another reorg of the catalog and glue database policies

Author: brifordwylie

aws_setup/workbench_core/workbench_core/workbench_core_stack.py

@@ -55,7 +55,7 @@ def __init__(
         self.workbench_glue_role = self.create_glue_role()
 
     ####################
-    #    S3 Section    #
+    #    S3 Buckets    #
     ####################
     def _bucket_names_to_arns(self, bucket_list: list[str]) -> list[str]:
         """Convert a list of dynamic bucket names to ARNs."""
@@ -108,25 +108,23 @@ def s3_public() -> iam.PolicyStatement:
             resources=["arn:aws:s3:::*"],
         )
 
-    ##############################
-    #    Glue Data Catalog       #
-    ##############################
+    ######################
+    #    Glue Catalog    #
+    ######################
     def glue_catalog_read(self) -> iam.PolicyStatement:
-        """Read-only access to the entire Glue Data Catalog."""
+        """Read-only discovery across the entire Glue Data Catalog."""
         return iam.PolicyStatement(
             actions=[
                 "glue:GetDatabases",
                 "glue:GetTable",
                 "glue:GetTables",
                 "glue:SearchTables",
-                "glue:GetPartition",
-                "glue:GetPartitions",
             ],
             resources=[f"arn:aws:glue:{self.region}:{self.account}:catalog"],
         )
 
     def glue_catalog_full(self) -> iam.PolicyStatement:
-        """Full access to the Glue Data Catalog including CRUD operations."""
+        """Full catalog access including database creation."""
         read_statement = self.glue_catalog_read()
         return iam.PolicyStatement(
             actions=read_statement.actions + [
@@ -138,6 +136,49 @@ def glue_catalog_full(self) -> iam.PolicyStatement:
             resources=[f"arn:aws:glue:{self.region}:{self.account}:catalog"],
         )
 
+    #######################
+    #    Glue Database    #
+    #######################
+    def glue_databases_read(self) -> iam.PolicyStatement:
+        """Read-only access to Workbench-managed databases and tables."""
+        return iam.PolicyStatement(
+            actions=[
+                "glue:GetDatabase",
+                "glue:GetTable",
+                "glue:GetTables",
+                "glue:GetPartition",
+                "glue:GetPartitions",
+            ],
+            resources=self._workbench_database_arns(),
+        )
+
+    def glue_databases_full(self) -> iam.PolicyStatement:
+        """Full access to Workbench-managed databases and tables."""
+        return iam.PolicyStatement(
+            actions=[
+                "glue:GetDatabase",
+                "glue:GetTable",
+                "glue:GetTables",
+                "glue:CreateTable",
+                "glue:UpdateTable",
+                "glue:DeleteTable",
+                "glue:GetPartition",
+                "glue:GetPartitions",
+            ],
+            resources=self._workbench_database_arns(),
+        )
+
+    def _workbench_database_arns(self) -> list[str]:
+        """Helper to get all Workbench-managed database/table ARNs."""
+        return [
+            f"arn:aws:glue:{self.region}:{self.account}:database/workbench",
+            f"arn:aws:glue:{self.region}:{self.account}:table/workbench/*",
+            f"arn:aws:glue:{self.region}:{self.account}:database/sagemaker_featurestore",
+            f"arn:aws:glue:{self.region}:{self.account}:table/sagemaker_featurestore/*",
+            f"arn:aws:glue:{self.region}:{self.account}:database/inference_store",
+            f"arn:aws:glue:{self.region}:{self.account}:table/inference_store/*",
+        ]
+
     def glue_pass_role(self) -> iam.PolicyStatement:
         """Allows us to specify the Workbench-Glue role when creating a Glue Job"""
         return iam.PolicyStatement(
@@ -663,6 +704,7 @@ def workbench_datasource_policy(self) -> iam.ManagedPolicy:
             self.s3_full(),
             self.s3_public(),
             self.glue_catalog_full(),
+            self.glue_databases_full(),
             self.glue_job_read_policy(),
             self.glue_job_create_policy(),
             self.glue_job_connections_policy_statement(),
@@ -684,6 +726,7 @@ def workbench_featureset_policy(self) -> iam.ManagedPolicy:
         policy_statements = [
             self.s3_full(),
             self.glue_catalog_full(),
+            self.glue_databases_full(),
             self.athena_policy_statement(),
             self.athena_workgroup_policy_statement(),
             self.featurestore_list_policy_statement(),