Permissions

Source: src/AWS/LakeFormation/Permissions.ts

A Lake Formation permission grant — gives a principal permissions on a Data Catalog resource (database, table, data location, LF-tag, or LF-tag policy expression). The resource owns the full permission set for its principal/resource pair: permissions removed from the props are revoked.

The caller must be a Lake Formation data lake administrator (or hold the grant option on the resource) — see AWS.LakeFormation.DataLakeSettings.

Granting Permissions

Grant Database Permissions to a Role

import * as AWS from "alchemy/AWS";

const database = yield* AWS.Glue.Database("Analytics", {});
const grant = yield* AWS.LakeFormation.Permissions("AnalystDbAccess", {
  principal: analystRole.roleArn,
  resource: { database: { name: database.databaseName } },
  permissions: ["DESCRIBE", "CREATE_TABLE"],
});

Grant Table Select with Grant Option

const grant = yield* AWS.LakeFormation.Permissions("AnalystTableAccess", {
  principal: analystRole.roleArn,
  resource: {
    table: { databaseName: database.databaseName, tableWildcard: true },
  },
  permissions: ["SELECT", "DESCRIBE"],
  permissionsWithGrantOption: ["SELECT"],
});

Grant Data Location Access

const grant = yield* AWS.LakeFormation.Permissions("EtlLocationAccess", {
  principal: etlRole.roleArn,
  resource: { dataLocation: { resourceArn: location.resourceArn } },
  permissions: ["DATA_LOCATION_ACCESS"],
});