AWS.LakeFormation reference

DataCellsFilter

Source: src/AWS/LakeFormation/DataCellsFilter.ts

A Lake Formation data cells filter — row- and column-level security on a Glue table. Grant SELECT on the filter (via Resource.DataCellsFilter) to give principals access to only the filtered cells.

Creating filters requires SELECT with the grant option on the table (or data lake administrator) — see AWS.LakeFormation.DataLakeSettings.

DataCellsFilter: Creating Data Cells Filters

Column Filter Hiding PII

import * as AWS from "alchemy/AWS";

const filter = yield* AWS.LakeFormation.DataCellsFilter("NoPii", {
  databaseName: database.databaseName,
  tableName: table.tableName,
  excludedColumnNames: ["email", "ssn"],
});

Row Filter by Country

const filter = yield* AWS.LakeFormation.DataCellsFilter("UsOnly", {
  databaseName: database.databaseName,
  tableName: table.tableName,
  rowFilter: { filterExpression: "country = 'US'" },
});

DataLakeSettings

Source: src/AWS/LakeFormation/DataLakeSettings.ts

The Lake Formation data lake settings for the account — an account/region singleton controlling who the data lake administrators are, the default permissions for new databases/tables, and external data filtering.

The resource is capture-and-restore: the pre-existing settings are snapshotted the first time it reconciles, admin lists are managed additively (existing admins are never removed), and destroy puts back what was there before for everything this resource managed.

DataLakeSettings: Managing Administrators

import * as AWS from "alchemy/AWS";

const settings = yield* AWS.LakeFormation.DataLakeSettings("Settings", {
  dataLakeAdmins: [adminRole.roleArn],
});

DataLakeSettings: Default Permissions

const settings = yield* AWS.LakeFormation.DataLakeSettings("Settings", {
  dataLakeAdmins: [adminRole.roleArn],
  createDatabaseDefaultPermissions: [],
  createTableDefaultPermissions: [],
});

GetDataLakePrincipal

Source: src/AWS/LakeFormation/GetDataLakePrincipal.ts

Runtime binding for lakeformation:GetDataLakePrincipal.

Returns the identity of the calling principal as Lake Formation sees it — useful for logging/auditing which data-lake principal a function acts as. Provide the implementation with Effect.provide(AWS.LakeFormation.GetDataLakePrincipalHttp).

GetDataLakePrincipal: Identifying the Caller

// init — account-level binding takes no resource
const getDataLakePrincipal = yield* AWS.LakeFormation.GetDataLakePrincipal();

// runtime
const { Identity } = yield* getDataLakePrincipal();

GetEffectivePermissionsForPath

Source: src/AWS/LakeFormation/GetEffectivePermissionsForPath.ts

Runtime binding for lakeformation:GetEffectivePermissionsForPath.

Returns the Lake Formation permissions in effect for the databases and tables stored under a registered S3 path — an authorization audit for a data location. Provide the implementation with Effect.provide(AWS.LakeFormation.GetEffectivePermissionsForPathHttp).

GetEffectivePermissionsForPath: Auditing Permissions

// init — account-level binding takes no resource
const getEffectivePermissions =
  yield* AWS.LakeFormation.GetEffectivePermissionsForPath();

// runtime
const { Permissions } = yield* getEffectivePermissions({
  ResourceArn: location.resourceArn,
});

GetLFTag

Source: src/AWS/LakeFormation/GetLFTag.ts

Runtime binding for lakeformation:GetLFTag.

Reads one LF-tag definition (its allowed values) by key. Provide the implementation with Effect.provide(AWS.LakeFormation.GetLFTagHttp).

GetLFTag: Reading LF-Tags

// init — account-level binding takes no resource
const getLFTag = yield* AWS.LakeFormation.GetLFTag();

// runtime
const { TagValues } = yield* getLFTag({ TagKey: "environment" });

GetResourceLFTags

Source: src/AWS/LakeFormation/GetResourceLFTags.ts

Runtime binding for lakeformation:GetResourceLFTags.

Reads the LF-tags attached to a Data Catalog resource (database, table, or columns) — lets a function make tag-driven decisions about the data it touches. Provide the implementation with Effect.provide(AWS.LakeFormation.GetResourceLFTagsHttp).

GetResourceLFTags: Reading LF-Tags

// init — account-level binding takes no resource
const getResourceLFTags = yield* AWS.LakeFormation.GetResourceLFTags();

// runtime
const { LFTagOnDatabase } = yield* getResourceLFTags({
  Resource: { Database: { Name: database.databaseName } },
});

GetTemporaryDataLocationCredentials

Source: src/AWS/LakeFormation/GetTemporaryDataLocationCredentials.ts

Runtime binding for lakeformation:GetDataAccess (data-location scope).

Vends temporary S3 credentials for registered data locations the caller holds DATA_LOCATION_ACCESS on. The returned credentials’ SecretAccessKey and SessionToken are Redacted. Provide the implementation with Effect.provide(AWS.LakeFormation.GetTemporaryDataLocationCredentialsHttp).

GetTemporaryDataLocationCredentials: Vending Data Access Credentials

// init — account-level binding takes no resource
const getLocationCredentials =
  yield* AWS.LakeFormation.GetTemporaryDataLocationCredentials();

// runtime
const { Credentials } = yield* getLocationCredentials({
  DataLocations: [location.resourceArn],
  CredentialsScope: "READ",
});

GetTemporaryGluePartitionCredentials

Source: src/AWS/LakeFormation/GetTemporaryGluePartitionCredentials.ts

Runtime binding for lakeformation:GetDataAccess (partition scope).

Identical to GetTemporaryGlueTableCredentials but scoped down to a single partition’s S3 prefix. The returned SecretAccessKey and SessionToken are Redacted. Provide the implementation with Effect.provide(AWS.LakeFormation.GetTemporaryGluePartitionCredentialsHttp).

GetTemporaryGluePartitionCredentials: Vending Data Access Credentials

// init — account-level binding takes no resource
const getPartitionCredentials =
  yield* AWS.LakeFormation.GetTemporaryGluePartitionCredentials();

// runtime
const credentials = yield* getPartitionCredentials({
  TableArn: table.tableArn,
  Partition: { Values: ["2026-07-14"] },
  Permissions: ["SELECT"],
});

GetTemporaryGlueTableCredentials

Source: src/AWS/LakeFormation/GetTemporaryGlueTableCredentials.ts

Runtime binding for lakeformation:GetDataAccess (table scope).

Vends temporary S3 credentials scoped down to the storage of one Glue table, enforcing the caller’s Lake Formation grants — the credential vending API used by query engines. The returned SecretAccessKey and SessionToken are Redacted. Provide the implementation with Effect.provide(AWS.LakeFormation.GetTemporaryGlueTableCredentialsHttp).

GetTemporaryGlueTableCredentials: Vending Data Access Credentials

// init — account-level binding takes no resource
const getTableCredentials =
  yield* AWS.LakeFormation.GetTemporaryGlueTableCredentials();

// runtime
const credentials = yield* getTableCredentials({
  TableArn: table.tableArn,
  Permissions: ["SELECT"],
  SupportedPermissionTypes: ["COLUMN_PERMISSION"],
});
const secret = Redacted.value(credentials.SecretAccessKey!);

LFTag

Source: src/AWS/LakeFormation/LFTag.ts

A Lake Formation LF-tag definition — a key with a list of allowed values used for tag-based access control (attach values to databases/tables with AWS.LakeFormation.LFTagAssociation, grant on expressions with AWS.LakeFormation.Permissions).

Creating LF-tags requires the caller to be a data lake administrator — see AWS.LakeFormation.DataLakeSettings.

LFTag: Creating LF-Tags

import * as AWS from "alchemy/AWS";

const envTag = yield* AWS.LakeFormation.LFTag("EnvTag", {
  tagKey: "environment",
  tagValues: ["dev", "staging", "prod"],
});

LFTagAssociation

Source: src/AWS/LakeFormation/LFTagAssociation.ts

Attaches LF-tag values to a Data Catalog resource (database, table, or columns) for Lake Formation tag-based access control.

Requires the caller to be a data lake administrator (or hold ASSOCIATE on the LF-tags) — see AWS.LakeFormation.DataLakeSettings.

LFTagAssociation: Tagging Resources

Tag a Database

import * as AWS from "alchemy/AWS";

const association = yield* AWS.LakeFormation.LFTagAssociation("DbEnvTag", {
  resource: { database: { name: database.databaseName } },
  lfTags: [{ tagKey: envTag.tagKey, tagValues: ["prod"] }],
});

Tag a Table

const association = yield* AWS.LakeFormation.LFTagAssociation("TableTag", {
  resource: {
    table: { databaseName: database.databaseName, name: "events" },
  },
  lfTags: [{ tagKey: envTag.tagKey, tagValues: ["dev"] }],
});

LFTagExpression

Source: src/AWS/LakeFormation/LFTagExpression.ts

A named Lake Formation LF-tag expression — a reusable, saved combination of LF-tag conditions that can be referenced from permission grants (Resource.LFTagExpression) instead of repeating the raw expression.

Creating LF-tag expressions requires CREATE_LF_TAG_EXPRESSION on the catalog (data lake administrators have it) plus GRANT_WITH_LF_TAG_EXPRESSION on the underlying LF-tag pairs — see AWS.LakeFormation.DataLakeSettings.

LFTagExpression: Creating LF-Tag Expressions

import * as AWS from "alchemy/AWS";

const tag = yield* AWS.LakeFormation.LFTag("EnvTag", {
  tagKey: "environment",
  tagValues: ["dev", "prod"],
});
const expression = yield* AWS.LakeFormation.LFTagExpression("ProdData", {
  name: "prod-data",
  description: "All resources tagged environment=prod",
  expression: [{ tagKey: tag.tagKey, tagValues: ["prod"] }],
});

ListLFTags

Source: src/AWS/LakeFormation/ListLFTags.ts

Runtime binding for lakeformation:ListLFTags.

Lists the LF-tag definitions visible to the caller. Provide the implementation with Effect.provide(AWS.LakeFormation.ListLFTagsHttp).

ListLFTags: Reading LF-Tags

// init — account-level binding takes no resource
const listLFTags = yield* AWS.LakeFormation.ListLFTags();

// runtime
const { LFTags } = yield* listLFTags();

ListPermissions

Source: src/AWS/LakeFormation/ListPermissions.ts

Runtime binding for lakeformation:ListPermissions.

Lists the Lake Formation permission grants visible to the caller, optionally filtered by principal or resource — runtime authorization introspection. Provide the implementation with Effect.provide(AWS.LakeFormation.ListPermissionsHttp).

ListPermissions: Auditing Permissions

// init — account-level binding takes no resource
const listPermissions = yield* AWS.LakeFormation.ListPermissions();

// runtime
const { PrincipalResourcePermissions } = yield* listPermissions({
  Resource: { Database: { Name: database.databaseName } },
});

OptIn

Source: src/AWS/LakeFormation/OptIn.ts

A Lake Formation opt-in — enforces Lake Formation permissions for one principal on one Data Catalog resource while the account is in hybrid access mode (where IAM/S3 policies otherwise govern access).

OptIn: Opting Into Lake Formation Enforcement

import * as AWS from "alchemy/AWS";

const optIn = yield* AWS.LakeFormation.OptIn("AnalystOptIn", {
  principal: analystRole.roleArn,
  resource: { database: { name: database.databaseName } },
});

Permissions

Source: src/AWS/LakeFormation/Permissions.ts

A Lake Formation permission grant — gives a principal permissions on a Data Catalog resource (database, table, data location, LF-tag, or LF-tag policy expression). The resource owns the full permission set for its principal/resource pair: permissions removed from the props are revoked.

The caller must be a Lake Formation data lake administrator (or hold the grant option on the resource) — see AWS.LakeFormation.DataLakeSettings.

Permissions: Granting Permissions

Grant Database Permissions to a Role

import * as AWS from "alchemy/AWS";

const database = yield* AWS.Glue.Database("Analytics", {});
const grant = yield* AWS.LakeFormation.Permissions("AnalystDbAccess", {
  principal: analystRole.roleArn,
  resource: { database: { name: database.databaseName } },
  permissions: ["DESCRIBE", "CREATE_TABLE"],
});

Grant Table Select with Grant Option

const grant = yield* AWS.LakeFormation.Permissions("AnalystTableAccess", {
  principal: analystRole.roleArn,
  resource: {
    table: { databaseName: database.databaseName, tableWildcard: true },
  },
  permissions: ["SELECT", "DESCRIBE"],
  permissionsWithGrantOption: ["SELECT"],
});

Grant Data Location Access

const grant = yield* AWS.LakeFormation.Permissions("EtlLocationAccess", {
  principal: etlRole.roleArn,
  resource: { dataLocation: { resourceArn: location.resourceArn } },
  permissions: ["DATA_LOCATION_ACCESS"],
});

Resource

Source: src/AWS/LakeFormation/Resource.ts

Registers an S3 location as managed by AWS Lake Formation, so Lake Formation can vend temporary credentials for data stored there (DATA_LOCATION_ACCESS grants, governed tables, etc.).

Resource: Registering Locations

Register a Bucket with the Service-Linked Role

import * as AWS from "alchemy/AWS";

const bucket = yield* AWS.S3.Bucket("DataLake", {});
const location = yield* AWS.LakeFormation.Resource("DataLakeLocation", {
  resourceArn: bucket.bucketArn,
});

Register with a Custom Data-Access Role

const location = yield* AWS.LakeFormation.Resource("DataLakeLocation", {
  resourceArn: bucket.bucketArn,
  roleArn: dataAccessRole.roleArn,
  hybridAccessEnabled: true,
});

SearchDatabasesByLFTags

Source: src/AWS/LakeFormation/SearchDatabasesByLFTags.ts

Runtime binding for lakeformation:SearchDatabasesByLFTags.

Finds Glue databases whose LF-tags match an expression — tag-driven data discovery at runtime. Provide the implementation with Effect.provide(AWS.LakeFormation.SearchDatabasesByLFTagsHttp).

SearchDatabasesByLFTags: Searching by LF-Tags

// init — account-level binding takes no resource
const searchDatabases = yield* AWS.LakeFormation.SearchDatabasesByLFTags();

// runtime
const { DatabaseList } = yield* searchDatabases({
  Expression: [{ TagKey: "environment", TagValues: ["prod"] }],
});

SearchTablesByLFTags

Source: src/AWS/LakeFormation/SearchTablesByLFTags.ts

Runtime binding for lakeformation:SearchTablesByLFTags.

Finds Glue tables whose LF-tags match an expression — tag-driven data discovery at runtime. Provide the implementation with Effect.provide(AWS.LakeFormation.SearchTablesByLFTagsHttp).

SearchTablesByLFTags: Searching by LF-Tags

// init — account-level binding takes no resource
const searchTables = yield* AWS.LakeFormation.SearchTablesByLFTags();

// runtime
const { TableList } = yield* searchTables({
  Expression: [{ TagKey: "classification", TagValues: ["pii"] }],
});