Register Resource and Grant Permissions
A 4-step recipe with Amazon Lake Formation. We can help you get access.
Recipe · 4 steps
Register Resource and Grant Permissions
Register an S3 data lake location and grant a principal permissions on a resource.
- Register the Amazon S3 path as a data lake location managed by Lake Formation using the supplied data access role.
- Confirm the registration by retrieving the current data access role for the registered resource.
- Grant the principal the requested permissions on the target Data Catalog resource.
- List the principal permissions on the resource to verify the grant was applied.
What you'll need to have ready
- resourceArn: The Amazon S3 path ARN to register as a data lake location (e.g. arn:aws:s3:::my-bucket/prefix).
- roleArn: The IAM role ARN Lake Formation assumes to access the registered location.
- useServiceLinkedRole: Whether to register the location using the Lake Formation service-linked role.
- principal: The DataLakePrincipal (e.g. {"DataLakePrincipalIdentifier":"arn:aws:iam::123456789012:role/analyst"}).
- resource: The Data Catalog Resource the permissions apply to (Database, Table, etc.).
- permissions: The list of permissions to grant (e.g. ["SELECT","DESCRIBE"]).
- permissionsWithGrantOption: The subset of permissions the principal may further grant to others.
For your developer
Arazzo workflow amazon-lake-formation:register-and-grant, 4 operations: RegisterResource → DescribeResource → GrantPermissions → ListPermissions. Specs on APIs.io.