Prerequisites for Lake Formation Push Mode - Access Management¶

AWS Lake Formation connector with Privacera using the Push mode requires the following prerequisites:

Mandatory Prerequisites¶

Optional Prerequisites¶

Appendix¶

IAM Policies for managing Lake Formation¶

The following IAM policies are required to update the policies in AWS Lake Formation. You can name it privacera-lf-push-policy.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
              "lakeformation:ListDataCellsFilter",
              "lakeformation:GetEffectivePermissionsForPath",
              "lakeformation:ListLFTags",
              "lakeformation:GetLFTag",
              "lakeformation:ListPermissions",
              "lakeformation:GetResourceLFTags",
              "lakeformation:DescribeResource",
              "lakeformation:ListResources",
              "lakeformation:GetTableObjects",
              "lakeformation:BatchGrantPermissions",
              "lakeformation:GrantPermissions",
              "lakeformation:DeleteDataCellsFilter",
              "lakeformation:RevokePermissions",
              "lakeformation:CreateDataCellsFilter",
              "lakeformation:BatchRevokePermissions"              
            ],
            "Resource": "*"
        }
    ]
}

IAM policies to read from Glue Data Catalog¶

The following IAM policies are required to read from the Glue Data Catalog. You can name it privacera-lf-glue-read-policy. This connector doesn't require write access to the Glue Data Catalog.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "glue:GetTables",
        "glue:GetTableVersions",
        "glue:GetDatabases",
        "glue:GetTable",
        "glue:GetDatabase",
        "glue:GetTableVersion",
        "glue:GetColumnStatisticsForTable"
      ],
      "Resource": "*"
    }
  ]
}

IAM policies to retrieve IAM Roles¶

The following IAM policies are required to retrieve the IAM roles. You can name it privacera-lf-iam-read-policy. This connector doesn't require write access to the IAM roles and it will not create or modify any IAM roles.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:ListRoles",
        "iam:ListGroups",
        "iam:ListUsers"
      ],      
      "Resource": "*"
    }
  ]
}

IAM policies for sharing resource across AWS Accounts¶

The following IAM policies are required to share resources across AWS Accounts. You can name it privacera-lf-share-policy. If you are using the Data Mesh design pattern and/or sharing resources across AWS accounts, you need to add additional permissions so that Privacera can manage the policies in the shared resources in other accounts also.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:CreateResourceShare",
        "ram:GetResourceShares",
        "ram:AssociateResourceShare",
        "ram:DisassociateResourceShare",
        "ram:DeleteResourceShare"
      ],
      "Resource": "*"
    }
  ]
}

IAM Role for the Privacera Connector¶

The following IAM role is required for the Privacera Connector. You can name it privacera-lf-push-connector-role.

Lake Formation Administrator Configuration¶

The IAM Role used by the Privacera Lake Formation connector should have the administrator privileges to manage the policies Lake Formation

1. Log in to AWS Account and navigate to AWS Lake Formation > Administrative roles and tasks.
2. Click [Add] in the Data lake administrators section
3. For Access Type [Data lake administrator] search for the role that was created for Privacera Lake Formation e.g. privacera-lf-push-connector-role and select it.
4. Click [Confirm].

Trust Policy to PrivaceraCloud for the IAM Role¶

If the Lake Formation connector is deployed in PrivaceraCloud, then the IAM Role should have a trust policy to PrivaceraCloud to manage the policies in your AWS Lake Formation. This should be attached to the role from the PrivaceraCloud. Go to the AWS IAM console and attach the following trust policy to the IAM Role you created for the Privacera Lake Formation connector.

1
2
3
4
5
6
7
8
9

{
  "Effect": "Allow",
  "Principal": {
    "AWS": [
      "<ROLE_ARN>"
    ]
  },
  "Action": "sts:AssumeRole"
}

Comments