How to grant LakeFormation permission to s3 tables data lake?

We are currently achieving this with (Python), e.g. (in stack code)::

        lakeformation.CfnPermissions(
            self,
            f"{data_product_table_name}-lf-permissions-for-firehose",
            permissions=["ALL"],
            permissions_with_grant_option=[],
            data_lake_principal=lakeformation.CfnPermissions.___(
                data_lake_principal_identifier=<principal_arn>
            ),
            resource=lakeformation.CfnPermissions.ResourceProperty(
                table_resource=lakeformation.CfnPermissions.TableResourceProperty(
                    catalog_id=f"{Aws.ACCOUNT_ID}:s3tablescatalog/{iceberg_bucket_name}",
                    database_name={data_product_namespace_name},
                    name={data_product_table_name},
                )
            ),
        )

And it accepts it the catalog ID. Not all interfaces accommodate this yet. CfnPrincipalPermissions does not appear to, currently.

Hello,

The S3 Tables feature, which was announced as a new open table format for organizing data in Amazon S3, introduces a specialized catalog identifier format that differs from the traditional numeric account ID format that CDK Lake Formation constructs expect. When you attempt to reference an S3 Tables catalog in your CDK Lake Formation permissions, the CDK validation layer rejects the non-standard catalog ID format, resulting in the properties validation failure you're experiencing.

In standard Lake Formation implementations, the catalog ID parameter expects your 12-digit AWS account ID in numeric format. However, S3 Tables catalogs use a different identifier structure that the current CDK Lake Formation constructs cannot recognize or validate properly.

I recommend subscribing to the AWS CDK GitHub repository (1) to stay informed about new releases and feature announcements. Additionally, you can track the AWS What's New announcements (2) for updates on both S3 Tables and CDK feature releases.

Regarding, the Access Denied, when you put Catalog ID it will refer to the Database in AWS Glue Data Catalog or shared database through Lake Formation. As a result, if there is no database, then you would get 'Database not found' error.

References:

1. AWS CDK GitHub Repository: https://github.com/aws/aws-cdk
2. AWS What's New: https://aws.amazon.com/new/

To grant Lake Formation permissions to S3 Tables, you need to use the AWS CLI or Lake Formation console rather than trying to use CDK with CfnPrincipalPermissions. The issue you're encountering is because the S3 Tables catalog has a special format that the CDK construct doesn't currently support properly.

For S3 Tables, you need to grant permissions using the AWS CLI. Here's how to do it:

1. Make sure you're running the commands as a data lake administrator.

2. Use the following AWS CLI command to grant Lake Formation permissions on a table in an S3 table bucket:

aws lakeformation grant-permissions \
--region us-east-1 \
--cli-input-json \
'{
"Principal": {
"DataLakePrincipalIdentifier": "your-role-arn"
},
"Resource": {
"Table": {
"CatalogId": "account-id:s3tablescatalog/your-table-bucket-name",
"DatabaseName": "your-namespace-name",
"Name": "your-table-name"
}
},
"Permissions": [
"ALL"
]
}'

Alternatively, you can use the Lake Formation console:

1. Navigate to the Lake Formation service in the AWS Management Console
2. Select "Data permissions" > "Grant"
3. In the Principals section, select the appropriate principal type and add your role ARN
4. Select "Named Data Catalog Resources" and choose the S3 Tables catalog, database, and table
5. Select the permissions you want to grant
6. Click "Grant"

Since the CDK construct doesn't properly support the S3 Tables catalog format, you might need to handle this permission granting as a post-deployment step using custom resources or AWS CLI commands in your deployment pipeline.
Sources
Using Amazon S3 Tables with AWS analytics services - Amazon Simple Storage Service
Stream data from Amazon MSK to Apache Iceberg tables in Amazon S3 and Amazon S3 Tables using Amazon Data Firehose | AWS Big Data Blog