CODEWITHSUNDEEP
amazon-web-servicesaws-glueamazon-athenaaws-lake-formation
plazmakeks
plazmakeks

Reputation: 181

AWS Lake Formation: Grant permission for one role to ALL databases

Is it possible to somehow grant permissions to ALL available databases in Lake Formation? Using the AWS UI I'm able to grant permission to individual databases. However I'm looking for a way to grant permissions to all available databases. Is that possible somehow?

Upvotes: 3

Views: 2124

Answers (2)

AreuGTOready
AreuGTOready

Reputation: 11

Use tags

Create a tag "admin": "true" (or anything else more suitable for your need) Associate this tag to all db ( no need to associate table, they will inherit the tag value from their db) grant desired permissions on this tag to your user/role.

Benfit : any new db or tables tagged with this tag key/value will be accessible

Upvotes: 1

plazmakeks
plazmakeks

Reputation: 181

Figured out how to use the CLI for that for individual databases. However, AWS confirms theres no API available for batch processing. Anyway this can be modified in a batch script or whatever one prefers to make it work in a batch style:

aws lakeformation grant-permissions --profile <your-profile> --principal '{"DataLakePrincipalIdentifier": "arn:aws:iam::<account-id>:role/<role>"}' --resource '{"Database": {"Name": "<database-name>", "CatalogId": "<account-id>"}}' --permissions ALL --permissions-with-grant-option ALL

Upvotes: 0

Related Questions