trigger_resource_access_update

EtlJobsApi.trigger_resource_access_update(id, role_id, update_job_resource_access_request_body, content_type=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)

Trigger resource access update for a job

Replaces extra dataset, domain, parameter, and shared-library grants on the job role and starts the resource-access step function. Success Message is “Updating resource access” (HTTP 200); IAM and Lake Formation apply asynchronously. GET /jobs/{id}/resourceaccess to poll Status. Caller must send a valid role_id and have at least editor access (AUTH-1012 if below editor, AUTH-1010 if no permission). Unknown JobId returns IPV-1002. RoleUsed must start with {projectShortName}-custom- (IPV-1002 otherwise). A concurrent update (ResourceAccessStatus=in_progress) returns GE-1033. Body must include DatasetAccess, ParameterAccess, DomainAccess, and SharedLibraries (IPV-1008). DatasetAccess must have Owner, ReadOnly, and ReadOnlyFileLevel (the handler fills omitted lists as empty). Each list replaces the current extra grant of that type. Store datasets are rejected (JOB-1043). Tag-based datasets cannot be ReadOnly (JOB-1031). System datasets cannot be Owner (IPV-1041). ReadOnlyFileLevel requires S3 non-external non-view datasets (DS-1040) and FileLevelTags the user can access (AUTH-1031). Owner access on LF-targeted external datasets returns IPV-1042. Allocation over policy budget returns JOB-1020 / JOB-1021.

Parameters:

  • id (str) – Job UUID (Jobs table Id). Unknown id returns IPV-1002. (required)

  • role_id (str) – Amorphic role ID the request is authorized against. Must be a role the user belongs to. Returns AUTH-1001 if missing. Used when validating system-dataset view permission. (required)

  • update_job_resource_access_request_body (UpdateJobResourceAccessRequestBody) – (required)

  • content_type (str)

  • _request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.

  • _request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.

  • _content_type (str, Optional) – force content-type for the request.

  • _headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.

  • _host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

UpdateJobResourceAccessResponse

Returns:

Returns the result object.

Request and Response Examples

HTTP: POST /jobs/{id}/resourceaccess

Parameter examples

Name

In

Example

id

path

"e4f5a6b7-c8d9-0123-4567-89abcdef0123"

Request

Replace extra datasets, domain, parameter, and libraries

{
  "DatasetAccess": {
    "Owner": [
      {
        "DatasetId": "b1e6c2a0-9f4d-4c7a-8f2e-1a2b3c4d5e6f",
        "DatasetName": "monthly_orders",
        "Domain": "sales"
      }
    ],
    "ReadOnly": [],
    "ReadOnlyFileLevel": [
      {
        "DatasetId": "c3d8e4f2-9a6b-5c7d-0e1f-3a4b5c6d7e8f",
        "FileLevelTags": [
          {
            "TagKey": "pii",
            "TagValue": "masked"
          }
        ]
      }
    ]
  },
  "DomainAccess": {
    "Owner": [
      {
        "DomainName": "sales"
      }
    ],
    "ReadOnly": []
  },
  "ParameterAccess": [
    "/amorphic/sales/db_password"
  ],
  "SharedLibraries": [
    "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
  ]
}

Clear extra resource access (empty lists)

{
  "DatasetAccess": {
    "Owner": [],
    "ReadOnly": [],
    "ReadOnlyFileLevel": []
  },
  "DomainAccess": {
    "Owner": [],
    "ReadOnly": []
  },
  "ParameterAccess": [],
  "SharedLibraries": []
}

Success (HTTP 200)

Step function started. Message is “Updating resource access”. Poll GET /jobs/{id}/resourceaccess for Status.

Async update accepted

{
  "Message": "Updating resource access"
}

Errors

Documented error codes: AUTH-1001, AUTH-1010, AUTH-1012, IPV-1002, IPV-1008, IPV-1041, IPV-1042, GE-1033, JOB-1031, JOB-1043, JOB-1020, JOB-1021, AUTH-1031, AUTH-1003, DS-1040, GE-1008, EMF-1001.

HTTP 400

Validation or authorization failure. Body is {“Message”: “<CODE> - <text>”}. Common codes: AUTH-1001, AUTH-1010, AUTH-1012, IPV-1002, IPV-1008, IPV-1041, IPV-1042, GE-1033, JOB-1031, JOB-1043, JOB-1020, JOB-1021, AUTH-1031, AUTH-1003, DS-1040.

Missing role_id header

{
  "Message": "AUTH-1001 - Missing role information in event header"
}

Unknown job id

{
  "Message": "IPV-1002 - Invalid JobId - e4f5a6b7-c8d9-0123-4567-89abcdef0123, resource not found."
}

Required body keys missing

{
  "Message": "IPV-1008 - Invalid request body, missing key(s) - ParameterAccess,DomainAccess,SharedLibraries"
}

RoleUsed is not {project}-custom-*

{
  "Message": "IPV-1002 - For Jobs created from console, only those that use roles that follow Amorphic naming convention(amorphic-custom-*) are allowed to Update Extra Resources from Amorphic"
}

Concurrent resource-access update

{
  "Message": "GE-1033 - Cannot complete requested operation, resource access update is already in progress state"
}

store datasource type is not allowed

{
  "Message": "JOB-1043 - ETL job doesn't support datasets with datasource type 'store'. Invalid datasets found - ['landing(sales)']"
}

TBAC dataset in ReadOnly

{
  "Message": "JOB-1031 - Failed to update job - cannot provide read access to tag based access controlled datasets"
}

System dataset in Owner

{
  "Message": "IPV-1041 - System  Datasets cannot be used in write access (DatasetId) - ['b1e6c2a0-9f4d-4c7a-8f2e-1a2b3c4d5e6f']"
}

ReadOnlyFileLevel without FileLevelTags

{
  "Message": "AUTH-1031 - Missing FileLevelTags for the following datasets under ReadOnlyFileLevel access: c3d8e4f2-9a6b-5c7d-0e1f-3a4b5c6d7e8f."
}

Access level below editor

{
  "Message": "AUTH-1012 - User: user1 requires at least editor access on the resource to perform this action."
}

HTTP 500

Unhandled backend failure. Body is {“Message”: “<CODE> - <text>”} (GE-1008 via EMF-1001). Invalid JSON in the body also lands here (json.loads is uncaught).

Unexpected failure

{
  "Message": "GE-1008 - Could not complete the request. Please try again."
}