Granting permissions on views using the named resource method - Amazon Lake Formation
Open the Grant data lake permissions pageSpecify the principalsSpecify the viewsSpecify the permissions
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Granting permissions on views using the named resource method

The following steps explain how to grant permissions on views by using the named resource method and the Grant data lake permissions page. The page is divided into the following sections:

  • Principals – The IAM users, roles, IAM Identity Center users and groups, Amazon Web Services accounts, organizations, or organizational units to grant permissions.

  • LF-Tags or catalog resources – The databases, tables, views, or resource links to grant permissions on.

  • Permissions – The data lake permissions to grant.

Open the Grant data lake permissions page

  1. Open the Amazon Lake Formation console at https://console.aws.amazon.com/lakeformation/, and sign in as a data lake administrator, the database creator, or an IAM user who has Grantable permissions on the database.

  2. Do one of the following:

    • In the navigation pane, under Permissions, choose Data lake permissions. Then choose Grant.

    • In the navigation pane, choose Views under Data Catalog. Then, on the Views page, choose a view, and from the Actions menu, under Permissions, choose Grant.

    Note

    You can grant permissions on a view through its resource link. To do so, on the Views page, choose a resource link, and on the Actions menu, choose Grant on target. For more information, see How resource links work in Lake Formation.

Specify the principals

In the Principals section, choose a principal type and then specify principals to grant permissions.

IAM users and roles

Choose one or more users or roles from the IAM users and roles list.

IAM Identity Center

Choose one or more users or groups from the Users and groups list.

SAML users and groups

For SAML and Amazon QuickSight users and groups, enter one or more Amazon Resource Names (ARNs) for users or groups federated through SAML, or ARNs for Amazon QuickSight users or groups. Press Enter after each ARN.

For information about how to construct the ARNs, see Lake Formation grant and revoke Amazon CLI commands.

Note

Lake Formation integration with Amazon QuickSight is supported only for Amazon QuickSight Enterprise Edition.

External accounts

For Amazon Web Services account, Amazon organization, or IAM Principal enter one or more valid Amazon account IDs, organization IDs, organizational unit IDs, or ARN for the IAM user or role. Press Enter after each ID.

An organization ID consists of "o-" followed by 10–32 lower-case letters or digits.

An organizational unit ID starts with "ou-" followed by 4–32 lowercase letters or digits (the ID of the root that contains the OU). This string is followed by a second "-" dash and 8 to 32 additional lowercase letters or digits.

See Also

Specify the views

In the LF-Tags or catalog resources section, choose one or more views to grant permissions on.

  1. Choose Named data catalog resources.

  2. Choose one or more views from the Views list. You can also choose one or more Databases, Tables, and/or Data filters.

    Grantng data lake permissions to All views within a database will result in the grantee having permissions on all tables and views within the database.

Specify the permissions

In the Permissions section, select permissions and grantable permissions.

The Permissions section has a group of check boxes for view permissions to grant. Check boxes include Select, Describe, Drop, and Super. Below that group is another group of the same check boxes for grantable permissions.

  1. Under View permissions, select one or more permissions to grant.

  2. (Optional) Under Grantable permissions, select the permissions that the grant recipient can grant to other principals in their Amazon Web Services account. This option is not supported when you are granting permissions to an IAM principal from an external account.

  3. Choose Grant.

See Also