The table construct's [default read permissions](https://github.com/aws/aws-cdk/blob/fb0977ab6f58edc4713267db3a3a9305baf5f8ec/packages/%40aws-cdk/aws-glue/lib/table.ts#L403) (used in `grantRead*`) include "glue:BatchDeletePartition" which sounds off. Must investigate. --- This is :bug: Bug Report