aws_glue_catalog_database: when create_table_default_permission is present, but empty, create default LF permissions, not IAM_ALLOWED_PRINCIPALS (legacy/hybrid) permissions

[psantus]

Description

As described in #27295, this resource would always create a glue database with IAM_ALLOWED_PRINCIPALS group in the permissions (i.e. IAM-only or Hybrid permissions, not Lake Formation permissions).

This PR makes it possible to create a database with Lake Formation permissions.

Relations

Closes #27295

References

https://docs.aws.amazon.com/glue/latest/webapi/API_DatabaseInput.html#Glue-Type-DatabaseInput-CreateTableDefaultPermissions

Output from Acceptance Testing

 
2025/06/30 09:44:32 Creating Terraform AWS Provider (SDKv2-style)...
2025/06/30 09:46:08 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccGlueCatalogDatabase_full
=== PAUSE TestAccGlueCatalogDatabase_full
=== RUN   TestAccGlueCatalogDatabase_createTablePermissionTransition
=== PAUSE TestAccGlueCatalogDatabase_createTablePermissionTransition
=== RUN   TestAccGlueCatalogDatabase_createTablePermission
=== PAUSE TestAccGlueCatalogDatabase_createTablePermission
=== RUN   TestAccGlueCatalogDatabase_targetDatabase
=== PAUSE TestAccGlueCatalogDatabase_targetDatabase
=== RUN   TestAccGlueCatalogDatabase_targetDatabaseWithRegion
=== PAUSE TestAccGlueCatalogDatabase_targetDatabaseWithRegion
=== RUN   TestAccGlueCatalogDatabase_federatedDatabase
=== PAUSE TestAccGlueCatalogDatabase_federatedDatabase
=== RUN   TestAccGlueCatalogDatabase_tags
=== PAUSE TestAccGlueCatalogDatabase_tags
=== RUN   TestAccGlueCatalogDatabase_disappears
=== PAUSE TestAccGlueCatalogDatabase_disappears
=== CONT  TestAccGlueCatalogDatabase_full
=== CONT  TestAccGlueCatalogDatabase_targetDatabaseWithRegion
=== CONT  TestAccGlueCatalogDatabase_tags
=== CONT  TestAccGlueCatalogDatabase_createTablePermissionTransition
=== CONT  TestAccGlueCatalogDatabase_disappears
=== CONT  TestAccGlueCatalogDatabase_targetDatabase
=== CONT  TestAccGlueCatalogDatabase_createTablePermission
=== CONT  TestAccGlueCatalogDatabase_federatedDatabase
--- PASS: TestAccGlueCatalogDatabase_disappears (27.06s)
--- PASS: TestAccGlueCatalogDatabase_createTablePermissionTransition (37.98s)
--- PASS: TestAccGlueCatalogDatabase_targetDatabaseWithRegion (42.18s)
--- PASS: TestAccGlueCatalogDatabase_createTablePermission (47.08s)
--- PASS: TestAccGlueCatalogDatabase_targetDatabase (49.45s)
--- PASS: TestAccGlueCatalogDatabase_full (61.77s)
--- PASS: TestAccGlueCatalogDatabase_tags (61.88s)
--- PASS: TestAccGlueCatalogDatabase_federatedDatabase (361.69s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/glue       365.925s

...

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.

[psantus]

Refactored to better integrate @jar-b's comments here.

Tests results

2025/06/30 10:57:10 Creating Terraform AWS Provider (SDKv2-style)...
2025/06/30 10:57:10 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccGlueCatalogDatabase_full
=== PAUSE TestAccGlueCatalogDatabase_full
=== RUN   TestAccGlueCatalogDatabase_createTablePermissionTransition
=== PAUSE TestAccGlueCatalogDatabase_createTablePermissionTransition
=== RUN   TestAccGlueCatalogDatabase_createTablePermission
=== PAUSE TestAccGlueCatalogDatabase_createTablePermission
=== RUN   TestAccGlueCatalogDatabase_targetDatabase
=== PAUSE TestAccGlueCatalogDatabase_targetDatabase
=== RUN   TestAccGlueCatalogDatabase_targetDatabaseWithRegion
=== PAUSE TestAccGlueCatalogDatabase_targetDatabaseWithRegion
=== RUN   TestAccGlueCatalogDatabase_federatedDatabase
=== PAUSE TestAccGlueCatalogDatabase_federatedDatabase
=== RUN   TestAccGlueCatalogDatabase_tags
=== PAUSE TestAccGlueCatalogDatabase_tags
=== RUN   TestAccGlueCatalogDatabase_disappears
=== PAUSE TestAccGlueCatalogDatabase_disappears
=== CONT  TestAccGlueCatalogDatabase_full
=== CONT  TestAccGlueCatalogDatabase_targetDatabaseWithRegion
=== CONT  TestAccGlueCatalogDatabase_tags
=== CONT  TestAccGlueCatalogDatabase_federatedDatabase
=== CONT  TestAccGlueCatalogDatabase_createTablePermission
=== CONT  TestAccGlueCatalogDatabase_targetDatabase
=== CONT  TestAccGlueCatalogDatabase_disappears
=== CONT  TestAccGlueCatalogDatabase_createTablePermissionTransition
--- PASS: TestAccGlueCatalogDatabase_disappears (25.14s)
--- PASS: TestAccGlueCatalogDatabase_targetDatabaseWithRegion (41.13s)
--- PASS: TestAccGlueCatalogDatabase_createTablePermission (44.27s)
--- PASS: TestAccGlueCatalogDatabase_targetDatabase (46.72s)
--- PASS: TestAccGlueCatalogDatabase_createTablePermissionTransition (51.77s)
--- PASS: TestAccGlueCatalogDatabase_full (58.65s)
--- PASS: TestAccGlueCatalogDatabase_tags (58.89s)
--- PASS: TestAccGlueCatalogDatabase_federatedDatabase (330.99s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/glue       335.144s