Add enable_lf_grants for opt-in LF TableWildcard grants

[drernie]

Summary

• Adds enable_lf_grants variable (bool, default false) to the modules/quilt module
• Maps to EnableLakeFormationGrants CFT parameter (Enabled/Disabled)
• Documents the variable in VARIABLES.md

Context

Per-role Lake Formation TableWildcard grants require the CloudFormation execution
role to be a Lake Formation administrator. Without this gate, deploys fail with
AccessDeniedException on any account where the deploying role isn't on the LF
admin list — which includes all new installs and accounts without LF enforcement.

This makes the grants opt-in so operators must explicitly enable them after
completing the LF admin bootstrap (adding the deploying role to the LF admin list).

Companion changes needed

• deployment repo: Add EnableLakeFormationGrants CFT parameter and
  LakeFormationGrantsEnabled condition to gate _DYNAMIC_DB_ROLE_GRANTS
  in lakeformation.py

Test plan

• terraform fmt -check passes
• terraform validate passes
• Existing deployments unaffected (default false → parameter omitted or Disabled)
• Verify CFT accepts EnableLakeFormationGrants parameter after deployment-side changes

🤖 Generated with Claude Code

Greptile Summary

This PR adds an enable_lf_grants boolean variable (default false) to the modules/quilt module, wiring it to the EnableLakeFormationGrants CloudFormation parameter so that per-role Lake Formation TableWildcard grants are opt-in rather than always-on.

• EnableLakeFormationGrants is unconditionally sent as \"Disabled\" when the feature is off, instead of null. Passing an unrecognized parameter to CloudFormation raises an error, so any terraform apply on a deployment whose CFT template hasn't yet received the companion parameter change will fail immediately.

Confidence Score: 4/5

Not safe to merge as-is — will break existing deployments if applied before the companion CFT change.

One P1 finding: the parameter is always sent as "Disabled" rather than null, creating a hard dependency on the companion CFT template change being deployed first. A one-line fix (null instead of "Disabled") aligns with the existing null pattern in the file and makes the rollout order-independent.

modules/quilt/main.tf — line 104 where EnableLakeFormationGrants is unconditionally set.

Important Files Changed

Filename	Overview
modules/quilt/main.tf	Adds EnableLakeFormationGrants to the CFT parameters block, but always passes "Disabled" (not null) when disabled — will break existing deployments whose templates don't yet have this parameter.
modules/quilt/variables.tf	Adds well-formed enable_lf_grants bool variable with nullable=false, default=false, and a clear description.
VARIABLES.md	Adds a new "Lake Formation Variables" section documenting enable_lf_grants with type, default, and usage notes.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[terraform apply] --> B{enable_lf_grants?}
    B -- true --> C["EnableLakeFormationGrants = 'Enabled'"]
    B -- false --> D["EnableLakeFormationGrants = 'Disabled'\n⚠️ always sent"]
    C --> E[merge with var.parameters]
    D --> E
    E --> F[aws_cloudformation_stack]
    F --> G{CFT template has\nEnableLakeFormationGrants\nparameter?}
    G -- yes --> H[Stack update succeeds]
    G -- no --> I[❌ CloudFormation rejects\nunknown parameter]

Loading

_{Reviews (1): Last reviewed commit: "Add enable_lf_grants variable for opt-in..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[greptile-apps]

Unconditional parameter breaks existing deployments

EnableLakeFormationGrants is always passed — as "Disabled" when the feature is off — even before the companion CFT template change adds this parameter. Any terraform apply on an existing deployment that doesn't yet have EnableLakeFormationGrants in its template will fail with CloudFormation rejecting the unknown parameter. Passing null omits the key from the parameters map (matching the existing pattern for PublicSubnets and UserSubnets), so CFT uses its own default and older templates stay unaffected.

Suggested change

	EnableLakeFormationGrants = var.enable_lf_grants ? "Enabled" : "Disabled"
	EnableLakeFormationGrants = var.enable_lf_grants ? "Enabled" : null