Set Athena Workgroup Encryption also tries to change readonly field about cloud-custodian

[kapilt]

I think the issue is on the custodian side, in that we need to ensure read only properties are not in the patch document, I've put up a pull request (#9297) that should address

also noting the awscc provider is relatively new, most custodian usage is using the aws.

[kapilt]

you would also typically want to do a single update invocation across all properties to change.

[snowiow]

you would also typically want to do a single update invocation across all properties to change.

ah yes, I was doing that in my first attempt. That snippet was a later one, where I tried things out, because I was not 100% sure what to change from the workaround the aws support send me for the case I described in the end 😄

And thanks a lot for handling this so quickly, really appreciate it 🙏

[kapilt]

yeah.. we only do full replacement atm the listed attributes instead of doing partial update which is really what your looking for here, investigating what partial would take.

[kapilt]

I've been thinking about how best to do partial update, and it does feel like the simplest thing here is to in addition of support key/value replacement, also support a user specified patch notion.

     - type: update
       patch: 
         - op: add
           path: WorkGroupConfiguration/EnforceWorkGroupConfiguration
           value: true
         - op: add
           path: WorkGroupConfiguration/ResultConfiguration/EncryptionConfiguration/EncryptionOption
           value: SSE_S3

[snowiow]

Hi, yes that sounds great. With that you would also have the possibility to do the original cloudcontrol operation directly from cloudcustodian 👍

[kapilt]

patch functionality added fwiw

[snowiow]

Thank you 🙏 Can you already tell, when the next release will happen?