Methods for fine-grained access control

Open means that the special permission Super is granted to the group IAMAllowedPrincipals, where IAMAllowedPrincipals is automatically created and includes any IAM users and roles that are allowed access to your Data Catalog resources by your IAM policies, and the Super permission enables a principal to perform every supported Lake Formation operation on the database or table on which it is granted. This effectively causes access to Data Catalog resources and Amazon S3 locations to be controlled solely by IAM policies. For more information, see Changing the default settings for your data lake and Upgrading Amazon Glue data permissions to the Amazon Lake Formation model.

Fine-grained means that IAM policies control all access to Data Catalog resources and to individual Amazon S3 buckets.

Fine-grained access means granting limited Lake Formation permissions to individual principals on Data Catalog resources, Amazon S3 locations, and the underlying data in those locations.

Coarse-grained means broader permissions on individual operations and on access to Amazon S3 locations. For example, a coarse-grained IAM policy might include "glue:*" or "glue:Create*" rather than "glue:CreateTables", leaving Lake Formation permissions to control whether or not a principal can create catalog objects. It also means giving principals access to the APIs that they need to do their work, but locking down other APIs and resources. For example, you might create an IAM policy that enables a principal to create Data Catalog resources and create and run workflows, but doesn't enable creation of Amazon Glue connections or user-defined functions. See the examples later in this section.