resources

Creates, updates, deletes, gets or lists a resources resource.

Overview

Name	resources
Type	Resource
Id	aws.lakeformation.resources

Fields

The following fields are returned by SELECT queries:

describe_resource

Name	Datatype	Description
expected_resource_owner_account	string	The Amazon Web Services account that owns the Glue tables associated with specific Amazon S3 locations. (pattern: <code>^\d{12}$</code>)
hybrid_access_enabled	boolean	Indicates whether the data access of tables pointing to the location can be managed by both Lake Formation permissions as well as Amazon S3 bucket policies.
last_modified	string (date-time)	The date and time the resource was last modified.
resource_arn	string	The Amazon Resource Name (ARN) of the resource.
role_arn	string	The IAM role that registered a resource. (pattern: <code>arn:aws:iam::[0-9]:role/.</code>)
verification_status	string	Indicates whether the registered role has sufficient permissions to access registered Amazon S3 location. Verification Status can be one of the following: VERIFIED - Registered role has sufficient permissions to access registered Amazon S3 location. NOT_VERIFIED - Registered role does not have sufficient permissions to access registered Amazon S3 location. VERIFICATION_FAILED - Unable to verify if the registered role can access the registered Amazon S3 location. (VERIFIED, VERIFICATION_FAILED, NOT_VERIFIED)
with_federation	boolean	Whether or not the resource is a federated resource.
with_privileged_access	boolean	Grants the calling principal the permissions to perform all supported Lake Formation operations on the registered data location.

list_resources

Name	Datatype	Description
next_token	string	A continuation token, if this is not the first call to retrieve these resources.
resource_info_list	array	A summary of the data lake resources.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_resource	select	region		Retrieves the current data access role for the given resource registered in Lake Formation.
list_resources	select	region		Lists the resources registered to be managed by the Data Catalog.
register_resource	insert	region, ResourceArn		Registers the resource as managed by the Data Catalog. To add or update data, Lake Formation needs read/write access to the chosen data location. Choose a role that you know has permission to do this, or choose the AWSServiceRoleForLakeFormationDataAccess service-linked role. When you register the first Amazon S3 path, the service-linked role and a new inline policy are created on your behalf. Lake Formation adds the first path to the inline policy and attaches it to the service-linked role. When you register subsequent paths, Lake Formation adds the path to the existing policy. The following request registers a new location and gives Lake Formation permission to use the service-linked role to access that location. ResourceArn = arn:aws:s3:::my-bucket/ UseServiceLinkedRole = true If UseServiceLinkedRole is not set to true, you must provide or set the RoleArn: arn:aws:iam::12345:role/my-data-access-role
add_lf_tags_to_resource	update	region, Resource, LFTags		Attaches one or more LF-tags to an existing resource.
update_resource	update	region, RoleArn, ResourceArn		Updates the data access role used for vending access to the given (registered) resource in Lake Formation.
deregister_resource	delete	region		Deregisters the resource as managed by the Data Catalog. When you deregister a path, Lake Formation removes the path from the inline policy attached to your service-linked role.
remove_lf_tags_from_resource	exec	region, Resource, LFTags		Removes an LF-tag from the resource. Only database, table, or tableWithColumns resource are allowed. To tag columns, use the column inclusion list in tableWithColumns to specify column input.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_resource

Retrieves the current data access role for the given resource registered in Lake Formation.

SELECT
expected_resource_owner_account,
hybrid_access_enabled,
last_modified,
resource_arn,
role_arn,
verification_status,
with_federation,
with_privileged_access
FROM aws.lakeformation.resources
WHERE region = '{{ region }}' -- required
;

list_resources

Lists the resources registered to be managed by the Data Catalog.

SELECT
next_token,
resource_info_list
FROM aws.lakeformation.resources
WHERE region = '{{ region }}' -- required
;

INSERT examples

register_resource

Registers the resource as managed by the Data Catalog. To add or update data, Lake Formation needs read/write access to the chosen data location. Choose a role that you know has permission to do this, or choose the AWSServiceRoleForLakeFormationDataAccess service-linked role. When you register the first Amazon S3 path, the service-linked role and a new inline policy are created on your behalf. Lake Formation adds the first path to the inline policy and attaches it to the service-linked role. When you register subsequent paths, Lake Formation adds the path to the existing policy. The following request registers a new location and gives Lake Formation permission to use the service-linked role to access that location. ResourceArn = arn:aws:s3:::my-bucket/ UseServiceLinkedRole = true If UseServiceLinkedRole is not set to true, you must provide or set the RoleArn: arn:aws:iam::12345:role/my-data-access-role

INSERT INTO aws.lakeformation.resources (
ResourceArn,
UseServiceLinkedRole,
RoleArn,
WithFederation,
HybridAccessEnabled,
WithPrivilegedAccess,
ExpectedResourceOwnerAccount,
region
)
SELECT 
'{{ ResourceArn }}' /* required */,
{{ UseServiceLinkedRole }},
'{{ RoleArn }}',
{{ WithFederation }},
{{ HybridAccessEnabled }},
{{ WithPrivilegedAccess }},
'{{ ExpectedResourceOwnerAccount }}',
'{{ region }}'
;

Manifest

# Description fields are for documentation purposes
- name: resources
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the resources resource.
  - name: ResourceArn
    value: "{{ ResourceArn }}"
  - name: UseServiceLinkedRole
    value: {{ UseServiceLinkedRole }}
  - name: RoleArn
    value: "{{ RoleArn }}"
  - name: WithFederation
    value: {{ WithFederation }}
  - name: HybridAccessEnabled
    value: {{ HybridAccessEnabled }}
  - name: WithPrivilegedAccess
    value: {{ WithPrivilegedAccess }}
  - name: ExpectedResourceOwnerAccount
    value: "{{ ExpectedResourceOwnerAccount }}"

UPDATE examples

add_lf_tags_to_resource

Attaches one or more LF-tags to an existing resource.

UPDATE aws.lakeformation.resources
SET 
CatalogId = '{{ CatalogId }}',
Resource = '{{ Resource }}',
LFTags = '{{ LFTags }}'
WHERE 
region = '{{ region }}' --required
AND Resource = '{{ Resource }}' --required
AND LFTags = '{{ LFTags }}' --required
RETURNING
failures;

update_resource

Updates the data access role used for vending access to the given (registered) resource in Lake Formation.

UPDATE aws.lakeformation.resources
SET 
RoleArn = '{{ RoleArn }}',
ResourceArn = '{{ ResourceArn }}',
WithFederation = {{ WithFederation }},
HybridAccessEnabled = {{ HybridAccessEnabled }},
ExpectedResourceOwnerAccount = '{{ ExpectedResourceOwnerAccount }}'
WHERE 
region = '{{ region }}' --required
AND RoleArn = '{{ RoleArn }}' --required
AND ResourceArn = '{{ ResourceArn }}' --required;

DELETE examples

deregister_resource

Deregisters the resource as managed by the Data Catalog. When you deregister a path, Lake Formation removes the path from the inline policy attached to your service-linked role.

DELETE FROM aws.lakeformation.resources
WHERE region = '{{ region }}' --required
;

Lifecycle Methods

remove_lf_tags_from_resource

Removes an LF-tag from the resource. Only database, table, or tableWithColumns resource are allowed. To tag columns, use the column inclusion list in tableWithColumns to specify column input.

EXEC aws.lakeformation.resources.remove_lf_tags_from_resource 
@region='{{ region }}' --required 
@@json=
'{
"CatalogId": "{{ CatalogId }}", 
"Resource": "{{ Resource }}", 
"LFTags": "{{ LFTags }}"
}'
;