diqiu50 opened a new issue, #12990:
URL: https://github.com/apache/gravitino/issues/12990
### Version
main branch
### Describe what's wrong
`GlueExceptionConverter` discards the underlying AWS exception detail in its
fallback branch and returns a message naming only the operation and the object.
The real cause is visible only in the stack trace.
Four different failures, all reported the same way:
GET .../schemas/db6a/tables/ctas_test -> Glue error: table ctas_test
GET .../schemas/db6a/tables -> Glue error: listing tables
in schema db6a
POST .../schemas -> Glue error: schema drop_me
DELETE .../schemas/drop_me -> Glue error: checking
tables in schema drop_me
Every one was an `AccessDeniedException` naming the exact IAM action that
was missing. An operator sees `Glue error: schema drop_me` and has no way to
know a permission is missing, which permission, or on which resource.
### Error message and/or stacktrace
Caused by: AccessDeniedException: User: arn:aws:iam::...:user/... is not
authorized
to perform: glue:CreateDatabase on resource:
arn:aws:glue:...:database/drop_me3
because no identity-based policy allows the glue:CreateDatabase action
### How to reproduce
+ Gravitino main branch, `glue` catalog provider, AWS Glue in us-east-2.
+ Configure the catalog with credentials lacking `glue:CreateDatabase`.
+ Create a schema through the REST API; the response carries only `Glue
error: schema <name>`.
### Additional context
`GlueExceptionConverter.toSchemaException` and `toTableException` build a
`RuntimeException` from a fixed string plus the object name and do not carry
the AWS message forward. Reached from `GlueCatalogOperations.createSchema`,
`dropSchema`, `listTables` and the table load path.
AWS names the missing action and the resource, which is the difference
between a five-second fix and an investigation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
