Step 2: Add permissions to read Amazon CloudTrail logs to the workflow role - Amazon Lake Formation
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Step 2: Add permissions to read Amazon CloudTrail logs to the workflow role

  1. Attach the following inline policy to the role LakeFormationWorkflowRole. The policy grants permission to read your Amazon CloudTrail logs. Name the policy DatalakeGetCloudTrail.

    To create the LakeFormationWorkflowRole role, see (Optional) Create an IAM role for workflows.

    Important

    Replace <your-s3-cloudtrail-bucket> with the Amazon S3 location of your CloudTrail data.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": ["arn:aws:s3:::<your-s3-cloudtrail-bucket>/*"]
        }
    ]
}

  2. Verify that there are three policies attached to the role.