El contenido no se encuentra disponible en el idioma seleccionado. Estamos trabajando continuamente para agregar más idiomas. Gracias por su apoyo.
- What's New
- Function Overview
- Service Overview
- Getting Started
- User Guide
- Best Practices
- Developer Guide
-
API Reference
- Before You Start
- API Overview
- API Calling
-
API
-
Console
- Instance Management
- Job Management
-
Service Authorization Management
- Granting Permissions for Accessing Other Cloud Services
- Querying Cloud Service Access Permissions
- Registering a Tenant Agreement
- Querying whether a Tenant Has Registered an Agreement
- Deleting a Tenant Agreement
- Registering a Tenant Agreement
- Querying whether a Tenant Has Registered an Agreement
- Deleting a Tenant Agreement
- Querying the Current System Agreement
- OBS Management
- Access Management
- Specification Management
- Quota Management Service
- Tag Management Service
- Agency Management
- Alarm Management
- Metadata Management
- Location
-
LakeCat
- Function Management
- Catalog Management
- Database Management
- Table Management
- Data Table Statistics
- Zone-based Management
- Partition Statistics
- Authorization Management
- User Group Management
- Metadata Statistics
-
Role Management
- Creating a Role
- Listing Roles on Different Pages by Condition
- Deleting a Role
- Obtaining a Role
- Modifying a Role
- Listing All Role Names
- Querying the Users or User groups Under a Role
- Adding One or More Users or User Groups to a Role
- Removing One or More Users or User Groups from a Role
- Updating the Entities in a Role
- Credential Management
- Configuration Management
- User
-
Console
- Application Examples
- Permissions and Supported Actions
- Appendix
- FAQs
- General Reference
Show all
Copied.
LakeFormation Permission Overview
LakeFormation uses a combination of coarse-grained Identity and Access Management (IAM) permissions and fine-grained LakeFormation permissions to manage metadata and data permissions for fine-grained access control.
- Coarse-grained IAM permissions are broad permissions on various operations. For instance, it is recommended to use lakeformation:*:create (permission to create all LakeFormation metadata) instead of lakeformation:table:create (permission to create LakeFormation data tables) to control users' ability to create tables. Additionally, use the fine-grained LakeFormation permission CREATE_TABLE to determine whether a user can create table metadata within a database.
- Fine-grained LakeFormation permissions grant access to metadata, OBS paths, and the data within them to entities, including users, user groups, and roles.
The IAM permission model consists of IAM policies. The LakeFormation permission model uses the permission entities, authorization objects, and permission composition defined by LakeFormation. For details, see Basic Concepts.
When a user requests access to metadata or data, the request must pass the permission checks of both IAM and LakeFormation.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
