You are viewing documentation for version 2 of the AWS SDK for Ruby. Version 3 documentation can be found here.

Class: Aws::LakeFormation::Client

Inherits:
Seahorse::Client::Base show all
Defined in:
(unknown)

Overview

An API client for AWS Lake Formation. To construct a client, you need to configure a :region and :credentials.

lakeformation = Aws::LakeFormation::Client.new(
  region: region_name,
  credentials: credentials,
  # ...
)

See #initialize for a full list of supported configuration options.

Region

You can configure a default region in the following locations:

  • ENV['AWS_REGION']
  • Aws.config[:region]

Go here for a list of supported regions.

Credentials

Default credentials are loaded automatically from the following locations:

  • ENV['AWS_ACCESS_KEY_ID'] and ENV['AWS_SECRET_ACCESS_KEY']
  • Aws.config[:credentials]
  • The shared credentials ini file at ~/.aws/credentials (more information)
  • From an instance profile when running on EC2

You can also construct a credentials object from one of the following classes:

Alternatively, you configure credentials with :access_key_id and :secret_access_key:

# load credentials from disk
creds = YAML.load(File.read('/path/to/secrets'))

Aws::LakeFormation::Client.new(
  access_key_id: creds['access_key_id'],
  secret_access_key: creds['secret_access_key']
)

Always load your credentials from outside your application. Avoid configuring credentials statically and never commit them to source control.

Instance Attribute Summary

Attributes inherited from Seahorse::Client::Base

#config, #handlers

Constructor collapse

API Operations collapse

Instance Method Summary collapse

Methods inherited from Seahorse::Client::Base

add_plugin, api, #build_request, clear_plugins, define, new, #operation, #operation_names, plugins, remove_plugin, set_api, set_plugins

Methods included from Seahorse::Client::HandlerBuilder

#handle, #handle_request, #handle_response

Constructor Details

#initialize(options = {}) ⇒ Aws::LakeFormation::Client

Constructs an API client.

Options Hash (options):

  • :access_key_id (String) —

    Used to set credentials statically. See Plugins::RequestSigner for more details.

  • :active_endpoint_cache (Boolean) —

    When set to true, a thread polling for endpoints will be running in the background every 60 secs (default). Defaults to false. See Plugins::EndpointDiscovery for more details.

  • :convert_params (Boolean) — default: true —

    When true, an attempt is made to coerce request parameters into the required types. See Plugins::ParamConverter for more details.

  • :credentials (required, Credentials) —

    Your AWS credentials. The following locations will be searched in order for credentials:

    • :access_key_id, :secret_access_key, and :session_token options
    • ENV['AWS_ACCESS_KEY_ID'], ENV['AWS_SECRET_ACCESS_KEY']
    • HOME/.aws/credentials shared credentials file
    • EC2 instance profile credentials See Plugins::RequestSigner for more details.
  • :disable_host_prefix_injection (Boolean) —

    Set to true to disable SDK automatically adding host prefix to default service endpoint when available. See Plugins::EndpointPattern for more details.

  • :endpoint (String) —

    A default endpoint is constructed from the :region. See Plugins::RegionalEndpoint for more details.

  • :endpoint_cache_max_entries (Integer) —

    Used for the maximum size limit of the LRU cache storing endpoints data for endpoint discovery enabled operations. Defaults to 1000. See Plugins::EndpointDiscovery for more details.

  • :endpoint_cache_max_threads (Integer) —

    Used for the maximum threads in use for polling endpoints to be cached, defaults to 10. See Plugins::EndpointDiscovery for more details.

  • :endpoint_cache_poll_interval (Integer) —

    When :endpoint_discovery and :active_endpoint_cache is enabled, Use this option to config the time interval in seconds for making requests fetching endpoints information. Defaults to 60 sec. See Plugins::EndpointDiscovery for more details.

  • :endpoint_discovery (Boolean) —

    When set to true, endpoint discovery will be enabled for operations when available. Defaults to false. See Plugins::EndpointDiscovery for more details.

  • :http_continue_timeout (Float) — default: 1 —

    See Seahorse::Client::Plugins::NetHttp for more details.

  • :http_idle_timeout (Integer) — default: 5 —

    See Seahorse::Client::Plugins::NetHttp for more details.

  • :http_open_timeout (Integer) — default: 15 —

    See Seahorse::Client::Plugins::NetHttp for more details.

  • :http_proxy (String) —

    See Seahorse::Client::Plugins::NetHttp for more details.

  • :http_read_timeout (Integer) — default: 60 —

    See Seahorse::Client::Plugins::NetHttp for more details.

  • :http_wire_trace (Boolean) — default: false —

    See Seahorse::Client::Plugins::NetHttp for more details.

  • :log_level (Symbol) — default: :info —

    The log level to send messages to the logger at. See Plugins::Logging for more details.

  • :log_formatter (Logging::LogFormatter) —

    The log formatter. Defaults to Seahorse::Client::Logging::Formatter.default. See Plugins::Logging for more details.

  • :logger (Logger) — default: nil —

    The Logger instance to send log messages to. If this option is not set, logging will be disabled. See Plugins::Logging for more details.

  • :profile (String) —

    Used when loading credentials from the shared credentials file at HOME/.aws/credentials. When not specified, 'default' is used. See Plugins::RequestSigner for more details.

  • :raise_response_errors (Boolean) — default: true —

    When true, response errors are raised. See Seahorse::Client::Plugins::RaiseResponseErrors for more details.

  • :region (required, String) —

    The AWS region to connect to. The region is used to construct the client endpoint. Defaults to ENV['AWS_REGION']. Also checks AMAZON_REGION and AWS_DEFAULT_REGION. See Plugins::RegionalEndpoint for more details.

  • :retry_limit (Integer) — default: 3 —

    The maximum number of times to retry failed requests. Only ~ 500 level server errors and certain ~ 400 level client errors are retried. Generally, these are throttling errors, data checksum errors, networking errors, timeout errors and auth errors from expired credentials. See Plugins::RetryErrors for more details.

  • :secret_access_key (String) —

    Used to set credentials statically. See Plugins::RequestSigner for more details.

  • :session_token (String) —

    Used to set credentials statically. See Plugins::RequestSigner for more details.

  • :simple_json (Boolean) — default: false —

    Disables request parameter conversion, validation, and formatting. Also disable response data type conversions. This option is useful when you want to ensure the highest level of performance by avoiding overhead of walking request parameters and response data structures.

    When :simple_json is enabled, the request parameters hash must be formatted exactly as the DynamoDB API expects. See Plugins::Protocols::JsonRpc for more details.

  • :ssl_ca_bundle (String) —

    See Seahorse::Client::Plugins::NetHttp for more details.

  • :ssl_ca_directory (String) —

    See Seahorse::Client::Plugins::NetHttp for more details.

  • :ssl_ca_store (String) —

    See Seahorse::Client::Plugins::NetHttp for more details.

  • :ssl_verify_peer (Boolean) — default: true —

    See Seahorse::Client::Plugins::NetHttp for more details.

  • :stub_responses (Boolean) — default: false —

    Causes the client to return stubbed responses. By default fake responses are generated and returned. You can specify the response data to return or errors to raise by calling ClientStubs#stub_responses. See ClientStubs for more information.

    Please note When response stubbing is enabled, no HTTP requests are made, and retries are disabled. See Plugins::StubResponses for more details.

  • :validate_params (Boolean) — default: true —

    When true, request parameters are validated before sending the request. See Plugins::ParamValidator for more details.

Instance Method Details

#batch_grant_permissions(options = {}) ⇒ Types::BatchGrantPermissionsResponse

Batch operation to grant permissions to the principal.

Examples:

Request syntax with placeholder values


resp = client.batch_grant_permissions({
  catalog_id: "CatalogIdString",
  entries: [ # required
    {
      id: "Identifier", # required
      principal: {
        data_lake_principal_identifier: "DataLakePrincipalString",
      },
      resource: {
        catalog: {
        },
        database: {
          catalog_id: "CatalogIdString",
          name: "NameString", # required
        },
        table: {
          catalog_id: "CatalogIdString",
          database_name: "NameString", # required
          name: "NameString",
          table_wildcard: {
          },
        },
        table_with_columns: {
          catalog_id: "CatalogIdString",
          database_name: "NameString", # required
          name: "NameString", # required
          column_names: ["NameString"],
          column_wildcard: {
            excluded_column_names: ["NameString"],
          },
        },
        data_location: {
          catalog_id: "CatalogIdString",
          resource_arn: "ResourceArnString", # required
        },
      },
      permissions: ["ALL"], # accepts ALL, SELECT, ALTER, DROP, DELETE, INSERT, DESCRIBE, CREATE_DATABASE, CREATE_TABLE, DATA_LOCATION_ACCESS
      permissions_with_grant_option: ["ALL"], # accepts ALL, SELECT, ALTER, DROP, DELETE, INSERT, DESCRIBE, CREATE_DATABASE, CREATE_TABLE, DATA_LOCATION_ACCESS
    },
  ],
})

Response structure


resp.failures #=> Array
resp.failures[0].request_entry.id #=> String
resp.failures[0].request_entry.principal.data_lake_principal_identifier #=> String
resp.failures[0].request_entry.resource.database.catalog_id #=> String
resp.failures[0].request_entry.resource.database.name #=> String
resp.failures[0].request_entry.resource.table.catalog_id #=> String
resp.failures[0].request_entry.resource.table.database_name #=> String
resp.failures[0].request_entry.resource.table.name #=> String
resp.failures[0].request_entry.resource.table_with_columns.catalog_id #=> String
resp.failures[0].request_entry.resource.table_with_columns.database_name #=> String
resp.failures[0].request_entry.resource.table_with_columns.name #=> String
resp.failures[0].request_entry.resource.table_with_columns.column_names #=> Array
resp.failures[0].request_entry.resource.table_with_columns.column_names[0] #=> String
resp.failures[0].request_entry.resource.table_with_columns.column_wildcard.excluded_column_names #=> Array
resp.failures[0].request_entry.resource.table_with_columns.column_wildcard.excluded_column_names[0] #=> String
resp.failures[0].request_entry.resource.data_location.catalog_id #=> String
resp.failures[0].request_entry.resource.data_location.resource_arn #=> String
resp.failures[0].request_entry.permissions #=> Array
resp.failures[0].request_entry.permissions[0] #=> String, one of "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS"
resp.failures[0].request_entry.permissions_with_grant_option #=> Array
resp.failures[0].request_entry.permissions_with_grant_option[0] #=> String, one of "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS"
resp.failures[0].error.error_code #=> String
resp.failures[0].error.error_message #=> String

Options Hash (options):

  • :catalog_id (String) —

    The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your AWS Lake Formation environment.

  • :entries (required, Array<Types::BatchPermissionsRequestEntry>) —

    A list of up to 20 entries for resource permissions to be granted by batch operation to the principal.

Returns:

See Also:

#batch_revoke_permissions(options = {}) ⇒ Types::BatchRevokePermissionsResponse

Batch operation to revoke permissions from the principal.

Examples:

Request syntax with placeholder values


resp = client.batch_revoke_permissions({
  catalog_id: "CatalogIdString",
  entries: [ # required
    {
      id: "Identifier", # required
      principal: {
        data_lake_principal_identifier: "DataLakePrincipalString",
      },
      resource: {
        catalog: {
        },
        database: {
          catalog_id: "CatalogIdString",
          name: "NameString", # required
        },
        table: {
          catalog_id: "CatalogIdString",
          database_name: "NameString", # required
          name: "NameString",
          table_wildcard: {
          },
        },
        table_with_columns: {
          catalog_id: "CatalogIdString",
          database_name: "NameString", # required
          name: "NameString", # required
          column_names: ["NameString"],
          column_wildcard: {
            excluded_column_names: ["NameString"],
          },
        },
        data_location: {
          catalog_id: "CatalogIdString",
          resource_arn: "ResourceArnString", # required
        },
      },
      permissions: ["ALL"], # accepts ALL, SELECT, ALTER, DROP, DELETE, INSERT, DESCRIBE, CREATE_DATABASE, CREATE_TABLE, DATA_LOCATION_ACCESS
      permissions_with_grant_option: ["ALL"], # accepts ALL, SELECT, ALTER, DROP, DELETE, INSERT, DESCRIBE, CREATE_DATABASE, CREATE_TABLE, DATA_LOCATION_ACCESS
    },
  ],
})

Response structure


resp.failures #=> Array
resp.failures[0].request_entry.id #=> String
resp.failures[0].request_entry.principal.data_lake_principal_identifier #=> String
resp.failures[0].request_entry.resource.database.catalog_id #=> String
resp.failures[0].request_entry.resource.database.name #=> String
resp.failures[0].request_entry.resource.table.catalog_id #=> String
resp.failures[0].request_entry.resource.table.database_name #=> String
resp.failures[0].request_entry.resource.table.name #=> String
resp.failures[0].request_entry.resource.table_with_columns.catalog_id #=> String
resp.failures[0].request_entry.resource.table_with_columns.database_name #=> String
resp.failures[0].request_entry.resource.table_with_columns.name #=> String
resp.failures[0].request_entry.resource.table_with_columns.column_names #=> Array
resp.failures[0].request_entry.resource.table_with_columns.column_names[0] #=> String
resp.failures[0].request_entry.resource.table_with_columns.column_wildcard.excluded_column_names #=> Array
resp.failures[0].request_entry.resource.table_with_columns.column_wildcard.excluded_column_names[0] #=> String
resp.failures[0].request_entry.resource.data_location.catalog_id #=> String
resp.failures[0].request_entry.resource.data_location.resource_arn #=> String
resp.failures[0].request_entry.permissions #=> Array
resp.failures[0].request_entry.permissions[0] #=> String, one of "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS"
resp.failures[0].request_entry.permissions_with_grant_option #=> Array
resp.failures[0].request_entry.permissions_with_grant_option[0] #=> String, one of "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS"
resp.failures[0].error.error_code #=> String
resp.failures[0].error.error_message #=> String

Options Hash (options):

  • :catalog_id (String) —

    The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your AWS Lake Formation environment.

  • :entries (required, Array<Types::BatchPermissionsRequestEntry>) —

    A list of up to 20 entries for resource permissions to be revoked by batch operation to the principal.

Returns:

See Also:

#deregister_resource(options = {}) ⇒ Struct

Deregisters the resource as managed by the Data Catalog.

When you deregister a path, Lake Formation removes the path from the inline policy attached to your service-linked role.

Examples:

Request syntax with placeholder values


resp = client.deregister_resource({
  resource_arn: "ResourceArnString", # required
})

Options Hash (options):

  • :resource_arn (required, String) —

    The Amazon Resource Name (ARN) of the resource that you want to deregister.

Returns:

  • (Struct) —

    Returns an empty response.

See Also:

#describe_resource(options = {}) ⇒ Types::DescribeResourceResponse

Retrieves the current data access role for the given resource registered in AWS Lake Formation.

Examples:

Request syntax with placeholder values


resp = client.describe_resource({
  resource_arn: "ResourceArnString", # required
})

Response structure


resp.resource_info.resource_arn #=> String
resp.resource_info.role_arn #=> String
resp.resource_info.last_modified #=> Time

Options Hash (options):

  • :resource_arn (required, String) —

    The resource ARN.

Returns:

See Also:

#get_data_lake_settings(options = {}) ⇒ Types::GetDataLakeSettingsResponse

Retrieves the list of the data lake administrators of a Lake Formation-managed data lake.

Examples:

Request syntax with placeholder values


resp = client.get_data_lake_settings({
  catalog_id: "CatalogIdString",
})

Response structure


resp.data_lake_settings.data_lake_admins #=> Array
resp.data_lake_settings.data_lake_admins[0].data_lake_principal_identifier #=> String
resp.data_lake_settings.create_database_default_permissions #=> Array
resp.data_lake_settings.create_database_default_permissions[0].principal.data_lake_principal_identifier #=> String
resp.data_lake_settings.create_database_default_permissions[0].permissions #=> Array
resp.data_lake_settings.create_database_default_permissions[0].permissions[0] #=> String, one of "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS"
resp.data_lake_settings.create_table_default_permissions #=> Array
resp.data_lake_settings.create_table_default_permissions[0].principal.data_lake_principal_identifier #=> String
resp.data_lake_settings.create_table_default_permissions[0].permissions #=> Array
resp.data_lake_settings.create_table_default_permissions[0].permissions[0] #=> String, one of "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS"
resp.data_lake_settings.trusted_resource_owners #=> Array
resp.data_lake_settings.trusted_resource_owners[0] #=> String

Options Hash (options):

  • :catalog_id (String) —

    The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your AWS Lake Formation environment.

Returns:

See Also:

#get_effective_permissions_for_path(options = {}) ⇒ Types::GetEffectivePermissionsForPathResponse

Returns the Lake Formation permissions for a specified table or database resource located at a path in Amazon S3. GetEffectivePermissionsForPath will not return databases and tables if the catalog is encrypted.

Examples:

Request syntax with placeholder values


resp = client.get_effective_permissions_for_path({
  catalog_id: "CatalogIdString",
  resource_arn: "ResourceArnString", # required
  next_token: "Token",
  max_results: 1,
})

Response structure


resp.permissions #=> Array
resp.permissions[0].principal.data_lake_principal_identifier #=> String
resp.permissions[0].resource.database.catalog_id #=> String
resp.permissions[0].resource.database.name #=> String
resp.permissions[0].resource.table.catalog_id #=> String
resp.permissions[0].resource.table.database_name #=> String
resp.permissions[0].resource.table.name #=> String
resp.permissions[0].resource.table_with_columns.catalog_id #=> String
resp.permissions[0].resource.table_with_columns.database_name #=> String
resp.permissions[0].resource.table_with_columns.name #=> String
resp.permissions[0].resource.table_with_columns.column_names #=> Array
resp.permissions[0].resource.table_with_columns.column_names[0] #=> String
resp.permissions[0].resource.table_with_columns.column_wildcard.excluded_column_names #=> Array
resp.permissions[0].resource.table_with_columns.column_wildcard.excluded_column_names[0] #=> String
resp.permissions[0].resource.data_location.catalog_id #=> String
resp.permissions[0].resource.data_location.resource_arn #=> String
resp.permissions[0].permissions #=> Array
resp.permissions[0].permissions[0] #=> String, one of "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS"
resp.permissions[0].permissions_with_grant_option #=> Array
resp.permissions[0].permissions_with_grant_option[0] #=> String, one of "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS"
resp.permissions[0].additional_details.resource_share #=> Array
resp.permissions[0].additional_details.resource_share[0] #=> String
resp.next_token #=> String

Options Hash (options):

  • :catalog_id (String) —

    The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your AWS Lake Formation environment.

  • :resource_arn (required, String) —

    The Amazon Resource Name (ARN) of the resource for which you want to get permissions.

  • :next_token (String) —

    A continuation token, if this is not the first call to retrieve this list.

  • :max_results (Integer) —

    The maximum number of results to return.

Returns:

See Also:

#grant_permissions(options = {}) ⇒ Struct

Grants permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3.

For information about permissions, see Security and Access Control to Metadata and Data.

Examples:

Request syntax with placeholder values


resp = client.grant_permissions({
  catalog_id: "CatalogIdString",
  principal: { # required
    data_lake_principal_identifier: "DataLakePrincipalString",
  },
  resource: { # required
    catalog: {
    },
    database: {
      catalog_id: "CatalogIdString",
      name: "NameString", # required
    },
    table: {
      catalog_id: "CatalogIdString",
      database_name: "NameString", # required
      name: "NameString",
      table_wildcard: {
      },
    },
    table_with_columns: {
      catalog_id: "CatalogIdString",
      database_name: "NameString", # required
      name: "NameString", # required
      column_names: ["NameString"],
      column_wildcard: {
        excluded_column_names: ["NameString"],
      },
    },
    data_location: {
      catalog_id: "CatalogIdString",
      resource_arn: "ResourceArnString", # required
    },
  },
  permissions: ["ALL"], # required, accepts ALL, SELECT, ALTER, DROP, DELETE, INSERT, DESCRIBE, CREATE_DATABASE, CREATE_TABLE, DATA_LOCATION_ACCESS
  permissions_with_grant_option: ["ALL"], # accepts ALL, SELECT, ALTER, DROP, DELETE, INSERT, DESCRIBE, CREATE_DATABASE, CREATE_TABLE, DATA_LOCATION_ACCESS
})

Options Hash (options):

  • :catalog_id (String) —

    The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your AWS Lake Formation environment.

  • :principal (required, Types::DataLakePrincipal) —

    The principal to be granted the permissions on the resource. Supported principals are IAM users or IAM roles, and they are defined by their principal type and their ARN.

    Note that if you define a resource with a particular ARN, then later delete, and recreate a resource with that same ARN, the resource maintains the permissions already granted.

  • :resource (required, Types::Resource) —

    The resource to which permissions are to be granted. Resources in AWS Lake Formation are the Data Catalog, databases, and tables.

  • :permissions (required, Array<String>) —

    The permissions granted to the principal on the resource. AWS Lake Formation defines privileges to grant and revoke access to metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3. AWS Lake Formation requires that each principal be authorized to perform a specific task on AWS Lake Formation resources.

  • :permissions_with_grant_option (Array<String>) —

    Indicates a list of the granted permissions that the principal may pass to other users. These permissions may only be a subset of the permissions granted in the Privileges.

Returns:

  • (Struct) —

    Returns an empty response.

See Also:

#list_permissions(options = {}) ⇒ Types::ListPermissionsResponse

Returns a list of the principal permissions on the resource, filtered by the permissions of the caller. For example, if you are granted an ALTER permission, you are able to see only the principal permissions for ALTER.

This operation returns only those permissions that have been explicitly granted.

For information about permissions, see Security and Access Control to Metadata and Data.

Examples:

Request syntax with placeholder values


resp = client.list_permissions({
  catalog_id: "CatalogIdString",
  principal: {
    data_lake_principal_identifier: "DataLakePrincipalString",
  },
  resource_type: "CATALOG", # accepts CATALOG, DATABASE, TABLE, DATA_LOCATION
  resource: {
    catalog: {
    },
    database: {
      catalog_id: "CatalogIdString",
      name: "NameString", # required
    },
    table: {
      catalog_id: "CatalogIdString",
      database_name: "NameString", # required
      name: "NameString",
      table_wildcard: {
      },
    },
    table_with_columns: {
      catalog_id: "CatalogIdString",
      database_name: "NameString", # required
      name: "NameString", # required
      column_names: ["NameString"],
      column_wildcard: {
        excluded_column_names: ["NameString"],
      },
    },
    data_location: {
      catalog_id: "CatalogIdString",
      resource_arn: "ResourceArnString", # required
    },
  },
  next_token: "Token",
  max_results: 1,
})

Response structure


resp.principal_resource_permissions #=> Array
resp.principal_resource_permissions[0].principal.data_lake_principal_identifier #=> String
resp.principal_resource_permissions[0].resource.database.catalog_id #=> String
resp.principal_resource_permissions[0].resource.database.name #=> String
resp.principal_resource_permissions[0].resource.table.catalog_id #=> String
resp.principal_resource_permissions[0].resource.table.database_name #=> String
resp.principal_resource_permissions[0].resource.table.name #=> String
resp.principal_resource_permissions[0].resource.table_with_columns.catalog_id #=> String
resp.principal_resource_permissions[0].resource.table_with_columns.database_name #=> String
resp.principal_resource_permissions[0].resource.table_with_columns.name #=> String
resp.principal_resource_permissions[0].resource.table_with_columns.column_names #=> Array
resp.principal_resource_permissions[0].resource.table_with_columns.column_names[0] #=> String
resp.principal_resource_permissions[0].resource.table_with_columns.column_wildcard.excluded_column_names #=> Array
resp.principal_resource_permissions[0].resource.table_with_columns.column_wildcard.excluded_column_names[0] #=> String
resp.principal_resource_permissions[0].resource.data_location.catalog_id #=> String
resp.principal_resource_permissions[0].resource.data_location.resource_arn #=> String
resp.principal_resource_permissions[0].permissions #=> Array
resp.principal_resource_permissions[0].permissions[0] #=> String, one of "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS"
resp.principal_resource_permissions[0].permissions_with_grant_option #=> Array
resp.principal_resource_permissions[0].permissions_with_grant_option[0] #=> String, one of "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS"
resp.principal_resource_permissions[0].additional_details.resource_share #=> Array
resp.principal_resource_permissions[0].additional_details.resource_share[0] #=> String
resp.next_token #=> String

Options Hash (options):

  • :catalog_id (String) —

    The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your AWS Lake Formation environment.

  • :principal (Types::DataLakePrincipal) —

    Specifies a principal to filter the permissions returned.

  • :resource_type (String) —

    Specifies a resource type to filter the permissions returned.

  • :resource (Types::Resource) —

    A resource where you will get a list of the principal permissions.

    This operation does not support getting privileges on a table with columns. Instead, call this operation on the table, and the operation returns the table and the table w columns.

  • :next_token (String) —

    A continuation token, if this is not the first call to retrieve this list.

  • :max_results (Integer) —

    The maximum number of results to return.

Returns:

See Also:

#list_resources(options = {}) ⇒ Types::ListResourcesResponse

Lists the resources registered to be managed by the Data Catalog.

Examples:

Request syntax with placeholder values


resp = client.list_resources({
  filter_condition_list: [
    {
      field: "RESOURCE_ARN", # accepts RESOURCE_ARN, ROLE_ARN, LAST_MODIFIED
      comparison_operator: "EQ", # accepts EQ, NE, LE, LT, GE, GT, CONTAINS, NOT_CONTAINS, BEGINS_WITH, IN, BETWEEN
      string_value_list: ["StringValue"],
    },
  ],
  max_results: 1,
  next_token: "Token",
})

Response structure


resp.resource_info_list #=> Array
resp.resource_info_list[0].resource_arn #=> String
resp.resource_info_list[0].role_arn #=> String
resp.resource_info_list[0].last_modified #=> Time
resp.next_token #=> String

Options Hash (options):

  • :filter_condition_list (Array<Types::FilterCondition>) —

    Any applicable row-level and/or column-level filtering conditions for the resources.

  • :max_results (Integer) —

    The maximum number of resource results.

  • :next_token (String) —

    A continuation token, if this is not the first call to retrieve these resources.

Returns:

See Also:

#put_data_lake_settings(options = {}) ⇒ Struct

Sets the list of data lake administrators who have admin privileges on all resources managed by Lake Formation. For more information on admin privileges, see Granting Lake Formation Permissions.

This API replaces the current list of data lake admins with the new list being passed. To add an admin, fetch the current list and add the new admin to that list and pass that list in this API.

Examples:

Request syntax with placeholder values


resp = client.put_data_lake_settings({
  catalog_id: "CatalogIdString",
  data_lake_settings: { # required
    data_lake_admins: [
      {
        data_lake_principal_identifier: "DataLakePrincipalString",
      },
    ],
    create_database_default_permissions: [
      {
        principal: {
          data_lake_principal_identifier: "DataLakePrincipalString",
        },
        permissions: ["ALL"], # accepts ALL, SELECT, ALTER, DROP, DELETE, INSERT, DESCRIBE, CREATE_DATABASE, CREATE_TABLE, DATA_LOCATION_ACCESS
      },
    ],
    create_table_default_permissions: [
      {
        principal: {
          data_lake_principal_identifier: "DataLakePrincipalString",
        },
        permissions: ["ALL"], # accepts ALL, SELECT, ALTER, DROP, DELETE, INSERT, DESCRIBE, CREATE_DATABASE, CREATE_TABLE, DATA_LOCATION_ACCESS
      },
    ],
    trusted_resource_owners: ["CatalogIdString"],
  },
})

Options Hash (options):

  • :catalog_id (String) —

    The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your AWS Lake Formation environment.

  • :data_lake_settings (required, Types::DataLakeSettings) —

    A structure representing a list of AWS Lake Formation principals designated as data lake administrators.

Returns:

  • (Struct) —

    Returns an empty response.

See Also:

#register_resource(options = {}) ⇒ Struct

Registers the resource as managed by the Data Catalog.

To add or update data, Lake Formation needs read/write access to the chosen Amazon S3 path. Choose a role that you know has permission to do this, or choose the AWSServiceRoleForLakeFormationDataAccess service-linked role. When you register the first Amazon S3 path, the service-linked role and a new inline policy are created on your behalf. Lake Formation adds the first path to the inline policy and attaches it to the service-linked role. When you register subsequent paths, Lake Formation adds the path to the existing policy.

The following request registers a new location and gives AWS Lake Formation permission to use the service-linked role to access that location.

ResourceArn = arn:aws:s3:::my-bucket UseServiceLinkedRole = true

If UseServiceLinkedRole is not set to true, you must provide or set the RoleArn:

arn:aws:iam::12345:role/my-data-access-role

Examples:

Request syntax with placeholder values


resp = client.register_resource({
  resource_arn: "ResourceArnString", # required
  use_service_linked_role: false,
  role_arn: "IAMRoleArn",
})

Options Hash (options):

  • :resource_arn (required, String) —

    The Amazon Resource Name (ARN) of the resource that you want to register.

  • :use_service_linked_role (Boolean) —

    Designates an AWS Identity and Access Management (IAM) service-linked role by registering this role with the Data Catalog. A service-linked role is a unique type of IAM role that is linked directly to Lake Formation.

    For more information, see Using Service-Linked Roles for Lake Formation.

  • :role_arn (String) —

    The identifier for the role that registers the resource.

Returns:

  • (Struct) —

    Returns an empty response.

See Also:

#revoke_permissions(options = {}) ⇒ Struct

Revokes permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3.

Examples:

Request syntax with placeholder values


resp = client.revoke_permissions({
  catalog_id: "CatalogIdString",
  principal: { # required
    data_lake_principal_identifier: "DataLakePrincipalString",
  },
  resource: { # required
    catalog: {
    },
    database: {
      catalog_id: "CatalogIdString",
      name: "NameString", # required
    },
    table: {
      catalog_id: "CatalogIdString",
      database_name: "NameString", # required
      name: "NameString",
      table_wildcard: {
      },
    },
    table_with_columns: {
      catalog_id: "CatalogIdString",
      database_name: "NameString", # required
      name: "NameString", # required
      column_names: ["NameString"],
      column_wildcard: {
        excluded_column_names: ["NameString"],
      },
    },
    data_location: {
      catalog_id: "CatalogIdString",
      resource_arn: "ResourceArnString", # required
    },
  },
  permissions: ["ALL"], # required, accepts ALL, SELECT, ALTER, DROP, DELETE, INSERT, DESCRIBE, CREATE_DATABASE, CREATE_TABLE, DATA_LOCATION_ACCESS
  permissions_with_grant_option: ["ALL"], # accepts ALL, SELECT, ALTER, DROP, DELETE, INSERT, DESCRIBE, CREATE_DATABASE, CREATE_TABLE, DATA_LOCATION_ACCESS
})

Options Hash (options):

  • :catalog_id (String) —

    The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your AWS Lake Formation environment.

  • :principal (required, Types::DataLakePrincipal) —

    The principal to be revoked permissions on the resource.

  • :resource (required, Types::Resource) —

    The resource to which permissions are to be revoked.

  • :permissions (required, Array<String>) —

    The permissions revoked to the principal on the resource. For information about permissions, see Security and Access Control to Metadata and Data.

  • :permissions_with_grant_option (Array<String>) —

    Indicates a list of permissions for which to revoke the grant option allowing the principal to pass permissions to other principals.

Returns:

  • (Struct) —

    Returns an empty response.

See Also:

#update_resource(options = {}) ⇒ Struct

Updates the data access role used for vending access to the given (registered) resource in AWS Lake Formation.

Examples:

Request syntax with placeholder values


resp = client.update_resource({
  role_arn: "IAMRoleArn", # required
  resource_arn: "ResourceArnString", # required
})

Options Hash (options):

  • :role_arn (required, String) —

    The new role to use for the given resource registered in AWS Lake Formation.

  • :resource_arn (required, String) —

    The resource ARN.

Returns:

  • (Struct) —

    Returns an empty response.

See Also:

#wait_until(waiter_name, params = {}) {|waiter| ... } ⇒ Boolean

Waiters polls an API operation until a resource enters a desired state.

Basic Usage

Waiters will poll until they are succesful, they fail by entering a terminal state, or until a maximum number of attempts are made.

# polls in a loop, sleeping between attempts client.waiter_until(waiter_name, params)

Configuration

You can configure the maximum number of polling attempts, and the delay (in seconds) between each polling attempt. You configure waiters by passing a block to #wait_until:

# poll for ~25 seconds
client.wait_until(...) do |w|
  w.max_attempts = 5
  w.delay = 5
end

Callbacks

You can be notified before each polling attempt and before each delay. If you throw :success or :failure from these callbacks, it will terminate the waiter.

started_at = Time.now
client.wait_until(...) do |w|

  # disable max attempts
  w.max_attempts = nil

  # poll for 1 hour, instead of a number of attempts
  w.before_wait do |attempts, response|
    throw :failure if Time.now - started_at > 3600
  end

end

Handling Errors

When a waiter is successful, it returns true. When a waiter fails, it raises an error. All errors raised extend from Waiters::Errors::WaiterFailed.

begin
  client.wait_until(...)
rescue Aws::Waiters::Errors::WaiterFailed
  # resource did not enter the desired state in time
end

Parameters:

  • waiter_name (Symbol) —

    The name of the waiter. See #waiter_names for a full list of supported waiters.

  • params (Hash) (defaults to: {}) —

    Additional request parameters. See the #waiter_names for a list of supported waiters and what request they call. The called request determines the list of accepted parameters.

Yield Parameters:

Returns:

  • (Boolean) —

    Returns true if the waiter was successful.

Raises:

  • (Errors::FailureStateError) —

    Raised when the waiter terminates because the waiter has entered a state that it will not transition out of, preventing success.

  • (Errors::TooManyAttemptsError) —

    Raised when the configured maximum number of attempts have been made, and the waiter is not yet successful.

  • (Errors::UnexpectedError) —

    Raised when an error is encounted while polling for a resource that is not expected.

  • (Errors::NoSuchWaiterError) —

    Raised when you request to wait for an unknown state.

#waiter_names ⇒ Array<Symbol>

Returns the list of supported waiters. The following table lists the supported waiters and the client method they call:

Waiter NameClient MethodDefault Delay:Default Max Attempts:

Returns:

  • (Array<Symbol>) —

    the list of supported waiters.