使用CDK创建Glue数据库配置Lake Formation权限时遇权限不足问题

尝试通过AWS CDK创建Glue数据库并在Lake Formation中配置权限，控制台执行相同操作正常，但代码运行时始终报错：

Insufficient Lake Formation permission(s): Required Create Database on Catalog

已尝试多种IAM角色与策略配置，代码逻辑如下：

class ExampleStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        custom_data_bucket_arn = "arn:aws:s3:::transformed-v5"
        s3_location = "s3://transformed-v5"
        bucket_name = "transformed-v5"

        glue_role = cdk.aws_iam.Role(self, "glue_role", 
            assumed_by=cdk.aws_iam.ServicePrincipal('glue.amazonaws.com'),
            managed_policies= [
                cdk.aws_iam.ManagedPolicy.from_managed_policy_arn(self, 'ManagedGlueRole', 
                    managed_policy_arn='arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole'
                    )
                ]
        )
        
        glue_role.add_to_policy(cdk.aws_iam.PolicyStatement(actions=['s3:GetObject', 's3:PutObject'], effect=cdk.aws_iam.Effect.ALLOW, resources=["arn:aws:s3:::transformed-v5*"]))

        glue_db=cdk.aws_glue.CfnDatabase(self, "Database", 
            catalog_id=cdk.Aws.ACCOUNT_ID,
            database_input=cdk.aws_glue.CfnDatabase.DatabaseInputProperty(
                name="datalake-v5",
                location_uri = s3_location 
            )
        )

        location_resource = cdk.aws_lakeformation.CfnResource(self, 
                "DatalakeLocationResource", 
                resource_arn= custom_data_bucket_arn, 
                use_service_linked_role=True
        )
    
        location_permission = cdk.aws_lakeformation.CfnPermissions(self, "DatalakeLocationPermission",
                data_lake_principal=cdk.aws_lakeformation.CfnPermissions.DataLakePrincipalProperty(
                    data_lake_principal_identifier=glue_role.role_arn),
                resource=cdk.aws_lakeformation.CfnPermissions.ResourceProperty(
                    data_location_resource=cdk.aws_lakeformation.CfnPermissions.DataLocationResourceProperty(
                        s3_resource=custom_data_bucket_arn)),
                permissions=["DATA_LOCATION_ACCESS"]
            )
        #make sure the location resource is created first
        location_permission.add_dependency(location_resource)

        cdk.aws_lakeformation.CfnPermissions(self, "DatabasePermission",
                data_lake_principal=cdk.aws_lakeformation.CfnPermissions.DataLakePrincipalProperty(
                    data_lake_principal_identifier=glue_role.role_arn),
                resource=cdk.aws_lakeformation.CfnPermissions.ResourceProperty(
                    database_resource=cdk.aws_lakeformation.CfnPermissions.DatabaseResourceProperty(
                        name="datalake-v5")),
                permissions=["ALL"],
                permissions_with_grant_option=["ALL"]
            )

核心问题 #

报错根源是CDK部署时使用的执行角色缺少Lake Formation Catalog级别的Create Database权限，而非你配置的Glue服务角色权限不足。

控制台操作正常是因为你当前使用的IAM身份（用户/角色）已拥有Lake Formation的Catalog权限，但CDK默认使用的部署角色（通常是cdk-hnb659fds-deploy-role-<账号ID>-<区域>）没有这个权限，导致调用Glue API创建数据库时被Lake Formation拦截。

解决方法 #

方法1：手动给CDK部署角色添加权限

在Lake Formation控制台操作：

1. 进入Lake Formation控制台，切换到Permissions标签页
2. 点击Grant，选择IAM users and roles，找到你的CDK部署角色
3. 在Resource type选择Catalog，勾选Create database权限
4. 完成授权后重新部署CDK栈

方法2：在CDK代码中自动配置权限

如果需要代码化管理权限，可以添加以下代码，给CDK执行角色授予Catalog级别的CREATE_DATABASE权限：

# 给CDK部署角色授予Lake Formation Catalog的Create Database权限
cdk_deploy_role_arn = cdk.Aws.PRINCIPAL_ARN
cdk.aws_lakeformation.CfnPermissions(self, "CdkDeployCatalogPermission",
    data_lake_principal=cdk.aws_lakeformation.CfnPermissions.DataLakePrincipalProperty(
        data_lake_principal_identifier=cdk_deploy_role_arn
    ),
    resource=cdk.aws_lakeformation.CfnPermissions.ResourceProperty(
        catalog_resource={}
    ),
    permissions=["CREATE_DATABASE"]
)

注意：此方法要求CDK部署角色本身拥有修改Lake Formation权限的权限（即Lake Formation的Grant权限），如果没有，需要先手动给部署角色授予该权限，否则这段代码会先报错。

额外注意点

当Lake Formation启用后，Glue Catalog的权限由Lake Formation接管，不再遵循传统的IAM策略。所以即使你的CDK部署角色有Glue的CreateDatabase IAM权限，也需要额外配置Lake Formation的Catalog权限才能成功创建数据库。

内容的提问来源于stack exchange，提问作者Moki