diff --git a/packages/@aws-cdk/aws-redshift-alpha/lib/private/privileges.ts b/packages/@aws-cdk/aws-redshift-alpha/lib/private/privileges.ts index 4284e679e46e1..f510d49bbe87c 100644 --- a/packages/@aws-cdk/aws-redshift-alpha/lib/private/privileges.ts +++ b/packages/@aws-cdk/aws-redshift-alpha/lib/private/privileges.ts @@ -5,7 +5,7 @@ import { ITable, TableAction } from '../table'; import { IUser } from '../user'; import { DatabaseQuery } from './database-query'; import { HandlerName } from './database-query-provider/handler-name'; -import { UserTablePrivilegesHandlerProps } from './handler-props'; +import { TablePrivilege as SerializedTablePrivilege, UserTablePrivilegesHandlerProps } from './handler-props'; /** * The Redshift table and action that make up a privilege that can be granted to a Redshift user. @@ -62,25 +62,33 @@ export class UserTablePrivileges extends Construct { username: props.user.username, tablePrivileges: cdk.Lazy.any({ produce: () => { - const groupedPrivileges = this.privileges.reduce( - (privileges, { table, actions }) => ({ - ...privileges, - [table.node.id]: { - actions: [ - ...(privileges[table.node.id]?.actions ?? []), - ...actions, - ], + const reducedPrivileges = this.privileges.reduce((privileges, { table, actions }) => { + const tableId = table.node.id; + if (!(tableId in privileges)) { + privileges[tableId] = { tableName: table.tableName, - }, - }), - {} as Record, - ); - - return Object.entries(groupedPrivileges).map(([tableId, config]) => ({ + actions: [], + }; + } + actions = actions.concat(privileges[tableId].actions); + if (actions.includes(TableAction.ALL)) { + actions = [TableAction.ALL]; + } + if (actions.includes(TableAction.UPDATE) || actions.includes(TableAction.DELETE)) { + actions.push(TableAction.SELECT); + } + privileges[tableId] = { + tableName: table.tableName, + actions: Array.from(new Set(actions)), + }; + return privileges; + }, {} as { [key: string]: { tableName: string; actions: TableAction[] } }); + const serializedPrivileges: SerializedTablePrivilege[] = Object.entries(reducedPrivileges).map(([tableId, config]) => ({ tableId, tableName: config.tableName, - actions: unifyTableActions(config.actions).map(action => TableAction[action]), + actions: config.actions.map(action => TableAction[action]), })); + return serializedPrivileges; }, }) as any, }, @@ -94,17 +102,3 @@ export class UserTablePrivileges extends Construct { this.privileges.push({ table, actions }); } } - -const unifyTableActions = (tableActions: TableAction[]): TableAction[] => { - const set = new Set(tableActions); - - if (set.has(TableAction.ALL)) { - return [TableAction.ALL]; - } - - if (set.has(TableAction.UPDATE) || set.has(TableAction.DELETE)) { - set.add(TableAction.SELECT); - } - - return [...set]; -}; diff --git a/packages/@aws-cdk/aws-redshift-alpha/lib/table.ts b/packages/@aws-cdk/aws-redshift-alpha/lib/table.ts index a4bd8814d23e3..3220b2dc2ceb5 100644 --- a/packages/@aws-cdk/aws-redshift-alpha/lib/table.ts +++ b/packages/@aws-cdk/aws-redshift-alpha/lib/table.ts @@ -272,7 +272,7 @@ export class Table extends TableBase { properties: { tableName: { prefix: props.tableName ?? cdk.Names.uniqueId(this), - generateSuffix: (props.tableName == null).toString(), + generateSuffix: !props.tableName ? 'true' : 'false', }, tableColumns: this.tableColumns, distStyle: props.distStyle, @@ -282,7 +282,7 @@ export class Table extends TableBase { }, }); - this.tableName = props.tableName ?? this.resource.ref; + this.tableName = this.resource.ref; } /** diff --git a/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/aws-cdk-redshift-cluster-database.assets.json b/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/aws-cdk-redshift-cluster-database.assets.json index cf83c628f04ac..5e81f51e31aad 100644 --- a/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/aws-cdk-redshift-cluster-database.assets.json +++ b/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/aws-cdk-redshift-cluster-database.assets.json @@ -27,7 +27,7 @@ } } }, - "e11f0479a680ff60a4cf25c470573e7db9226fbeccdd309f5b60ef7e37438f7d": { + "9aff4c194461e020c72266dfeedef35d3d7f6f8b288d80ed16073b701be94522": { "source": { "path": "aws-cdk-redshift-cluster-database.template.json", "packaging": "file" @@ -35,7 +35,7 @@ "destinations": { "current_account-current_region": { "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}", - "objectKey": "e11f0479a680ff60a4cf25c470573e7db9226fbeccdd309f5b60ef7e37438f7d.json", + "objectKey": "9aff4c194461e020c72266dfeedef35d3d7f6f8b288d80ed16073b701be94522.json", "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}" } } diff --git a/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/aws-cdk-redshift-cluster-database.template.json b/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/aws-cdk-redshift-cluster-database.template.json index 6ac7b6b834184..7cead10457627 100644 --- a/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/aws-cdk-redshift-cluster-database.template.json +++ b/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/aws-cdk-redshift-cluster-database.template.json @@ -926,7 +926,9 @@ "tablePrivileges": [ { "tableId": "Table", - "tableName": "IntegTable", + "tableName": { + "Ref": "Table7ABB320E" + }, "actions": [ "INSERT", "DELETE", diff --git a/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/manifest.json b/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/manifest.json index 2a38be6d1969c..f1c8e0ef1361d 100644 --- a/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/manifest.json +++ b/packages/@aws-cdk/aws-redshift-alpha/test/integ.database.js.snapshot/manifest.json @@ -18,7 +18,7 @@ "validateOnSynth": false, "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}", "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}", - "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/e11f0479a680ff60a4cf25c470573e7db9226fbeccdd309f5b60ef7e37438f7d.json", + "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/9aff4c194461e020c72266dfeedef35d3d7f6f8b288d80ed16073b701be94522.json", "requiresBootstrapStackVersion": 6, "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version", "additionalDependencies": [