MDAA TS Docs
    Preparing search index...

    Interface DatabaseLakeFormationProps

    Lake Formation database permissions configuration for automatic grant management on project databases.

    Use cases: Automated data admin permissions; DataOps team access management; Lake Formation grant automation; Database permission simplification; Project-level access control

    AWS: AWS Lake Formation database permissions with automatic super grants for data admin roles on DataOps project databases

    Validation: createSuperGrantsForDataAdminRoles must be boolean; data admin roles must exist in the account; database must be registered with Lake Formation

    interface DatabaseLakeFormationProps {
        createCrossAccountResourceLinkAccounts?: string[];
        createCrossAccountResourceLinkName?: string;
        createReadGrantsForDataEngineerRoles?: boolean;
        createReadWriteGrantsForProjectExecutionRoles?:
            | boolean
            | "read"
            | "write"
            | "super";
        createSuperGrantsForDataAdminRoles?: boolean;
        databaseTagValues?: LFTagConfig[];
        grants?: NamedDatabaseGrantProps;
        tagBasedGrants?: NamedTagBasedGrants;
    }
    Index

    Properties

    createCrossAccountResourceLinkAccounts? createCrossAccountResourceLinkName? createReadGrantsForDataEngineerRoles? createReadWriteGrantsForProjectExecutionRoles? createSuperGrantsForDataAdminRoles? databaseTagValues? grants? tagBasedGrants?

    Properties

    createCrossAccountResourceLinkAccounts?: string[]

    Target account numbers for cross-account resource link creation.

    createCrossAccountResourceLinkName?: string

    Custom name for cross-account resource links. Defaults to database name.

    createReadGrantsForDataEngineerRoles?: boolean

    Auto-create read grants for data engineer roles on this database.

    createReadWriteGrantsForProjectExecutionRoles?:
        | boolean
        | "read"
        | "write"
        | "super"

    Auto-create Lake Formation grants for project execution roles on this database and its S3 locations.

    Accepts a boolean or a permission level. true is equivalent to 'write' (backward compatible). false or omitted creates no grants. 'read' grants read-only access and no data-location access. 'write' grants read/write. 'super' additionally grants table ALTER/DROP and database DROP for ETL jobs that replace or recreate tables; because these are destructive privileges that expand the role's blast radius, prefer 'read'/'write' by default and select 'super' only for roles that genuinely require it.

    Use cases: Read-only ETL roles; standard read/write ETL; table-replacing/recreating ETL (super); disabling grants

    AWS: AWS Lake Formation database and table permissions, plus DATA_LOCATION_ACCESS, for project execution roles

    Validation: Optional; boolean OR one of the case-sensitive strings 'read' | 'write' | 'super'

    undefined (no grants created)
    createSuperGrantsForDataAdminRoles?: boolean

    Auto-create super grants for data admin roles on this database.

    databaseTagValues?: LFTagConfig[]

    LF-Tag values to associate with this database for tag-based access control.

    grants?: NamedDatabaseGrantProps

    Named Lake Formation grant configurations for this database.

    tagBasedGrants?: NamedTagBasedGrants

    Tag-based grant configurations for LF-Tag-based access control.

    Settings

    Member Visibility

    On This Page

    Properties