Querying a data lake

Open the IAM console at https://console.amazonaws.cn/iam/.

In the navigation pane, choose Policies.

If this is your first time choosing Policies, the Welcome to Managed Policies page appears. Choose Get Started.

Choose Create policy.

Choose to create the policy on the JSON tab.

Paste in the following JSON policy document, which grants access to the Data Catalog but denies the administrator permissions for Lake Formation.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "RedshiftPolicyForLF",
            "Effect": "Allow",
            "Action": [
                "glue:*",
                "lakeformation:GetDataAccess"
            ],
            "Resource": "*"
        }
    ]
}

When you are finished, choose Review to review the policy. The policy validator reports any syntax errors.

On the Review policy page, for Name enter a name for the policy that you are creating, for example, mydatalake_policy. Enter a Description (optional). Review the policy Summary to see the permissions that are granted by your policy. Then choose Create policy to save your work.

After you create a policy, you can create a role and apply the policy.

In the navigation pane of the IAM console, choose Roles, and then choose Create role.

For Select type of trusted entity, choose Amazon service.

Choose the Amazon Redshift service to assume this role.

Choose the Redshift Customizable use case for your service. Then choose Next: Permissions.

Choose the permissions policy that you created, mydatalake_policy, to attach to the role.

Choose Next: Tagging.

Choose Next: Review.

For Role name, enter a name for the role, for example, mydatalake_role.

(Optional) For Role description, enter a description for the new role.

Review the role, and then choose Create role.

Open the Lake Formation console at https://console.amazonaws.cn/lakeformation/.

In the navigation pane, choose Permissions, and then choose Grant.

Provide the following information:

Choose Save.