We experimented with the aws-data-mesh-utils to create a simple setup similar to the one outlined in the documentation here.
However, we noticed that the DataMeshConsumer role does not seem to have access to the shared data product (it can see the Glue database, but not the shared Glue table due to insufficient Lake Formation permissions). The reason for this seems to be that the approve-subscription step grants Lake Formation permissions to the consumer account as principal, and not to the DataMeshConsumer IAM role as principal.
Is this the intended setup? From what I can see in the code, the request-access step uses the requesting account ID as the subscriber principal in the DynamoDB table entry and in the subsequent approve-subscription step, this account is used as the principal the Lake Formation permissions are granted to.
We experimented with the aws-data-mesh-utils to create a simple setup similar to the one outlined in the documentation here.
However, we noticed that the DataMeshConsumer role does not seem to have access to the shared data product (it can see the Glue database, but not the shared Glue table due to insufficient Lake Formation permissions). The reason for this seems to be that the
approve-subscriptionstep grants Lake Formation permissions to the consumer account as principal, and not to the DataMeshConsumer IAM role as principal.Is this the intended setup? From what I can see in the code, the
request-accessstep uses the requesting account ID as the subscriber principal in the DynamoDB table entry and in the subsequentapprove-subscriptionstep, this account is used as the principal the Lake Formation permissions are granted to.