Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Lake Formation

AWS Lake Formation (service prefix: lakeformation) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Lake Formation
Actions defined by AWS Lake Formation
Resource types defined by AWS Lake Formation
Condition keys for AWS Lake Formation

API operations defined by AWS Lake Formation

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
BatchGrantPermissions	lakeformation:BatchGrantPermissions	Permissions management, Write
BatchRevokePermissions	lakeformation:BatchRevokePermissions	Permissions management, Write
CreateDataCellsFilter	lakeformation:CreateDataCellsFilter	Write
CreateLFTagExpression	lakeformation:CreateLFTagExpression	Write
CreateLakeFormationIdentityCenterConfiguration	lakeformation:CreateLakeFormationIdentityCenterConfiguration	Write
CreateLakeFormationOptIn	lakeformation:CreateLakeFormationOptIn	Write
DeleteDataCellsFilter	lakeformation:DeleteDataCellsFilter	Write
DeleteLFTagExpression	lakeformation:DeleteLFTagExpression	Write
DeleteLakeFormationIdentityCenterConfiguration	lakeformation:DeleteLakeFormationIdentityCenterConfiguration	Write
DeleteLakeFormationOptIn	lakeformation:DeleteLakeFormationOptIn	Write
DescribeLakeFormationIdentityCenterConfiguration	lakeformation:DescribeLakeFormationIdentityCenterConfiguration	Read
GetDataCellsFilter	lakeformation:GetDataCellsFilter	Read
GetDataLakePrincipal	lakeformation:GetDataLakePrincipal	Read
GetDataLakeSettings	lakeformation:GetDataLakeSettings	Read
GetEffectivePermissionsForPath	lakeformation:GetEffectivePermissionsForPath	Read
GetLFTagExpression	lakeformation:GetLFTagExpression	Read
GetQueryState	lakeformation:GetQueryState	Read
GetQueryStatistics	lakeformation:GetQueryStatistics	Read
GetTemporaryDataLocationCredentials	lakeformation:GetDataAccess	Write
GetWorkUnitResults	lakeformation:GetWorkUnitResults	Read
GetWorkUnits	lakeformation:GetWorkUnits	Read
ListDataCellsFilter	lakeformation:ListDataCellsFilter	List
ListLFTagExpressions	lakeformation:ListLFTagExpressions	Read
ListLakeFormationOptIns	lakeformation:ListLakeFormationOptIns	List
ListPermissions	lakeformation:ListPermissions	List
PutDataLakeSettings	lakeformation:PutDataLakeSettings	Permissions management, Write
StartQueryPlanning	lakeformation:StartQueryPlanning	Write
UpdateDataCellsFilter	lakeformation:UpdateDataCellsFilter	Write
UpdateLFTagExpression	lakeformation:UpdateLFTagExpression	Write
UpdateLakeFormationIdentityCenterConfiguration	lakeformation:UpdateLakeFormationIdentityCenterConfiguration	Write

Actions defined by AWS Lake Formation

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Condition keys	Access level
AddLFTagsToResource	Grants permission to attach Lake Formation tags to catalog resources		Tagging, Write
BatchGrantPermissions	Grants permission to data lake permissions to one or more principals in a batch		Permissions management, Write
BatchRevokePermissions	Grants permission to revoke data lake permissions from one or more principals in a batch		Permissions management, Write
CancelTransaction	Grants permission to cancel the given transaction		Write
CommitTransaction	Grants permission to commit the given transaction		Write
CreateDataCellsFilter	Grants permission to create a Lake Formation data cell filter		Write
CreateLFTag	Grants permission to create a Lake Formation tag		Write
CreateLFTagExpression	Grants permission to create a Lake Formation tag expression		Write
CreateLakeFormationIdentityCenterConfiguration	Grants permission to create an IAM Identity Center connection with Lake Formation to allow IAM Identity Center users and groups to access Data Catalog resources		Write
CreateLakeFormationOptIn	Grants permission to enforce Lake Formation permissions for the given databases, tables, and principals		Write
DeleteDataCellsFilter	Grants permission to delete a Lake Formation data cell filter		Write
DeleteLFTag	Grants permission to delete a Lake Formation tag		Write
DeleteLFTagExpression	Grants permission to delete a Lake Formation expression		Write
DeleteLakeFormationIdentityCenterConfiguration	Grants permission to delete an IAM Identity Center connection with Lake Formation		Write
DeleteLakeFormationOptIn	Grants permission to remove the Lake Formation permissions enforcement of the given databases, tables, and principals		Write
DeleteObjectsOnCancel	Grants permission to delete the specified objects if the transaction is canceled		Write
DeregisterResource	Grants permission to deregister a registered location		Write
DescribeLakeFormationIdentityCenterConfiguration	Grants permission to describe the IAM Identity Center connection with Lake Formation		Read
DescribeResource	Grants permission to describe a registered location		Read
DescribeTransaction	Grants permission to get status of the given transaction		Read
ExtendTransaction	Grants permission to extend the timeout of the given transaction		Write
GetDataAccess	Grants permission to virtual data lake access	lakeformation:EnabledOnlyForMetaDataAccess	Write
GetDataCellsFilter	Grants permission to retrieve a Lake Formation data cell filter		Read
GetDataLakePrincipal	Grants permission to retrieve the identity of the invoking principal		Read
GetDataLakeSettings	Grants permission to retrieve data lake settings such as the list of data lake administrators and database and table default permissions		Read
GetEffectivePermissionsForPath	Grants permission to retrieve permissions attached to resources in the given path		Read
GetLFTag	Grants permission to retrieve a Lake Formation tag		Read
GetLFTagExpression	Grants permission to retrieve a Lake Formation tag expression		Read
GetQueryState	Grants permission to retrieve the state of the given query		Read
GetQueryStatistics	Grants permission to retrieve the statistics for the given query		Read
GetResourceLFTags	Grants permission to retrieve lakeformation tags on a catalog resource		Read
GetTableObjects	Grants permission to retrieve objects from a table		Read
GetTemporaryGluePartitionCredentials	Grants permission to get temporary credentials to access Glue partition data through Lake Formation		Read
GetTemporaryGlueTableCredentials	Grants permission to get temporary credentials to access Glue table data through Lake Formation		Read
GetWorkUnitResults	Grants permission to retrieve the results for the given work units		Read
GetWorkUnits	Grants permission to retrieve the work units for the given query		Read
GrantPermissions	Grants permission to data lake permissions to a principal		Permissions management, Write
ListDataCellsFilter	Grants permission to list cell filters		List
ListLFTagExpressions	Grants permission to list Lake Foramtion tag expressions		Read
ListLFTags	Grants permission to list Lake Formation tags		Read
ListLakeFormationOptIns	Grants permission to retrieve the current list of resources and principals that are opt in to enforce Lake Formation permissions		List
ListPermissions	Grants permission to list permissions filtered by principal or resource		List
ListResources	Grants permission to List registered locations		List
ListTableStorageOptimizers	Grants permission to list all the storage optimizers for the Governed table		List
ListTransactions	Grants permission to list all transactions in the system		List
PutDataLakeSettings	Grants permission to overwrite data lake settings such as the list of data lake administrators and database and table default permissions		Permissions management, Write
RegisterResource	Grants permission to register a new location to be managed by Lake Formation		Write
RegisterResourceWithPrivilegedAccess	Grants permission to register a new location to be managed by Lake Formation, with privileged access		Write
RemoveLFTagsFromResource	Grants permission to remove lakeformation tags from catalog resources		Tagging, Write
RevokePermissions	Grants permission to revoke data lake permissions from a principal		Permissions management, Write
SearchDatabasesByLFTags	Grants permission to list catalog databases with Lake Formation tags		Read
SearchTablesByLFTags	Grants permission to list catalog tables with Lake Formation tags		Read
StartQueryPlanning	Grants permission to initiate the planning of the given query		Write
StartTransaction	Grants permission to start a new transaction		Write
UpdateDataCellsFilter	Grants permission to update a Lake Formation data cell filter		Write
UpdateLFTag	Grants permission to update a Lake Formation tag		Write
UpdateLFTagExpression	Grants permission to update a Lake Formation expression		Write
UpdateLakeFormationIdentityCenterConfiguration	Grants permission to update the IAM Identity Center connection parameters		Write
UpdateResource	Grants permission to update a registered location		Write
UpdateTableObjects	Grants permission to add or delete the specified objects to or from a table		Write
UpdateTableStorageOptimizer	Grants permission to update the configuration of the storage optimizer for the Governed table		Write

Resource types defined by AWS Lake Formation

AWS Lake Formation does not support specifying a resource ARN in the Resource element of an IAM policy statement.

Condition keys for AWS Lake Formation

AWS Lake Formation defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
lakeformation:EnabledOnlyForMetaDataAccess	Filters access by the presence of the key configured for role's identity-based policy	Bool

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Key Management Service (kms)

AWS Lambda (lambda)