remove datalake admin role

only used by the replicate lambda
awslabs · Oct 1, 2024 · e470864 · e470864
1 parent 84865dc
commit e470864
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/sdlf-foundations/src/template.yaml b/sdlf-foundations/src/template.yaml
@@ -96,6 +96,7 @@ Resources:
   # Role defined upstream due to Lake Formation PutDataLakeSettings constraints
   rDataLakeAdminRole:
     Type: AWS::IAM::Role
+    Condition: UseLegacyTables
     Properties:
       AssumeRolePolicyDocument:
         Version: 2012-10-17
@@ -158,9 +159,11 @@ Resources:
   rDataLakeSettings:
     Type: AWS::LakeFormation::DataLakeSettings
     Properties:
-      Admins:
-        - DataLakePrincipalIdentifier: !GetAtt rDataLakeAdminRole.Arn
-        - DataLakePrincipalIdentifier: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pCicdRole}
+      Admins: !If
+        - UseLegacyTables
+        - - DataLakePrincipalIdentifier: !GetAtt rDataLakeAdminRole.Arn
+          - DataLakePrincipalIdentifier: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pCicdRole}
+        - - DataLakePrincipalIdentifier: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pCicdRole}
       CreateDatabaseDefaultPermissions: []
       CreateTableDefaultPermissions: []
       MutationType: REPLACE
@@ -1563,6 +1566,7 @@ Resources:
 
   rDataLakeAdminRoleSsm:
     Type: AWS::SSM::Parameter
+    Condition: UseLegacyTables
     Properties:
       Name: /SDLF/IAM/DataLakeAdminRoleArn
       Type: String