Lake Formation Settings

Note: This documentation is also available in a rendered format here.

Configures account-level Lake Formation settings including administrator roles, default IAM Allowed Principals behavior, DataZone admin role creation, IAM Identity Center integration, and S3 Tables integration with AWS analytics services. Use this module as a prerequisite when setting up Lake Formation-based data governance, to establish admin roles and control whether new Glue resources default to IAM or Lake Formation permissions.

⚠️ Account-Level Module — This module can only be deployed once per AWS account. A second deployment to the same account will fail. See Account-Level Modules for details.

Deployed Resources

This module deploys and integrates the following resources:

LakeFormation Settings - Configures LakeFormation administrator roles and default permissions behavior for IAM Allowed Principals on new Glue Databases/Tables.

DataZone Manage Access Role (Optional) - IAM role with cross-account trust for centralized DataZone data governance, with ARN stored in SSM Parameter Store.

IAM Identity Center Configuration (Optional) - Configures Lake Formation integration with IAM Identity Center for SSO-based access.

S3 Tables Integration (Optional) - Automates the S3 Tables "Enable integration" action by creating the s3tablescatalog Glue federated catalog, making S3 table buckets in this account/Region queryable from AWS analytics services (Athena, Redshift, EMR, QuickSight) without a manual console step. Glue registers the table bucket location with Lake Formation using IAM (IAM_ALLOWED_PRINCIPALS) access controls. The s3tablescatalog catalog is created with IAM_ALLOWED_PRINCIPALS/ALL default database and table permissions and full external table access regardless of this module's iamAllowedPrincipalsDefault setting — so these catalogs are governed by IAM rather than fine-grained Lake Formation grants (this matches the S3 console "Enable integration" behavior, and does not change the default permissions applied to your other, non-S3-Tables, databases and tables). Because the integration is a single shared resource per account/Region, it is deliberately placed in this account-level module. On stack delete the integration is left in place by default (so queries for other deployments don't break); set removeOnDelete: true to tear it down. If the s3tablescatalog catalog already exists (for example it was enabled from the S3 console, or by an earlier deployment), MDAA treats that as success and leaves the existing catalog's permissions unchanged — it does not re-apply or verify the default permissions against an already-present catalog.

LakeFormationSettings

Lake Formation Access Control — Deploy fine-grained Lake Formation grants after configuring account-level settings with this module
Data Lake — Data lake Lake Formation locations require admin roles configured by this module
DataZone — DataZone domains integrate with Lake Formation admin roles configured here
SageMaker (Domain) — SageMaker domains integrate with Lake Formation admin roles configured here
Glue Catalog Settings — Configure Glue Catalog encryption alongside Lake Formation settings for the account
S3 Tables — Enable s3TablesIntegration here so S3 table buckets deployed by that module are queryable from AWS analytics services

Security/Compliance Details

This module is designed in alignment with MDAA security/compliance principles and CDK nag rulesets. Additional review is recommended prior to production deployment, ensuring organization-specific compliance requirements are met.

Least Privilege:
- Lake Formation admin roles (lakeFormationAdminRoles) control all data access grants
- IAM Allowed Principals default configurable (disable for strict LF-only governance)
- Optional CDK deploy role as LF admin for automated deployments
Separation of Duties:
- DataZone admin role with cross-account trust for centralized data governance
- IAM Identity Center integration for SSO-based Lake Formation access

Configuration

MDAA Config

Add the following snippet to your mdaa.yaml under the modules: section of a domain/env in order to use this module:

lakeformation-settings: # Module Name can be customized
  module_path: '@aws-mdaa/lakeformation-settings' # Must match module NPM package name
  module_configs:
    - ./lakeformation-settings.yaml # Filename/path can be customized

Module Config Samples and Variants

Copy the contents of the relevant sample config below into the ./lakeformation-settings.yaml file referenced in the MDAA config snippet above.

Minimal Configuration

Required properties only — Lake Formation admin roles and IAM Allowed Principals default. Start here for basic account-level Lake Formation setup with an admin role.

sample-config-minimal.yaml

# Contents available via above link
# Minimal Lake Formation Settings module configuration.
# Contains only required properties for account-level LF settings.

# Lake Formation admin role references
lakeFormationAdminRoles:
  - name: Admin

# Whether to add IAM_ALLOWED_PRINCIPALS by default to new
# databases and tables
iamAllowedPrincipalsDefault: true

Comprehensive Configuration

Covers Lake Formation admin roles, IAM permission defaults, cross-account sharing, DataZone integration, IAM Identity Center integration, and S3 Tables integration for centralized data governance. Start here when evaluating all available options for admin roles, SSO integration, cross-account DataZone governance, and automated S3 Tables analytics enablement.

sample-config-comprehensive.yaml

# Contents available via above link
# Comprehensive Lake Formation Settings module configuration.
# Covers ALL non-excluded properties at full depth including
# Lake Formation admin roles, IAM permission defaults,
# cross-account sharing, DataZone integration, and IAM Identity
# Center integration for centralized data governance.

# Lake Formation admin role references (required).
# Roles can be referenced by name (auto-expanded to ARN), by explicit ARN,
# by MDAA-generated role ID, or as SSO-managed roles.
lakeFormationAdminRoles:
  # Role by name (auto-expanded to ARN at deploy time)
  - name: Admin
  # Role by ARN
  - arn: arn:{{partition}}:iam::{{account}}:role/LakeFormationCrossAccountAdmin
    immutable: true
  # Role by ARN
  - arn: arn:{{partition}}:iam::{{account}}:role/LakeFormationAdmin
  # SSO-managed role (resolved from IAM Identity Center)
  - name: SSOLakeFormationAdmin
    sso: true

# (Required) Controls whether IAM_ALLOWED_PRINCIPALS is added by
# default to new databases and tables. When true, Lake Formation
# defers to IAM policies on Glue catalog resources. When false,
# all permissions must be managed exclusively in Lake Formation.
iamAllowedPrincipalsDefault: true

# (Optional) When true, adds the CDK execution role as a Lake
# Formation admin so CDK deployments can manage Lake Formation
# resources without manual setup.
createCdkLFAdmin: true

# (Optional) When true, creates a dedicated Lake Formation admin
# role for DataZone so DataZone can manage Lake Formation
# permissions in this account.
createDataZoneAdminRole: true

# (Optional) Additional account IDs added to the DataZone admin
# role's trust policy, allowing DataZone in those accounts to
# manage Lake Formation in this account. Requires
# createDataZoneAdminRole: true.
dataZoneAdminTrustAccounts:
  - '{{account}}'

# (Optional) Lake Formation cross-account sharing version.
# Controls which cross-account sharing features are available
# for data mesh and multi-account architectures.
crossAccountVersion: '4'

# (Optional) IAM Identity Center integration for Lake Formation,
# enabling SSO-based data lake access and optional cross-account
# or org sharing via RAM.
iamIdentityCenter:
  # (Required) IAM Identity Center instance ID
  instanceId: ssoins-test-instance-id
  # (Optional) Accounts, organizations, or OUs to share Lake
  # Formation services with via IAM Identity Center
  shares:
    # Share with a specific account
    - '{{account}}'
    # Share with an entire organization
    - 'arn:{{partition}}:organizations::{{account}}:organization/o-exampleorgid'
    # Share with a specific organizational unit
    - 'arn:{{partition}}:organizations::{{account}}:ou/o-exampleorgid/ou-exampleouid'

# (Optional) Enable S3 Tables integration with AWS analytics services. See SCHEMA.md for the full contract.
s3TablesIntegration:
  # (Required) Set true to enable the S3 Tables integration.
  enabled: true
  # (Optional) Set true only if this stack owns the integration and you want it removed on delete.
  removeOnDelete: false

Config Schema Docs