPartitionHasServicePreCheck(lakeformation.EndpointsID, t) },
+		ErrorCheck:   testAccErrorCheck(t, lakeformation.EndpointsID),
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSLakeFormationPermissionsDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSLakeFormationPermissionsDataSourceConfig_policy_tag(rName),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(resourceName, "principal", dataSourceName, "principal"),
+					resource.TestCheckResourceAttrPair(resourceName, "policy_tag.#", dataSourceName, "policy_tag.#"),
+					resource.TestCheckResourceAttrPair(resourceName, "policy_tag.0.key", dataSourceName, "policy_tag.0.key"),
+					resource.TestCheckResourceAttrPair(resourceName, "policy_tag.0.values", dataSourceName, "policy_tag.0.values"),
+					resource.TestCheckResourceAttrPair(resourceName, "permissions.#", dataSourceName, "permissions.#"),
+					resource.TestCheckResourceAttrPair(resourceName, "permissions.0", dataSourceName, "permissions.0"),
+					resource.TestCheckResourceAttrPair(resourceName, "permissions.1", dataSourceName, "permissions.1"),
+					resource.TestCheckResourceAttrPair(resourceName, "permissions_with_grant_option.#", dataSourceName, "permissions_with_grant_option.#"),
+					resource.TestCheckResourceAttrPair(resourceName, "permissions_with_grant_option.0", dataSourceName, "permissions_with_grant_option.0"),
+					resource.TestCheckResourceAttrPair(resourceName, "permissions_with_grant_option.1", dataSourceName, "permissions_with_grant_option.1"),
+				),
+			},
+		},
+	})
+}
+
 func testAccAWSLakeFormationPermissionsDataSource_table(t *testing.T) {
 	rName := acctest.RandomWithPrefix("tf-acc-test")
 	resourceName := "aws_lakeformation_permissions.test"
@@ -313,6 +343,70 @@ data "aws_lakeformation_permissions" "test" {
 `, rName)
 }
 
+func testAccAWSLakeFormationPermissionsDataSourceConfig_policy_tag(rName string) string {
+	return fmt.Sprintf(`
+data "aws_partition" "current" {}
+
+resource "aws_iam_role" "test" {
+  name = %[1]q
+  path = "/"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "glue.${data.aws_partition.current.dns_suffix}"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+
+data "aws_caller_identity" "current" {}
+
+resource "aws_lakeformation_data_lake_settings" "test" {
+  admins = [data.aws_caller_identity.current.arn]
+ }
+
+resource "aws_lakeformation_policy_tag" "test" {
+  key    = %[1]q
+  values = ["value1", "value2"]
+
+  # for consistency, ensure that admins are setup before testing
+  depends_on = [aws_lakeformation_data_lake_settings.test]
+}
+
+resource "aws_lakeformation_permissions" "test" {
+  permissions                   = ["ASSOCIATE", "DESCRIBE"]
+  permissions_with_grant_option = ["ASSOCIATE", "DESCRIBE"]
+  principal                     = aws_iam_role.test.arn
+
+  policy_tag {
+    key    = aws_lakeformation_policy_tag.test.key
+    values = aws_lakeformation_policy_tag.test.values
+  }
+
+  # for consistency, ensure that admins are setup before testing
+  depends_on = [aws_lakeformation_data_lake_settings.test]
+}
+
+data "aws_lakeformation_permissions" "test" {
+  principal = aws_lakeformation_permissions.test.principal
+
+  policy_tag {
+    key    = aws_lakeformation_policy_tag.test.key
+    values = aws_lakeformation_policy_tag.test.values
+  }
+}
+`, rName)
+}
+
 func testAccAWSLakeFormationPermissionsDataSourceConfig_table(rName string) string {
 	return fmt.Sprintf(`
 data "aws_partition" "current" {}