[New Resource]: aws_datazone_policy_grant

What new functionality are you requesting?

PolicyGrant (AWS::DataZone::PolicyGrant) is available in CloudFormation but has no Terraform equivalent. It is required to authorize blueprint access (e.g., CREATE_ENVIRONMENT_FROM_BLUEPRINT) within a DataZone V2 / SageMaker Unified Studio domain without resorting to console configuration.

Use case: grant project contributors permission to create environments from the Tooling blueprint — required for a fully Terraform-managed Unified Studio setup.

CloudFormation equivalent:

Type: AWS::DataZone::PolicyGrant
Properties:
  DomainIdentifier: !Ref DomainId
  EntityType: ENVIRONMENT_BLUEPRINT_CONFIGURATION
  PolicyType: CREATE_ENVIRONMENT_FROM_BLUEPRINT
  Detail:
    CreateEnvironmentFromBlueprint: {}
  Principal:
    Project:
      ProjectDesignation: CONTRIBUTOR
Current workaround: aws_cloudformation_stack inline wrapper (~0.5 days effort, functional but non-native).

Related AWS API: datazone:AddPolicyGrant / datazone:RemovePolicyGrant

CloudFormation ref: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datazone-policygrant.html AWS sample using it: https://github.com/aws-samples/sample-automate-sagemaker-unified-studio-using-iac Related provider issue: #37423

Description

PolicyGrant (AWS::DataZone::PolicyGrant) is available in CloudFormation but has no Terraform equivalent. It is required to authorize blueprint access (e.g., CREATE_ENVIRONMENT_FROM_BLUEPRINT) within a DataZone V2 / SageMaker Unified Studio domain without resorting to console configuration.

Use case: grant project contributors permission to create environments from the Tooling blueprint — required for a fully Terraform-managed Unified Studio setup.

CloudFormation equivalent:

Type: AWS::DataZone::PolicyGrant Properties: DomainIdentifier: !Ref DomainId EntityType: ENVIRONMENT_BLUEPRINT_CONFIGURATION PolicyType: CREATE_ENVIRONMENT_FROM_BLUEPRINT Detail: CreateEnvironmentFromBlueprint: {} Principal: Project: ProjectDesignation: CONTRIBUTOR Current workaround: aws_cloudformation_stack inline wrapper (~0.5 days effort, functional but non-native).

Related AWS API: datazone:AddPolicyGrant / datazone:RemovePolicyGrant

CloudFormation ref: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datazone-policygrant.html AWS sample using it: https://github.com/aws-samples/sample-automate-sagemaker-unified-studio-using-iac Related provider issue: #37423

Potential Terraform Configuration

PolicyGrant (AWS::DataZone::PolicyGrant) is available in CloudFormation but has no Terraform equivalent. It is required to authorize blueprint access (e.g., CREATE_ENVIRONMENT_FROM_BLUEPRINT) within a DataZone V2 / SageMaker Unified Studio domain without resorting to console configuration.

Use case: grant project contributors permission to create environments from the Tooling blueprint — required for a fully Terraform-managed Unified Studio setup.

CloudFormation equivalent:

Type: AWS::DataZone::PolicyGrant Properties: DomainIdentifier: !Ref DomainId EntityType: ENVIRONMENT_BLUEPRINT_CONFIGURATION PolicyType: CREATE_ENVIRONMENT_FROM_BLUEPRINT Detail: CreateEnvironmentFromBlueprint: {} Principal: Project: ProjectDesignation: CONTRIBUTOR Current workaround: aws_cloudformation_stack inline wrapper (~0.5 days effort, functional but non-native).

Related AWS API: datazone:AddPolicyGrant / datazone:RemovePolicyGrant

CloudFormation ref: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datazone-policygrant.html AWS sample using it: https://github.com/aws-samples/sample-automate-sagemaker-unified-studio-using-iac Related provider issue: #37423

References

No response

Would you like to implement the enhancement?

No