fix: add lf_data_access role to S3 bucket policy to allow Glue stats Puffin file writes

LakeFormation vends credentials via the lf_data_access role when Glue
stats writes Puffin files to S3. The role was registered as the LF
service-linked role for S3 bucket access but was not included in the
bucket policy, causing S3 Access Denied on every Puffin file write.
Fix aligns with the lakehouse module which explicitly prepends
lf_data_access_role to local_write_iamroles in its bucket policy.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: javbeltran_expedia

CHANGELOG.md

@@ -3,6 +3,10 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## [7.12.10] - 2026-04-16
+### Fixed
+- Added `lf_data_access` role ARN to S3 bucket policy `common_producer_iamroles` when `create_lf_data_access_role` is true. LakeFormation vends credentials via this role when Glue stats writes Puffin files, but without it being in the bucket policy the writes were denied with S3 Access Denied.
+
 ## [7.12.9] - 2026-04-16
 ### Fixed
 - Added `lakeformation:GetDataAccess` and `iam:PassRole` (self) inline policy to `lf_data_access` role, required for LakeFormation credential vending when Glue stats writes column statistics back to the catalog.

s3.tf

@@ -25,7 +25,7 @@ locals {
       client_roles                  = replace(lookup(schema, "client_roles", ""), ",", "\",\"")
       governance_iamroles           = join("\",\"", var.apiary_governance_iamroles)
       consumer_prefix_roles         = lookup(var.apiary_consumer_prefix_iamroles, schema["schema_name"], {})
-      common_producer_iamroles      = join("\",\"", var.apiary_common_producer_iamroles)
+      common_producer_iamroles      = join("\",\"", compact(concat(var.create_lf_data_access_role ? [aws_iam_role.lf_data_access[0].arn] : [], var.apiary_common_producer_iamroles)))
       deny_exception_iamroles       = lookup(schema, "deny_exception_iamroles", "") == "" ? "" : join("\",\"", compact(concat(split(",", schema["deny_exception_iamroles"]), var.apiary_managed_service_iamroles, var.apiary_governance_iamroles)))
     })
   }
@@ -42,7 +42,7 @@ resource "aws_s3_bucket" "apiary_data_bucket" {
   bucket        = each.value["data_bucket"]
   request_payer = "BucketOwner"
   policy        = local.bucket_policy_map[each.key]
-  tags = merge(tomap({"Name"=each.value["data_bucket"]}),
+  tags = merge(tomap({ "Name" = each.value["data_bucket"] }),
     var.apiary_tags,
   jsondecode(lookup(each.value, "tags", "{}")))
 }
@@ -109,7 +109,7 @@ resource "aws_s3_bucket_lifecycle_configuration" "apiary_data_bucket_versioning_
       days = each.value["s3_object_expiration_days_num"] != "-1" ? each.value["s3_object_expiration_days_num"] : "0"
     }
   }
-} 
+}
 
 resource "aws_s3_bucket_inventory" "apiary_bucket" {
   for_each = var.s3_enable_inventory == true ? {