AWS lake-formation documentation change

Service: lake-formation · 2025-04-18 · Documentation low

File: lake-formation/latest/dg/granting-multi-catalog-permissions.md

Summary

Updated documentation to introduce attribute-based permissions using IAM tags, renamed UI elements from 'Data lake permissions' to 'Data permissions', and added details about principal type selection (specific principals vs. attribute-based access)

Security assessment

The changes introduce attribute-based access control using IAM role/session tags, which is a security feature enhancement. However, there's no evidence this addresses a specific vulnerability or security incident - it appears to document new RBAC capabilities rather than fix a security issue.

Diff

diff --git a/lake-formation/latest/dg/granting-multi-catalog-permissions.md b/lake-formation/latest/dg/granting-multi-catalog-permissions.md
index 943dc53ea..78ad4afc1 100644
--- a//lake-formation/latest/dg/granting-multi-catalog-permissions.md
+++ b//lake-formation/latest/dg/granting-multi-catalog-permissions.md
@@ -12 +12 @@ Console
-Use the **Grant data lake permissions** page on the Lake Formation console. The page is divided into the following sections:
+Use the **Grant permissions** page on the Lake Formation console. The page is divided into the following sections:
@@ -14 +14 @@ Use the **Grant data lake permissions** page on the Lake Formation console. The
-  * **Principals** – You can grant permissions to specific principals.
+  * **Principal type** – You can grant permissions to specific principals or use attribute tags.
@@ -17,0 +18,2 @@ Use the **Grant data lake permissions** page on the Lake Formation console. The
+Principal by attributes – Add tag key-value pairs from IAMroles or IAM session tags. Principals with matching attributes receive access to the specified resource. 
+
@@ -29 +31 @@ To grant permissions on a database resource link, see [Granting resource link pe
-  1. Open the **Grant data lake permissions** page.
+  1. Open the **Grant permissions** page.
@@ -31 +33 @@ To grant permissions on a database resource link, see [Granting resource link pe
-Open the AWS Lake Formation console at [https://console.aws.amazon.com/lakeformation/](https://console.aws.amazon.com/lakeformation/), and sign in as a data lake administrator, the database creator, or an IAM user who has **Grantable permissions** on the database.
+Open the AWS Lake Formation console at [https://console.aws.amazon.com/lakeformation/](https://console.aws.amazon.com/lakeformation/), and sign in as a data lake administrator, the catalog creator, or an IAM user who has **Grantable permissions** on the catalog.
@@ -35 +37 @@ Do one of the following:
-     * In the navigation pane, under **Permissions** , choose **Data lake permissions**. Then choose **Grant**.
+     * In the navigation pane, under **Permissions** , choose **Data permissions**. Then choose **Grant**.
@@ -41 +43,3 @@ Do one of the following:
-You can grant permissions on a catalog through its resource link. To do so, on the **catalogs** page, choose a catalog link container, and on the **Actions** menu, choose **Grant on target**. For more information, see [How resource links work in Lake Formation](./resource-links-about.html).
+You can grant permissions on a catalog through its resource link. To do so, on the **Catalogs** page, choose a catalog link container, and on the **Actions** menu, choose **Grant on target**. For more information, see [How resource links work in Lake Formation](./resource-links-about.html).
+
+  2. Next, in the **Principal type** section, choose principals or specify attributes attached to the principals.
@@ -43 +47 @@ You can grant permissions on a catalog through its resource link. To do so, on t
-  2. Next, in the **Principals** section, choose a principals.
+![The principal type section contains two tiles arranged horizontally, where each tile contains an option button and descriptive text. The options are Principals and Principals by attributes.Below the title are the principals.](/images/lake-formation/latest/dg/images/grant-catalog-principal-type.png)
@@ -76,0 +81,12 @@ An organizational unit ID starts with "ou-" followed by 4–32 lowercase letters
+###### **Principals by attributes**
+
+**Attributes**
+    
+
+Add the IAM tag key-value pairs from the IAM role. 
+
+**Permission scope**
+    
+
+Specify if you're granting permissions to principals with matching attributes in the same account or in another account.
+
@@ -85 +101 @@ An organizational unit ID starts with "ou-" followed by 4–32 lowercase letters
-![The Permissions section contains two tiles, arranged horizontally. Each tile contains a option button and text. The Catalog permissions tile is selected. The other tile, Column-based permissions, is disabled, because it relates to table permissions. Below the tiles is a group of check boxes for database permissions to grant. Check boxes include Create Table, Alter, Drop, Describe, and Super. Below that group is another group of the same check boxes for grantable permissions.](/images/lake-formation/latest/dg/images/grant-target-catalog-permissions-section.png)
+![The Permissions section the catalog permissions tile. Below the tiles is a group of check boxes for catalog permissions to grant. Check boxes include Super user, Create catalog, Create database, Alter, Drop, Describe, and Super. Below that group is another group of the same check boxes for grantable permissions.](/images/lake-formation/latest/dg/images/grant-target-catalog-permissions-section.png)
@@ -96,0 +113,2 @@ After granting `Create database` or `Alter` on a catalog that has a location pro
+The **Data permissions** page shows the permission details. If you used **Principals by attribute** option to grant permissions, you can view the permission grant to `ALLPrincipals` in the list.
+