permissions

Creates, updates, deletes, gets or lists a permissions resource.

Overview

Name	permissions
Type	Resource
Id	aws.lakeformation.permissions

Fields

The following fields are returned by SELECT queries:

list_permissions

Name	Datatype	Description
next_token	string	A continuation token, if this is not the first call to retrieve this list.
principal_resource_permissions	array	A list of principals and their permissions on the resource for the specified principal and resource types.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_permissions	select	region		Returns a list of the principal permissions on the resource, filtered by the permissions of the caller. For example, if you are granted an ALTER permission, you are able to see only the principal permissions for ALTER. This operation returns only those permissions that have been explicitly granted. If both Principal and Resource parameters are provided, the response returns effective permissions rather than the explicitly granted permissions. For information about permissions, see Security and Access Control to Metadata and Data.
revoke_permissions	update	region, Principal, Resource, Permissions		Revokes permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3.
batch_grant_permissions	exec	region, Entries		Batch operation to grant permissions to the principal.
batch_revoke_permissions	exec	region, Entries		Batch operation to revoke permissions from the principal.
grant_permissions	exec	region, Principal, Resource, Permissions		Grants permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3. For information about permissions, see Security and Access Control to Metadata and Data.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

list_permissions

Returns a list of the principal permissions on the resource, filtered by the permissions of the caller. For example, if you are granted an ALTER permission, you are able to see only the principal permissions for ALTER. This operation returns only those permissions that have been explicitly granted. If both Principal and Resource parameters are provided, the response returns effective permissions rather than the explicitly granted permissions. For information about permissions, see Security and Access Control to Metadata and Data.

SELECT
next_token,
principal_resource_permissions
FROM aws.lakeformation.permissions
WHERE region = '{{ region }}' -- required
;

UPDATE examples

revoke_permissions

Revokes permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3.

UPDATE aws.lakeformation.permissions
SET 
CatalogId = '{{ CatalogId }}',
Principal = '{{ Principal }}',
Resource = '{{ Resource }}',
Permissions = '{{ Permissions }}',
Condition = '{{ Condition }}',
PermissionsWithGrantOption = '{{ PermissionsWithGrantOption }}'
WHERE 
region = '{{ region }}' --required
AND Principal = '{{ Principal }}' --required
AND Resource = '{{ Resource }}' --required
AND Permissions = '{{ Permissions }}' --required;

Lifecycle Methods

batch_grant_permissions

Batch operation to grant permissions to the principal.

EXEC aws.lakeformation.permissions.batch_grant_permissions 
@region='{{ region }}' --required 
@@json=
'{
"CatalogId": "{{ CatalogId }}", 
"Entries": "{{ Entries }}"
}'
;

batch_revoke_permissions

Batch operation to revoke permissions from the principal.

EXEC aws.lakeformation.permissions.batch_revoke_permissions 
@region='{{ region }}' --required 
@@json=
'{
"CatalogId": "{{ CatalogId }}", 
"Entries": "{{ Entries }}"
}'
;

grant_permissions

Grants permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3. For information about permissions, see Security and Access Control to Metadata and Data.

EXEC aws.lakeformation.permissions.grant_permissions 
@region='{{ region }}' --required 
@@json=
'{
"CatalogId": "{{ CatalogId }}", 
"Principal": "{{ Principal }}", 
"Resource": "{{ Resource }}", 
"Permissions": "{{ Permissions }}", 
"Condition": "{{ Condition }}", 
"PermissionsWithGrantOption": "{{ PermissionsWithGrantOption }}"
}'
;