IAM Permissions

IAM Overview

If you need to assign different permissions to employees in your enterprise to access your LakeFormation resources, IAM is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you secure access to your Huawei Cloud resources.

With IAM, you can create IAM users for your employees, and assign permissions to these users to control their access to specific resource types. For example, if you want them to use LakeFormation but must not delete the databases or perform any high-risk operations, you can create IAM users and grant them only the permissions to query LakeFormation instances but not to delete them.

If your Huawei Cloud account does not need individual IAM users for permission management, you may skip this section.

IAM is a free service. You only pay for the resources in your account. For more information about IAM, see What Is IAM?

IAM Permissions

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.

LakeFormation permissions are assigned to users in the global project, and users do not need to switch regions when accessing OBS.

You can grant permissions by using roles and policies.

Roles: A coarse-grained authorization mechanism provided by IAM to define permissions based on job responsibilities. Only a limited number of service-level roles are available for authorization. When using roles to grant permissions, you also need to assign the roles that the permissions depend on. Roles are not ideal for fine-grained authorization and least privilege access.
Policies: A fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This type of authorization is more flexible and is ideal for secure access control. For example, you can grant users only permission to manage cloud servers of a certain type.

IAM System Policies

Table 1 lists the default system policies of LakeFormation.

**Table 1** LakeFormation system policies
Role/Policy Name	Description	Type	Dependency
LakeFormation FullAccess	Administrator permissions for LakeFormation. Users granted these permissions can use all LakeFormation functions.	System policy	IAM AgencyFullAccess OBS OperateAccess VPC FullAccess VPCEndpoint FullAccess
LakeFormation ReadOnlyAccess	Read-only permissions for LakeFormation. Users granted these permissions can query LakeFormation data.	System policy	IAM ReadOnlyAccess OBS ReadOnlyAccess VPC ReadOnlyAccess VPCEndpoint ReadOnlyAccess
LakeFormation CommonOperations	Basic permissions for LakeFormation, including viewing, authorizing, and canceling the LakeFormation service agreement and basic permissions for dependent services such as OBS and TMS.	System policy	IAM ReadOnlyAccess OBS ReadOnlyAccess VPC FullAccess VPCEndpoint FullAccess

Table 2 lists the common operations supported by each system policy or role of LakeFormation. Select the permissions as needed.

**Table 2** Common operations supported by each LakeFormation system policy
Operation	LakeFormation FullAccess	LakeFormation CommonOperations	LakeFormation ReadOnlyAccess
Querying a LakeFormation instance	√	√	√
Creating a LakeFormation instance	√	x	x
Modifying a LakeFormation instance	√	√	x
Deleting a LakeFormation instance	√	x	x
Restoring a LakeFormation instance	√	x	x
Listing all tags of a tenant	√	√	√
Updating tags of a LakeFormation instance	√	√	x
Creating a metadata migration/discovery task	√	√	x
Creating a metadata migration/discovery task	√	√	x
Deleting a metadata migration or discovery task	√	√	x
Querying a metadata migration or discovery task	√	√	√
Querying metadata migration/discovery task logs	√	√	√
Running or stopping a metadata migration or discovery task	√	√	x
Agreeing to the user agreement	√	√	√
Querying the user agreement	√	√	√
Querying the user agreement	√	√	√
Authorizing LakeFormation to create an agency	√	x	x
Querying the agency created by LakeFormation	√	√	√
Deleting an agency created by LakeFormation	√	x	x
Authorizing a resource	√	x	x
Querying authorized resources	√	√	√
Canceling resource authorization	√	x	x
Querying OBS buckets	√	√	√
Querying OBS bucket objects	√	√	√
Creating a client for service access	√	√	x
Querying the client for service access	√	√	√
Deleting the client for service access	√	√	x
Subscribing to metadata events	√	√	x
Unsubscribing from metadata events	√	√	x
Querying metadata events	√	√	√
Querying catalog metadata	√	√	√
Creating catalog metadata	√	√	x
Modifying catalog metadata	√	√	x
Deleting catalog metadata	√	√	x
Querying database metadata	√	√	√
Creating database metadata	√	√	x
Modifying database metadata	√	√	x
Deleting database metadata	√	√	x
Querying table metadata	√	√	√
Creating table metadata	√	√	x
Modifying table metadata	√	√	x
Deleting table metadata	√	√	x
Querying partition metadata	√	√	√
Creating partition metadata	√	√	x
Modifying partition metadata	√	√	x
Deleting partition metadata	√	√	x
Querying column statistics	√	√	√
Creating column statistics	√	√	x
Modifying column statistics	√	√	x
Deleting column statistics	√	√	x
Querying function metadata	√	√	√
Querying function metadata	√	√	x
Modifying function metadata	√	√	x
Deleting function metadata	√	√	x
Querying model metadata	√	√	√
Creating model metadata	√	√	x
Modifying model metadata	√	√	x
Deleting model metadata	√	√	x
Querying model file metadata	√	√	√
Creating model file metadata	√	√	x
Modifying model file metadata	√	√	x
Deleting model file metadata	√	√	x
Querying dataset metadata	√	√	√
Creating dataset metadata	√	√	x
Modifying dataset metadata	√	√	x
Deleting dataset metadata	√	√	x
Querying the number of metadata records	√	√	√
Querying an authorization entity	√	√	√
Creating a role	√	√	x
Deleting a role	√	√	x
Modifying a role	√	√	x
Querying a role	√	√	√
Adding a user or user group to a role	√	√	x
Removing a user or user group from a role	√	√	x
Updating the users or user groups in a role	√	√	x
Granting the metadata permission to the authorization entity	√	√	x
Canceling the metadata permission authorization to the authorization entity	√	√	x
Querying authorization information	√	√	√
Obtaining the STS token for accessing data	√	√	x

LakeFormation system policies include the following:

LakeFormation FullAccess

{
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "lakeformation:*:*",
                "vpc:*:get",
                "vpc:*:list",
                "tms:predefineTags:list",
                "obs:bucket:ListAllMyBuckets",
                "obs:bucket:ListBucket",
                "obs:bucket:HeadBucket",
                "obs:object:GetObject"
            ],
            "Effect": "Allow"
        }
    ]
}

LakeFormation CommonOperations

{
	"Version": "1.1",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"lakeformation:*:describe*",
				"lakeformation:*:list*",
				"lakeformation:policy:export",
				"lakeformation:access:create",
				"lakeformation:access:delete",
				"lakeformation:accessAgency:describe",
				"lakeformation:accessService:describe",
				"lakeformation:accessService:grant",
				"lakeformation:accessTenant:grant",
				"lakeformation:agreement:cancel",
				"lakeformation:agreement:describe",
				"lakeformation:agreement:grant",
				"lakeformation:catalog:alter",
				"lakeformation:catalog:create",
				"lakeformation:catalog:drop",
				"lakeformation:database:alter",
				"lakeformation:database:create",
				"lakeformation:database:drop",
				"lakeformation:dataset:alter",
				"lakeformation:dataset:alterFile",
				"lakeformation:dataset:alterFileGroup",
				"lakeformation:dataset:create",
				"lakeformation:dataset:createFile",
				"lakeformation:dataset:createFileGroup",
				"lakeformation:dataset:drop",
				"lakeformation:dataset:dropFile",
				"lakeformation:dataset:dropFileGroup",
				"lakeformation:function:alter",
				"lakeformation:function:create",
				"lakeformation:function:drop",
				"lakeformation:group:alter",
				"lakeformation:instance:access",
				"lakeformation:instance:alter",
				"lakeformation:instanceJob:alter",
				"lakeformation:instanceJob:create",
				"lakeformation:instanceJob:drop",
				"lakeformation:instanceJob:exec",
				"lakeformation:job:alter",
				"lakeformation:job:create",
				"lakeformation:job:drop",
				"lakeformation:job:exec",
				"lakeformation:model:alter",
				"lakeformation:model:alterFile",
				"lakeformation:model:create",
				"lakeformation:model:createFile",
				"lakeformation:model:drop",
				"lakeformation:model:dropFile",
				"lakeformation:policy:create",
				"lakeformation:policy:drop",
				"lakeformation:role:alter",
				"lakeformation:role:create",
				"lakeformation:role:drop",
				"lakeformation:table:alter",
				"lakeformation:table:create",
				"lakeformation:table:drop",
				"lakeformation:transaction:operate",
				"lakeformation:user:alter",
				"vpc:*:get",
				"vpc:*:list",
				"tms:predefineTags:list",
				"obs:bucket:ListAllMyBuckets",
				"obs:bucket:ListBucket",
				"obs:bucket:HeadBucket",
				"obs:object:GetObject"
			]
		}
	]
}

LakeFormation ReadOnlyAccess

{
	"Version": "1.1",
	"Statement": [
		{
			"Action": [
				"lakeformation:*:describe*",
				"lakeformation:*:list*",
				"lakeformation:policy:export",
                                "lakeformation:agreement:cancel",
                                "lakeformation:agreement:describe",
                                "lakeformation:agreement:grant",
				"vpc:*:get",
				"vpc:*:list",
				"tms:predefineTags:list",
				"obs:bucket:ListAllMyBuckets",
				"obs:bucket:ListBucket",
				"obs:bucket:HeadBucket",
				"obs:object:GetObject"
			],
			"Effect": "Allow"
		}
	]
}

IAM permissions of LakeFormation

Table 3 lists all IAM permissions of LakeFormation.

**Table 3** IAM permissions of LakeFormation
Operation Type	Policy	Description
Read-only	lakeformation:access:describe	Querying the access client
Read-only	lakeformation:agency:describe	Querying an agency
Read-only	lakeformation:catalog:describe	Querying catalog metadata
Read-only	lakeformation:configuration:describe	Querying configurations
Read-only	lakeformation:credential:describe	Obtaining authentication information
Read-only	lakeformation:database:describe	Querying database metadata
Read-only	lakeformation:function:describe	Query function metadata.
Read-only	lakeformation:group:describe	Obtaining the relationship between a user group and associated roles
Read-only	lakeformation:instance:describe	Querying an instance
Read-only	lakeformation:instanceJob:describe	Querying an instance-level task
Read-only	lakeformation:job:describe	Querying a task
Read-only	lakeformation:obs:describe	Querying the list of OBS buckets
Read-only	lakeformation:policy:describe	Obtaining a permission policy
Read-only	lakeformation:policy:export	Obtaining permission policies in batches
Read-only	lakeformation:role:describe	Querying a role
Read-only	lakeformation:table:describe	Querying table metadata
Read-only	lakeformation:tag:describe	Querying tags of a resource
Read-only	lakeformation:user:describe	Obtaining relationship between user and associated roles
Read-only	lakeformation:dataset:describe	Querying the metadata of a dataset
Read-only	lakeformation:dataset:describeFile	Querying the metadata of a dataset file
Read-only	lakeformation:dataset:describeFileGroup	Querying the metadata of a dataset file group
Read-only	lakeformation:model:describe	Querying the metadata of a model
Read-only	lakeformation:model:describeFile	Query the metadata of a model file.
Write	lakeformation:access:create	Creating a client for service access
Write	lakeformation:access:delete	Deleting the client for service access
Write	lakeformation:agency:create	Creating an agency
Write	lakeformation:agency:drop	Deleting an agency
Write	lakeformation:catalog:alter	Modifying catalog metadata
Write	lakeformation:catalog:create	Creating catalog metadata
Write	lakeformation:catalog:drop	Deleting catalog metadata
Write	lakeformation:database:alter	Modifying database metadata
Write	lakeformation:database:create	Creating database metadata
Write	lakeformation:database:drop	Deleting database metadata
Write	lakeformation:dataset:create	Creating dataset metadata
Write	lakeformation:file:create	Creating a file
Write	lakeformation:file:drop	Deleting a file
Write	lakeformation:file:alter	Modifying a file
Write	lakeformation:function:alter	Modifying function metadata
Write	lakeformation:function:create	Creating function metadata
Write	lakeformation:function:drop	Deleting function metadata
Write	lakeformation:group:alter	Modifying the relationship between a user group and associated roles
Write	lakeformation:instance:access	Applying for service access
Write	lakeformation:instance:alter	Modifying an instance
Write	lakeformation:instance:create	Creating an instance
Write	lakeformation:instance:drop	Deleting an instance
Write	lakeformation:instanceJob:alter	Modifying an instance-level task
Write	lakeformation:instanceJob:create	Creating an instance-level task
Write	lakeformation:instanceJob:drop	Deleting an instance-level task
Write	lakeformation:instanceJob:exec	Executing an instance-level task
Write	lakeformation:instance:createSubscriber	Creating a metadata event subscriber
Write	lakeformation:instance:deleteSubscriber	Deleting a metadata event subscriber
Write	lakeformation:job:alter	Modifying a non-instance-level task
Write	lakeformation:job:create	Creating a non-instance-level task
Write	lakeformation:job:drop	Deleting a non-instance-level task
Write	lakeformation:job:exec	Executing a non-instance-level task
Write	lakeformation:model:create	Creating model metadata
Write	lakeformation:metadata:restore	Restoring metadata
Write	lakeformation:part:alter	Modifying a partition
Write	lakeformation:part:drop	Deleting a partition
Write	lakeformation:part:create	Creating a partition
Write	lakeformation:policy:create	Creating a permission policy
Write	lakeformation:policy:drop	Deleting a permission policy
Write	lakeformation:role:alter	Modifying the relationship between a role and associated user group
Write	lakeformation:role:create	Creating a role
Write	lakeformation:role:drop	Deleting a role
Write	lakeformation:table:alter	Modifying table metadata
Write	lakeformation:table:create	Creating table metadata
Write	lakeformation:table:drop	Deleting table metadata
Write	lakeformation:tableFile:alter	Modifying a table file
Write	lakeformation:tableFile:create	Creating a table file
Write	lakeformation:tableFile:drop	Deleting a table file
Write	lakeformation:tableFileGroup:alter	Modifying the metadata of the table file group
Write	lakeformation:tableFileGroup:create	Creating the metadata of the table file group
Write	lakeformation:tableFileGroup:drop	Deleting the metadata of a table file group
Write	lakeformation:transaction:operate	Operating transactions
Write	lakeformation:user:alter	Modifying the relationship between a user and associated roles
Permission management	lakeformation:accessService:grant	Authorizing an access service
Permission management	lakeformation:accessTenant:grant	Authorizing an access tenant
Permission management	lakeformation:accessAgency:describe	Querying agency information
Permission management	lakeformation:accessService:describe	Viewing an access service
Permission management	lakeformation:agreement:describe	Querying a service agreement authorization
Permission management	lakeformation:agreement:cancel	Canceling a service agreement authorization
Permission management	lakeformation:agreement:grant	Granting a service agreement authorization
Permission management	lakeformation:instance:authorizeLocation	Authorize an OBS path to LakeFormation
Permission management	lakeformation:instance:cancelAuthorizeLocation	Canceling the authorization of an OBS path
Permission management	lakeformation:policy:delegate	Delegating a permission policy to another authorization entity