Enforcing Lake formation permissions

To enforce Lake Formation permissions for all users in your account, you need to follow these steps:

1. First, ensure all users who need access to your data lake have the necessary IAM permissions. Create and attach the following policy named LakeFormationDataAccess to every user:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "LakeFormationDataAccess",
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": "*"
}
]
}

2. Switch your data stores to the Lake Formation permissions model. This involves registering the Amazon S3 locations of your databases or tables with Lake Formation.

3. Verify that the Super permission to the IAMAllowedPrincipals group exists on the databases and tables for which you registered the data location.

4. Grant specific Lake Formation permissions to users using GRANT/REVOKE commands (like Grant SELECT on tableName to userName). Remember that Lake Formation uses a combination of Lake Formation permissions and IAM permissions.

5. For users who will be granting or revoking permissions using the Lake Formation console, ensure they have the appropriate IAM permissions including:

• lakeformation:ListPermissions
• lakeformation:GrantPermissions
• lakeformation:RevokePermissions
• Various glue: permissions for accessing catalog resources
• iam:ListUsers and iam:ListRoles

6. If you want to use hybrid access mode (which allows you to enable Lake Formation permissions for specific users without interrupting existing workloads), you can opt in specific principals by enabling the option "Make Lake Formation permissions effective immediately" in the Lake Formation console.

Remember that for a request to succeed, it must pass permission checks by both IAM and Lake Formation. Lake Formation permissions control access to Data Catalog resources and underlying data, while IAM permissions control access to the Lake Formation and AWS Glue APIs.
Sources
Upgrading AWS Glue data permissions to the AWS Lake Formation model - AWS Lake Formation
Overview of Lake Formation permissions - AWS Lake Formation
IAM permissions required to grant or revoke Lake Formation permissions - AWS Lake Formation
Sharing an AWS Glue resource using hybrid access mode - AWS Lake Formation