Skip to content

Table Wildcard Grant for Database Policies

By default, when a policy grants access to all tables in a database (using a table wildcard *), the Lake Formation connector pushes a separate Lake Formation grant for every table in that database. For databases that contain many tables, this produces a large number of grants and Lake Formation API calls.

When Table Wildcard Grant is enabled, the connector instead pushes a single Lake Formation Table grant with TableWildcard for the database. One grant then covers every current and future table in that database, which reduces the number of grants and API calls and speeds up policy synchronization.

Use this setting for databases where users are granted access to all tables and you want to minimize the number of Lake Formation grants.

Note

  • This feature applies to the Lake Formation Push (Sink) mode only.
  • A database is consolidated to a single wildcard grant only when all of its tables are managed by the connector. If a table in the database is excluded from sync or has a row filter (Lake Formation Data Cells Filter), that database continues to use per-table grants so row-level filtering is preserved.
  • The table name ALL_TABLES is reserved while this feature is enabled. Avoid creating a Glue table named ALL_TABLES in a database managed by this connector.

Configuration

Setting Type Default Description
CONNECTOR_LAKEFORMATION_ENABLE_TABLE_WILDCARD_GRANT Boolean false When enabled, a database policy that grants on all tables (table *) is pushed as a single Table + TableWildcard Lake Formation grant per database instead of one grant per table.

Setup

  1. SSH into the instance where Privacera Manager is installed.

  2. Navigate to your Lake Formation connector instance YAML file :

    Note

    Replace instance1 with the appropriate connector instance name.

    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/lakeformation/instance1/vars.connector.lakeformation.push.yml

  3. To turn on the table wildcard grant, set the following PolicySync variable:

    YAML
    1
2
    # Table wildcard grant
CONNECTOR_LAKEFORMATION_ENABLE_TABLE_WILDCARD_GRANT: "true"

  4. After updating the file, apply the changes by running:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install