Add ABAC permissions to LakeFormation Data

Question

Hello! 👋 I've recently noticed it's now possible to grant permissions to AWS Glue tables via Lake Formation using principal attributes

I tested this successfully through the AWS Console UI:

![Grant Permissions ABAC](/media/postImages/original/IMBbELZZbHTJOnePWDQcRzYQ)

![Table Permissions](/media/postImages/original/IMdIZT14LLRp2whfLzDJwy9w)

Now I’m trying to replicate it using Boto3, but I'm running into issues despite following the official docs:

[LakeFormation batch_grant_permissions](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/lakeformation/client/batch_grant_permissions.html)

> Condition (dict) – A Lake Formation condition, which applies to permissions and opt-ins that contain an expression. Expression (string) – An expression written based on the Cedar Policy Language used to match the principal attributes.

I am not getting any error but no  new permissions are being added to "AllIAMPrincipals"

```
    entries = [
        {
            'Id': f'ReadOnly-{database}-{table_name}',
            'Principal': { # Do i have to set a Principal?
            },
            'Resource': {
                'Table': {
                    'DatabaseName': database,
                    'Name': table_name
                }
            },
            'Permissions': ['SELECT', 'DESCRIBE'],
            'PermissionsWithGrantOption': ['SELECT', 'DESCRIBE'],
            'Condition': {
                # Is this the correct syntaxis? I took the Image above lines as an example
                'Expression': 'context.iam.principalTags.hasTag("accesMode") && context.iam.principalTags.getTag("accesMode") == "readOnly"'
            }
        }
    ]

lf.batch_grant_permissions(CatalogId=account_id, Entries=entries)
```

SergiVilla · Accepted Answer

Hello! I finally got the correct syntax from AWS Support. I needed to specify the catalog ID and use the string 'IAMPrincipals' in the Principal field

```
    entries = [
        {
            'Id': f'ReadOnly-{database}-{table_name}',
            'Principal': {'DataLakeIdentifier': f'{catalog_id}:IAMPrincipals'},
            'Resource': {
                'Table': {
                    'CatalogId': catalog_id,
                    'DatabaseName': database,
                    'Name': table_name
                }
            },
            'Permissions': ['SELECT', 'DESCRIBE'],
            # 'PermissionsWithGrantOption': ['SELECT', 'DESCRIBE'],
            'Condition': {
                'Expression': f'context.iam.principalTags.hasTag("{session_tag_key}") && context.iam.principalTags.getTag("{session_tag_key}") == "{session_tag_value}"'
            }
        }
    ]

```

re:Post Agent · Answer

To grant permissions using attribute-based access control (ABAC) in AWS Lake Formation via Boto3, you need to make a few adjustments to your code.

When using ABAC in Lake Formation, you need to specify that you're using attribute-based access control by including a special principal type. Your current code is missing this specification.

Here's how you should structure your batch_grant_permissions call:

```python
entries = [
{
'Id': f'ReadOnly-{database}-{table_name}',
'Principal': {
'DataLakePrincipalIdentifier': 'IAM_ALLOWED_PRINCIPALS'
},
'Resource': {
'Table': {
'DatabaseName': database,
'Name': table_name
}
},
'Permissions': ['SELECT', 'DESCRIBE'],
'PermissionsWithGrantOption': ['SELECT', 'DESCRIBE'],
'Condition': {
'Expression': 'context.iam.principalTags.hasTag("accesMode") && context.iam.principalTags.getTag("accesMode") == "readOnly"'
}
}
]

lf.batch_grant_permissions(CatalogId=account_id, Entries=entries)
```
Addressing you queries below:
========================

->Do i have to set a Principal?
Yes, you have to set a Principal.

->Is this the correct syntaxis?
Yes, the syntax looks correct.

For your queries, you can refer to the document attached below.
[+] https://docs.aws.amazon.com/lake-formation/latest/APIReference/API_GrantPermissions.html

As mentioned above, the key difference is setting the Principal with an `Principal` with `DataLakePrincipalIdentifier` set to `'IAM_ALLOWED_PRINCIPALS'`. This special identifier is used when you're applying attribute-based conditions.

Your Cedar policy expression looks correct, checking if the principal has a tag "accesMode" with the value "readOnly".

Before implementing ABAC in Lake Formation, ensure you've completed these prerequisites:
1. Updated the Data Catalog settings to enable Lake Formation permissions for Data Catalog objects
2. Set the cross-account version settings to two or higher
3. Attached the appropriate attributes (tags) to the IAM entities that require access
4. Verified you have the required permissions to grant access on Data Catalog objects

With ABAC, any IAM principal with matching tag keys and values will automatically gain access to the resource, making permission management more efficient as your user base grows.

**Sources**  
==========

[Prerequisites for granting permissions using attributes - AWS Lake Formation](https://docs.aws.amazon.com/lake-formation/latest/dg/abac-prerequisites.html)

[Attribute-based access control - AWS Lake Formation](https://docs.aws.amazon.com/lake-formation/latest/dg/attribute-based-access-control.html)

[Granting permissions using attribute-based access control - AWS Lake Formation](https://docs.aws.amazon.com/lake-formation/latest/dg/abac-granting-permissions.html)

[Lake Formation examples using AWS CLI](https://docs.aws.amazon.com/code-library/latest/ug/cli_2_lakeformation_code_examples.html)

[grant-permissions] (https://docs.aws.amazon.com/cli/latest/reference/lakeformation/grant-permissions.html)

Add ABAC permissions to LakeFormation Data

Addressing you queries below:

Sources

Add your answer

Relevant content