Skip to content

Batch Permissions API Diagnostic Warning logs – Lake Formation Connector

This section explains how to enable optional WARN-level diagnostic logging for Lake Formation batch grant and revoke API calls. Enable it during troubleshooting to capture one summary WARN line after each batch API response.

Each diagnostic line includes the operation key, AWS request ID, response time, batch size, HTTP status code, and failure count.

Example WARN log

These diagnostic lines appear only when CONNECTOR_LAKEFORMATION_BATCH_PERMISSIONS_API_DIAGNOSTIC_WARN_ENABLE is set to "true".

Text Only
1
2026-05-25 14:32:18,442 WARN  [LakeFormationPolicySync-1] c.p.p.c.l.util.LFGrantRevokeProcessor - LakeFormation batch API: operationKey=batchGrantPermissions_25, requestId=a1b2c3d4-e5f6-7890-abcd-ef1234567890, responseTimeMs=842, batchSize=25, httpStatusCode=200, failureCount=0

Configuration

  • Variable: CONNECTOR_LAKEFORMATION_BATCH_PERMISSIONS_API_DIAGNOSTIC_WARN_ENABLE
  • Description: When enabled, the connector writes an additional WARN-level summary line after each Lake Formation batchGrantPermissions or batchRevokePermissions call, including operationKey, AWS requestId, responseTimeMs, batchSize, httpStatusCode, and failureCount.
  • Type: Boolean
  • Default: false

Setup

  1. SSH into the instance where Privacera Manager is installed.

  2. Open the Lake Formation connector configuration file for editing:

    Note

    Replace instance1 with the appropriate connector instance name, if you have multiple connectors.

    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/lakeformation/instance1/vars.connector.lakeformation.push.yml

  3. Set the flag:

    YAML
    1
    CONNECTOR_LAKEFORMATION_BATCH_PERMISSIONS_API_DIAGNOSTIC_WARN_ENABLE: "true"

  4. After updating the value, apply the changes by running the following commands:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install