Skip to content

Serialized Batch Grants by Account – Lake Formation Connector

Serialize batch AWS API calls for cross-account principals to avoid concurrent update conflicts and reduce throttling when applying permissions at scale.

Behavior

When enabled, the connector:

  • Groups permission changes into batch operations (requires Batch Permissions Update to be enabled).
  • Serializes batch execution by account for cross-account principals.
  • Reduces the likelihood of concurrent update conflicts and throttling responses.

Prerequisite

Before enabling serialization by account, you must first enable Batch Permissions Update:

Configuration Parameter

CONNECTOR_LAKEFORMATION_BATCH_GRANT_SERIALIZE_BY_ACCOUNT_ENABLE

  • Description: Enables serialized processing of batch grant/revoke operations by account for cross-account principals.
  • Type: Boolean
  • Default: false
  • Purpose: When enabled, the connector serializes batch permission updates per account to minimize ConcurrentModificationException and API throttling in multi-account scenarios.

Setup

  1. SSH into the instance where Privacera Manager is installed.
  2. Open the Lake Formation connector configuration file for editing:
    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/lakeformation/<instance-name>/vars.connector.lakeformation.push.yml
    Replace <instance-name> with your connector instance name (for example, instance1).
  3. Add the following property:
    YAML
    1
    CONNECTOR_LAKEFORMATION_BATCH_GRANT_SERIALIZE_BY_ACCOUNT_ENABLE: "true"

  4. Apply the changes:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install