data_lake_settings

Creates, updates, deletes, gets or lists a data_lake_settings resource.

Overview

Name	data_lake_settings
Type	Resource
Id	aws.lakeformation.data_lake_settings

Fields

The following fields are returned by SELECT queries:

get_data_lake_settings

Name	Datatype	Description
allow_external_data_filtering	boolean	Whether to allow Amazon EMR clusters to access data managed by Lake Formation. If true, you allow Amazon EMR clusters to access data in Amazon S3 locations that are registered with Lake Formation. If false or null, no Amazon EMR clusters will be able to access data in Amazon S3 locations that are registered with Lake Formation. For more information, see (Optional) Allow external data filtering.
allow_full_table_external_data_access	boolean	Whether to allow a third-party query engine to get data access credentials without session tags when a caller has full data access permissions.
authorized_session_tag_value_list	array	Lake Formation relies on a privileged process secured by Amazon EMR or the third party integrator to tag the user's role while assuming it. Lake Formation will publish the acceptable key-value pair, for example key = "LakeFormationTrustedCaller" and value = "TRUE" and the third party integrator must properly tag the temporary security credentials that will be used to call Lake Formation's administrative APIs.
create_database_default_permissions	array	Specifies whether access control on newly created database is managed by Lake Formation permissions or exclusively by IAM permissions. A null value indicates access control by Lake Formation permissions. A value that assigns ALL to IAM_ALLOWED_PRINCIPALS indicates access control by IAM permissions. This is referred to as the setting "Use only IAM access control," and is for backward compatibility with the Glue permission model implemented by IAM permissions. The only permitted values are an empty array or an array that contains a single JSON object that grants ALL to IAM_ALLOWED_PRINCIPALS. For more information, see Changing the Default Security Settings for Your Data Lake.
create_table_default_permissions	array	Specifies whether access control on newly created table is managed by Lake Formation permissions or exclusively by IAM permissions. A null value indicates access control by Lake Formation permissions. A value that assigns ALL to IAM_ALLOWED_PRINCIPALS indicates access control by IAM permissions. This is referred to as the setting "Use only IAM access control," and is for backward compatibility with the Glue permission model implemented by IAM permissions. The only permitted values are an empty array or an array that contains a single JSON object that grants ALL to IAM_ALLOWED_PRINCIPALS. For more information, see Changing the Default Security Settings for Your Data Lake.
data_lake_admins	array	A list of Lake Formation principals. Supported principals are IAM users or IAM roles.
external_data_filtering_allow_list	array	A list of the account IDs of Amazon Web Services accounts with Amazon EMR clusters that are to perform data filtering.>
parameters	object	A key-value map that provides an additional configuration on your data lake. The following key-value pairs are supported: CROSS_ACCOUNT_VERSION - Accepted values are 1, 2, 3, 4, and 5. SET_SOURCE_IDENTITY - Accepted values are TRUE and FALSE. When set to TRUE, Lake Formation includes the IAM role identifier that was used to query in the S3 data event CloudTrail logs for s3:GetObject calls. For more information, see Tracking query engine IAM roles in S3 data events.
read_only_admins	array	A list of Lake Formation principals with only view access to the resources, without the ability to make changes. Supported principals are IAM users or IAM roles.
trusted_resource_owners	array	A list of the resource-owning account IDs that the caller's account can use to share their user access details (user ARNs). The user ARNs can be logged in the resource owner's CloudTrail log. You may want to specify this property when you are in a high-trust boundary, such as the same team or company.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_data_lake_settings	select	region		Retrieves the list of the data lake administrators of a Lake Formation-managed data lake.
put_data_lake_settings	replace	region, DataLakeSettings		Sets the list of data lake administrators who have admin privileges on all resources managed by Lake Formation. For more information on admin privileges, see Granting Lake Formation Permissions. This API replaces the current list of data lake admins with the new list being passed. To add an admin, fetch the current list and add the new admin to that list and pass that list in this API.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_data_lake_settings

Retrieves the list of the data lake administrators of a Lake Formation-managed data lake.

SELECT
allow_external_data_filtering,
allow_full_table_external_data_access,
authorized_session_tag_value_list,
create_database_default_permissions,
create_table_default_permissions,
data_lake_admins,
external_data_filtering_allow_list,
parameters,
read_only_admins,
trusted_resource_owners
FROM aws.lakeformation.data_lake_settings
WHERE region = '{{ region }}' -- required
;

REPLACE examples

put_data_lake_settings

Sets the list of data lake administrators who have admin privileges on all resources managed by Lake Formation. For more information on admin privileges, see Granting Lake Formation Permissions. This API replaces the current list of data lake admins with the new list being passed. To add an admin, fetch the current list and add the new admin to that list and pass that list in this API.

REPLACE aws.lakeformation.data_lake_settings
SET 
CatalogId = '{{ CatalogId }}',
DataLakeSettings = '{{ DataLakeSettings }}'
WHERE 
region = '{{ region }}' --required
AND DataLakeSettings = '{{ DataLakeSettings }}' --required;