Granting resource link permissions - Amazon Lake Formation
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Granting resource link permissions

Follow these steps to grant Amazon Lake Formation permissions on one or more resource links to a principal in your Amazon account.

After you create a resource link, only you can view and access it. (This assumes that Use only IAM access control for new tables in this database is not enabled for the database.) To permit other principals in your account to access the resource link, grant at least the DESCRIBE permission.

Important

Granting permissions on a resource link doesn't grant permissions on the target (linked) database or table. You must grant permissions on the target separately.

You can grant permissions by using the Lake Formation console, the API, or the Amazon Command Line Interface (Amazon CLI).

console
To grant resource link permissions using the Lake Formation console

  1. Do one of the following:

  2. Under Permissions, select the permissions to grant. Optionally, select grantable permissions.

    The Permissions section contains two tiles. Each tile contains a option button and text. The Resource link permissions tile is selected. The other tile is disabled, because it relates to table permissions. Below the tiles is a group of check boxes for resource link permissions to grant. Check boxes include Drop, Describe, and Super. Below that group is another group of the same check boxes for grantable permissions.

  3. Choose Grant.

Amazon CLI
To grant resource link permissions using Amazon CLI

  • Run the grant-permissions command, specifying a resource link as the resource.

    This example grants DESCRIBE to user datalake_user1 on the table resource link incidents-link in the database issues in Amazon account 1111-2222-3333.

    aws lakeformation grant-permissions --principal DataLakePrincipalIdentifier=arn:aws:iam::111122223333:user/datalake_user1 --permissions "DESCRIBE" --resource '{ "Table": {"DatabaseName":"issues", "Name":"incidents-link"}}'
See Also: