Prerequisites for creating views - Amazon Lake Formation
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Prerequisites for creating views

  • To create views in Data Catalog, you must register the underlying Amazon S3 data locations of the reference tables with Lake Formation. For details on registering data with Lake Formation, see Adding an Amazon S3 location to your data lake.

  • Only IAM roles can create Data Catalog views. Other IAM identities can't create Data Catalog views.

  • The IAM role that defines the view must have the following permissions:

    • Lake Formation SELECT permission with the Grantable option on all reference tables, all columns included.

    • A trust policy for the Lake Formation and Amazon Glue services to assume the role. 

      {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DataCatalogViewDefinerAssumeRole1",
            "Effect": "Allow",
            "Principal": {
               "Service": [
                    "glue.amazonaws.com",
                    "lakeformation.amazonaws.com"
                 ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

    • The iam:PassRole permission for Amazon Glue and Lake Formation.

      {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DataCatalogViewDefinerPassRole1",
            "Action": [
                "iam:PassRole"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [ 
                        "glue.amazonaws.com",
                        "lakeformation.amazonaws.com"
                      ]
                }
            }
        }
    ]
}

    • Amazon Glue and Lake Formation permissions.

      {
    "Version": "2012-10-17",
                 "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "Glue:GetDatabase",
                "Glue:GetDatabases",
                "Glue:CreateTable",
                "Glue:GetTable",
                "Glue:GetTables",
                "Glue:BatchGetPartition",
                "Glue:GetPartitions",
                "Glue:GetPartition",
                "Glue:GetTableVersion",
                "Glue:GetTableVersions",
				"Glue:PassConnection",
                "lakeFormation:GetDataAccess"
            ],
            "Resource": "*"
        }
    ]   
}

  • You can't create views in a database that has Super or ALL permission granted to the IAMAllowedPrincipals group. You can either revoke the Super permission for the IAMAllowedPrincipals group on a database, see Step 4: Switch your data stores to the Lake Formation permissions model, or create a new database with the Use only IAM access control for new tables in this database box unchecked under Default permissions for newly created tables.