MDAA TS Docs
    Preparing search index...

    Interface PrincipalProps

    Defines a Lake Formation principal for grant assignment. Supports federated groups, federated users, and IAM roles as principal types. Federated principals require a matching federationProviderArn.

    Use cases: Federated group access; Individual user permissions; IAM role-based grants; Cross-account principals

    AWS: Lake Formation principals (federated via IAM SAML providers or direct IAM roles)

    Validation: At least one principal type required; federated types require federationProviderArn

    interface PrincipalProps {
        account?: string;
        federatedGroup?: string;
        federatedUser?: string;
        federationProviderArn?: string;
        role?: MdaaRoleRef;
    }
    Index

    Properties

    account? federatedGroup? federatedUser? federationProviderArn? role?

    Properties

    account?: string

    AWS account ID for cross-account principal resolution. Used when the account cannot be determined from the role ARN.

    Use cases: Cross-account grants; Multi-account Lake Formation permissions

    AWS: AWS account ID for principal resolution

    Validation: Optional; 12-digit AWS account ID

    federatedGroup?: string

    Federated group name for group-based Lake Formation permissions. Combined with federationProviderArn to construct the principal identity.

    Use cases: Active Directory group access; Enterprise group-based governance; Team-level data permissions

    AWS: Lake Formation federated group principal via IAM SAML provider

    Validation: Optional; requires federationProviderArn when specified

    federatedUser?: string

    Federated user name for individual Lake Formation permissions. Combined with federationProviderArn to construct the principal identity.

    Use cases: Individual user data access; User-specific permissions; Federated user governance

    AWS: Lake Formation federated user principal via IAM SAML provider

    Validation: Optional; requires federationProviderArn when specified

    federationProviderArn?: string

    IAM federation provider ARN for resolving federated group/user principals. Must reference an existing IAM SAML identity provider.

    Use cases: SAML provider integration; Active Directory federation; External IdP connectivity

    AWS: IAM SAML identity provider ARN (arn:aws:iam::account:saml-provider/name)

    Validation: Optional; required when federatedGroup or federatedUser is specified

    role?: MdaaRoleRef

    IAM role reference for role-based Lake Formation permissions. Can be specified by ARN, name, or SSM parameter reference.

    Use cases: IAM role-based data access; Service role permissions; Cross-account role grants

    AWS: IAM role for Lake Formation grant assignment

    Validation: Optional; valid MdaaRoleRef; mutually exclusive with federated principal types

    Settings

    Member Visibility

    On This Page

    Properties