Integrating Amazon S3 Tables with Amazon analytics services

1. Open the Amazon S3 console at https://console.amazonaws.cn/s3/.

2. In the left navigation pane, choose Table buckets.

3. Choose Create table bucket.

   The Create table bucket page opens.

4. Enter a Table bucket name and make sure that the Enable integration checkbox is selected.

5. Choose Create table bucket. Amazon S3 will attempt to automatically integrate your table buckets in that Region.

To integrate table buckets using the Amazon CLI

The following steps show how to use the Amazon CLI to integrate table buckets. To use these steps, replace the user input placeholders with your own information.

1. Create a table bucket.

   aws s3tables create-table-bucket \
   --region us-east-1 \
   --name amzn-s3-demo-table-bucket

2. Create an IAM service role that allows Lake Formation to access your table resources.

   1. Create a file called Role-Trust-Policy.json that contains the following trust policy:

      JSON

      Create the IAM service role by using the following command:

      aws iam create-role \
      --role-name S3TablesRoleForLakeFormation \
      --assume-role-policy-document file://Role-Trust-Policy.json                

   2. Create a file called LF-GluePolicy.json that contains the following policy:

      JSON

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Sid": "LakeFormationPermissionsForS3ListTableBucket",
                  "Effect": "Allow",
                  "Action": [
                      "s3tables:ListTableBuckets"
                  ],
                  "Resource": [
                      "*"
                  ]
              },
              {
                  "Sid": "LakeFormationDataAccessPermissionsForS3TableBucket",
                  "Effect": "Allow",
                  "Action": [
                      "s3tables:CreateTableBucket",
                      "s3tables:GetTableBucket",
                      "s3tables:CreateNamespace",
                      "s3tables:GetNamespace",
                      "s3tables:ListNamespaces",
                      "s3tables:DeleteNamespace",
                      "s3tables:DeleteTableBucket",
                      "s3tables:CreateTable",
                      "s3tables:DeleteTable",
                      "s3tables:GetTable",
                      "s3tables:ListTables",
                      "s3tables:RenameTable",
                      "s3tables:UpdateTableMetadataLocation",
                      "s3tables:GetTableMetadataLocation",
                      "s3tables:GetTableData",
                      "s3tables:PutTableData"
                  ],
                  "Resource": [
                      "arn:aws-cn:s3tables:us-east-1:111122223333:bucket/*"
                  ]
              }
          ]
      }
      

      Attach the policy to the role by using the following command:

      aws iam put-role-policy \
      --role-name S3TablesRoleForLakeFormation  \
      --policy-name LakeFormationDataAccessPermissionsForS3TableBucket \
      --policy-document file://LF-GluePolicy.json

3. Create a file called input.json that contains the following:

   {
       "ResourceArn": "arn:aws-cn:s3tables:us-east-1:111122223333:bucket/*",
   
       "WithFederation": true,
       "RoleArn": "arn:aws-cn:iam::111122223333:role/S3TablesRoleForLakeFormation"
   }                

   Register table buckets with Lake Formation by using the following command:

   aws lakeformation register-resource \
   --region us-east-1 \
   --with-privileged-access \
   --cli-input-json file://input.json

4. Create a file called catalog.json that contains the following catalog:

   {
      "Name": "s3tablescatalog",
      "CatalogInput": {
         "FederatedCatalog": {
             "Identifier": "arn:aws-cn:s3tables:us-east-1:111122223333:bucket/*",
             "ConnectionName": "aws:s3tables"
          },
          "CreateDatabaseDefaultPermissions":[],
          "CreateTableDefaultPermissions":[],
          "AllowFullTableExternalDataAccess": "True"
      }
   }     

   Create the s3tablescatalog catalog by using the following command. Creating this catalog populates the Amazon Glue Data Catalog with objects corresponding to table buckets, namespaces, and tables.

   aws glue create-catalog \
   --region us-east-1 \
   --cli-input-json file://catalog.json

5. Verify that the s3tablescatalog catalog was added in Amazon Glue by using the following command:

   aws glue get-catalog --catalog-id s3tablescatalog

1. Open the Amazon Lake Formation console at https://console.amazonaws.cn/lakeformation/, and sign in as a data lake administrator. For more information about how to create a data lake administrator, see Create a data lake administrator in the Amazon Lake Formation Developer Guide.

2. Delete your s3tablescatalog catalog by doing the following:

   • In the left navigation pane, choose Catalogs.

   • Select the option button next to the s3tablescatalog catalog in the Catalogs list. On the Actions menu, choose Delete.

3. Deregister the data location for the s3tablescatalog catalog by doing the following:

   • In the left navigation pane, go to the Administration section, and choose Data lake locations.

   • Select the option button next to the s3tablescatalog data lake location, for example, s3://tables:region:account-id:bucket/*.

   • On the Actions menu, choose Remove.

   • In the confirmation dialog box that appears, choose Remove.

4. Now that you've deleted your s3tablescatalog catalog and data lake location, you can follow the steps to integrate your table buckets with Amazon analytics services by using the updated integration process.