SparkJob场景的LakeFormation授权
提交SparkJob作业前，需通过委托完成LakeFormation的IAM细粒度授权和SQL资源授权（包括元数据、数据库、表、列和函数），以确保作业在Spark集群后台运行时能够正常访问所需数据。本节介绍SparkJob场景的LakeFormation授权的具体操作。
授权操作
在使用LakeFormation资源前需要分别完成LakeFormation API的授权和LakeFormation SQL资源授权。各SQL语句的权限请参考Paimon、Iceberg、Hive和DataSource。
- 通过委托，授权使用LakeFormation API。
使用SparkJob执行作业时，需要您先在IAM页面创建相关委托，并在配置作业时添加新建的委托信息。委托权限示例请参考创建自定义委托。
- LakeFormation SQL资源授权：授权使用LakeFormation具体资源。
LakeFormation资源授权是指允许用户对特定资源（元数据、数据库、表、列和函数等）访问的权限，以此来控制对LakeFormation数据和元数据的访问。
在LakeFormation管理控制台，对资源授权。SparkJob支持角色和委托两种主体类型。
了解LakeFormation SQL资源权限请参考配置LakeFormation元数据权限。
SQL资源鉴权（LakeFormation鉴权）
- 除了表格内的权限，IAM侧还需要配置lakeformation:credential:describe、lakeformation:function:describe和lakeformation:policy:describe。
- 由于Spark集群启动时默认会校验default数据库，所以在执行任何SQL前，需要在LakeFormation控制台上先为目标Catalog下的default数据库授予DESCRIBE权限，授权操作请参考配置LakeFormation元数据权限。
- 建议不要给lakeformation:policy:create权限，给了会被视为管理员，跳过SQL鉴权。
| 类型 | SQL | LakeFormation SQL资源鉴权权限 | IAM权限 |
|---|---|---|---|
| DDL语句 | ALTER DATABASE | database:DESCRIBE database:ALTER | "lakeformation:database:describe", "lakeformation:database:alter" |
| ALTER TABLE | database:DESCRIBE table:DESCRIBE table:ALTER database:CREATE_TABLE column:SELECT或table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:table:create" | |
| ALTER DATABASE db SET ... | database:DESCRIBE database:ALTER | "lakeformation:database:describe", "lakeformation:database:alter" | |
| ALTER TABLE db.t ADD COLUMN col TYPE | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t RENAME COLUMN col TO col2 | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t DROP COLUMN col | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t ALTER COLUMN col TYPE BIGINT | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t ALTER COLUMN col COMMENT 'desc' | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t ALTER COLUMN col FIRST / AFTER col2 | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t SET TBLPROPERTIES ('k'='v') | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t UNSET TBLPROPERTIES ('k') | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t RENAME TO db.t2 | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t ADD PARTITION (...) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t DROP PARTITION (...) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t CREATE TAG tag_name | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t CREATE TAG IF NOT EXISTS tag_name | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t REPLACE TAG tag_name | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t CREATE OR REPLACE TAG tag_name | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t DELETE TAG tag_name | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t DELETE TAG IF EXISTS tag_name | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE db.t RENAME TAG tag1 TO tag2 | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CREATE DATABASE db | database:DESCRIBE catalog:CREATE_DATABASE | "lakeformation:database:describe", "lakeformation:database:create" | |
| CREATE TABLE db.t USING paimon | database:DESCRIBE database:CREATE_TABLE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create" | |
| CREATE TABLE db.t AS SELECT xx From xx Where | database:DESCRIBE database:CREATE_TABLE table:DESCRIBE table:SELECT column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create", "lakeformation:table:alter" | |
| DROP DATABASE db | database:DESCRIBE database:DROP | "lakeformation:database:describe", "lakeformation:database:drop" | |
| DROP DATABASE db CASCADE | database:DESCRIBE database:DROP table:DROP(库下所有表) | "lakeformation:database:describe", "lakeformation:database:drop", "lakeformation:table:drop" | |
| DROP TABLE db.t | database:DESCRIBE table:DESCRIBE table:DROP | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:drop" | |
| TRUNCATE TABLE db.t | database:DESCRIBE table:DESCRIBE table:SELECT table:ALTER table:UPDATE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| DML语句 | INSERT INTO db.t VALUES/SELECT | table:DESCRIBE table:SELECT table:INSERT database:DESCRIBE table:ALTER column:SELECT | "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:database:describe" |
| INSERT OVERWRITE db.t | table:DESCRIBE table:UPDATE table:SELECT database:DESCRIBE | "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:database:describe" | |
| UPDATE db.t SET col = value WHERE | table:DESCRIBE table:ALTER table:UPDATE table:SELECT column:SELECT database:DESCRIBE | "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:database:describe" | |
| DELETE FROM db.t WHERE | database:DESCRIBE table:DESCRIBE table:ALTER table:DELETE table:SELECT column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| MERGE INTO db.t USING src | database:DESCRIBE table:DESCRIBE table:UPDATE table:SELECT column:SELECT(目标表+源表) | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| DQL语句 | SELECT ... FROM db.t | database:DESCRIBE table:SELECT table:DESCRIBE column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe" |
| SELECT col1, col2 FROM db.t | database:DESCRIBE table:DESCRIBE column:SELECT(col1,col2) | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SELECT * FROM db.t VERSION AS OF 'tag' | database:DESCRIBE table:DESCRIBE column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SELECT * FROM db.t TIMESTAMP AS OF '2024-01-01 12:00:00' | database:DESCRIBE table:DESCRIBE column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe" | |
| EXPLAIN | 取决于执行SQL | 取决于执行SQL | |
| Auxiliary语句 | DESCRIBE DATABASE db | database:DESCRIBE | "lakeformation:database:describe" |
| DESCRIBE TABLE db.t | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| DESCRIBE FORMATTED db.t | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW COLUMNS FROM db.t | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW CREATE TABLE db.t | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW DATABASES | catalog:LIST_DATABASE database:DESCRIBE | "lakeformation:database:describe" | |
| SHOW PARTITIONS db.t | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW TABLE EXTENDED | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW TABLES IN db | database:LIST_TABLE database:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW TBLPROPERTIES db.t | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW TAGS db.t | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| USE db | database:DESCRIBE database:USE | "lakeformation:database:describe" | |
| CALL sys.compact(db.t) | database:DESCRIBE table:DESCRIBE table:UPDATE table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.compact_manifest(db.t) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.expire_snapshots(db.t) | database:DESCRIBE table:DESCRIBE table:DELETE table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.expire_tags(db.t) | database:DESCRIBE table:DESCRIBE table:DELETE table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.expire_partitions(db.t) | database:DESCRIBE table:DESCRIBE table:ALTER table:DELETE table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.remove_orphan_files(db.t) | database:DESCRIBE table:DESCRIBE table:DELETE table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.remove_unexisting_files(db.t) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.repair(db.t) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.refresh_object_table(db.t) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.reset_consumer(db.t, id) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.clear_consumers(db.t) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.mark_partition_done(db.t, p1;p2) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.create_tag(db.t, 'tag') | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.create_tag_from_timestamp(db.t, 'tag', ts) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.replace_tag(db.t, 'tag', snapshot) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.rename_tag(db.t, 'tag', 'new_tag') | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.delete_tag(db.t, 'tag') | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.create_branch(db.t, 'br') | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.delete_branch(db.t, 'br') | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.fast_forward(db.t, 'br') | database:DESCRIBE table:DESCRIBE table:UPDATE table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.rollback(db.t, version/tag/snapshot) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.rollback_to_timestamp(db.t, ts) | database:DESCRIBE table:DESCRIBE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL sys.rollback_to_watermark(db.t, wm) | database:DESCRIBE | "lakeformation:database:describe", | |
| table:DESCRIBE | "lakeformation:table:describe", | ||
| table:ALTER | "lakeformation:table:alter" |
| 分类 | SQL | LakeFormation SQL资源鉴权权限 | IAM权限 |
|---|---|---|---|
| DDL语句 | ALTER DATABASE | database:DESCRIBE database:ALTER | "lakeformation:database:describe", "lakeformation:database:alter" |
| ALTER TABLE | database:DESCRIBE table:DESCRIBE table:ALTER database:CREATE_TABLE column:SELECT或table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:table:create" | |
| ALTER VIEW | database:DESCRIBE database:CREATE_TABLE table:DESCRIBE table:ALTER column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg ALTER COLUMN col TYPE BIGINT | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg ADD PARTITION FIELD col | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg DROP PARTITION FIELD col | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg REPLACE PARTITION FIELD col | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg WRITE writeSpec | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg SET IDENTIFIER_KW FIELDS fieldList | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg DROP IDENTIFIER_KW FIELDS fieldList | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg SET TBLPROPERTIES | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg create/Replace BRANCH Test_branch | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg create/Replace Tag Test_tag | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg DROP BRANCH Test_branch | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| ALTER TABLE Test_Iceberg DROP TAG Test_tag | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| CREATE DATABASE | database:DESCRIBE catalog:CREATE_DATABASE | "lakeformation:database:describe", "lakeformation:database:create" | |
| CREATE TABLE Test_Iceberg USING iceberg | database:DESCRIBE database:CREATE_TABLE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create" | |
| CREATE VIEW | database:DESCRIBE database:CREATE_TABLE table:DESCRIBE（source\target） table:DROP(target) column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create", "lakeformation:table:drop" | |
| CREATE TABLE Test_Iceberg AS SELECT xx From xx Where | table:DESCRIBE table:ALTER table:DROP table:INSERT database:CREATE_TABLE database:DESCRIBE column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create", "lakeformation:table:alter", "lakeformation:table:drop" | |
| DROP DATABASE | database:DESCRIBE database:DROP | "lakeformation:database:describe", "lakeformation:database:drop" | |
| DROP TABLE | database:DESCRIBE table:DESCRIBE table:DROP | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:drop" | |
| DROP VIEW | database:DESCRIBE table:DESCRIBE(target\source) table:DROP(target) | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:drop" | |
| REPAIR TABLE | database:DESCRIBE table:DESCRIBE table:ALTER table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| TRUNCATE TABLE | database:DESCRIBE table:DESCRIBE table:SELECT table:UPDATE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| REPLACE TABLE Test_Iceberg (col1..col2..) USING iceberg | table:DESCRIBE table:ALTER | "lakeformation:table:describe", "lakeformation:table:alter" | |
| DML语句 | INSERT TABLE | database:DESCRIBE table:DESCRIBE table:ALTER table:INSERT column:SELECT或table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" |
| INSERT INTO Test_Iceberg VALUES | table:DESCRIBE table:ALTER column:SELECT database:DESCRIBE | "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:database:describe" | |
| UPDATE Test_Iceberg SET col = value WHERE | table:DESCRIBE table:ALTER column:SELECT database:DESCRIBE | "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:database:describe" | |
| INSERT OVERWRITE Test_Iceberg VALUES | table:DESCRIBE table:ALTER table:UPDATE database:DESCRIBE | "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:database:describe" | |
| MERGE INTO Test_Iceberg USING xx | table:DESCRIBE table:ALTER table:UPDATE table:SELECT | "lakeformation:table:describe", "lakeformation:table:alter" | |
| DELETE FROM Test_Iceberg WHERE | table:DESCRIBE table:ALTER table:UPDATE table:SELECT | "lakeformation:table:describe", "lakeformation:table:alter" | |
| SET xx.wap.branch = Test_branch INSERT INTO Test_Iceberg VALUES | table:DESCRIBE table:ALTER table:INSERT | "lakeformation:table:describe", "lakeformation:table:alter" | |
| DQL语句 | SELECT | database:DESCRIBE table:DESCRIBE column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe" |
| EXPLAIN | 取决于执行SQL | 取决于执行SQL | |
| Auxiliary语句 | DESCRIBE DATABASE | database:DESCRIBE | "lakeformation:database:describe" |
| DESCRIBE QUERY | database:DESCRIBE table:DESCRIBE table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe" | |
| DESCRIBE TABLE | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW COLUMNS | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW CREATE TABLE | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW DATABASES | catalog:LIST_DATABASE database:DESCRIBE | "lakeformation:database:describe" | |
| SHOW PARTITIONS | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW TABLE EXTENDED | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW TABLES | database:LIST_TABLE database:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW TBLPROPERTIES | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW VIEWS | catalog:LIST_DATABASE database:LIST_TABLE database:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| CALL system.rollback_to_snapshot(Test_Iceberg, snapshot_id) | table:DESCRIBE table:ALTER table:UPDATE table:SELECT | "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL system.rollback_to_timestamp(Test_Iceberg, timestamp) | table:DESCRIBE table:ALTER table:UPDATE table:SELECT | "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL system.set_current_snapshot(Test_Iceberg, snapshot_id) | table:DESCRIBE table:ALTER table:UPDATE table:SELECT | "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL system.cherrypick_snapshot(Test_Iceberg, snapshot_id) | table:DESCRIBE table:ALTER table:UPDATE table:SELECT | "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL system.fast_forward(Test_Iceberg, branch) | table:DESCRIBE table:ALTER table:UPDATE table:SELECT | "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL system.expire_snapshots(Test_Iceberg, older_than) | table:DESCRIBE table:ALTER table:DELETE table:SELECT | "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL system.remove_orphan_files(Test_Iceberg) | table:DESCRIBE table:DELETE table:SELECT | "lakeformation:table:describe" | |
| CALL system.rewrite_data_files(Test_Iceberg) | table:DESCRIBE table:UPDATE table:SELECT | "lakeformation:table:describe" | |
| CALL system.rewrite_manifests(Test_Iceberg) | table:DESCRIBE table:ALTER table:UPDATE table:SELECT | "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL system.rewrite_position_delete_files(Test_Iceberg) | table:DESCRIBE table:UPDATE table:SELECT | "lakeformation:table:describe" | |
| CALL system.register_table(spark_catalog, Test_Iceberg) | table:DESCRIBE database:DESCRIBE database:CREATE_TABLE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create" | |
| CALL system.ancestors_of(Test_Iceberg) | table:DESCRIBE table:SELECT | "lakeformation:table:describe" | |
| CALL system.add_files(Test_Iceberg, Table_1,) | table:DESCRIBE table:ALTER table:SELECT table:UPDATE | "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL system.publish_changes(Test_Iceberg, wap1) | table:DESCRIBE table:ALTER table:SELECT table:UPDATE | "lakeformation:table:describe", "lakeformation:table:alter" | |
| CALL system.snapshot(Test_Parquet, Test_Copy) | table:DESCRIBE database:CREATE_TABLE | "lakeformation:table:describe", "lakeformation:table:create" | |
| CALL system.migrate(Test_Parquet) | table:DESCRIBE database:DESCRIBE database:CREATE_TABLE table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create", "lakeformation:table:alter" | |
| CALL system.create_changelog_view(Test_Iceberg, '1', '4') | table:DESCRIBE table:SELECT | "lakeformation:table:describe" |
| 类型 | SQL语句 | LakeFormation SQL资源鉴权权限 | IAM权限 |
|---|---|---|---|
| DDL语句 | ALTER DATABASE | database:DESCRIBE database:ALTER | "lakeformation:database:describe", "lakeformation:database:alter" |
| ALTER TABLE | database:DESCRIBE table:DESCRIBE table:ALTER database:CREATE_TABLE column:SELECT或table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter", "lakeformation:table:create" | |
| ALTER VIEW | database:DESCRIBE table:DESCRIBE table:ALTER table:CREATE_TABLE column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| CREATE DATABASE | database:DESCRIBE catalog:CREATE_DATABASE | "lakeformation:database:describe", "lakeformation:database:create" | |
| CREATE OR REPLACE FUNCTION (CREATE) | database:DESCRIBE database:CREATE_FUNC | "lakeformation:database:describe", "lakeformation:function:describe", "lakeformation:function:create" | |
| CREATE OR REPLACE FUNCTION (REPLACE) | database:CREATE_FUNC database:DESCRIBE function:DESCRIBE function:DROP | "lakeformation:database:create", "lakeformation:database:describe", "lakeformation:function:describe", "lakeformation:function:create", "lakeformation:function:drop" | |
| CREATE TABLE | database:DESCRIBE database:CREATE_TABLE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create" | |
| CREATE VIEW | database:DESCRIBE database:CREATE_TABLE table:DESCRIBE（source\target） table:DROP(target) column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:create", "lakeformation:table:drop" | |
| DROP DATABASE | database:DESCRIBE database:DROP | "lakeformation:database:describe", "lakeformation:database:drop" | |
| DROP FUNCTION | database:DESCRIBE function:DESCRIBE function:DROP | "lakeformation:database:describe", "lakeformation:function:describe", "lakeformation:function:drop" | |
| DROP TABLE | database:DESCRIBE table:DESCRIBE table:DROP | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:drop" | |
| DROP VIEW | database:DESCRIBE table:DESCRIBE(target\source) table:DROP(target) | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:drop" | |
| REPAIR TABLE | database:DESCRIBE table:DESCRIBE table:ALTER table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| TRUNCATE TABLE | database:DESCRIBE table:DESCRIBE table:SELECT table:UPDATE | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| DML语句 | INSERT TABLE | database:DESCRIBE table:DESCRIBE table:ALTER table:INSERT column:SELECT或table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" |
| LOAD DATA | database:DESCRIBE table:DESCRIBE table:UPDATE table:ALTER table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" | |
| DQL语句 | SELECT | database:DESCRIBE table:DESCRIBE column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe" |
| EXPLAIN | 取决于执行SQL | - | |
| Auxiliary语句 | ANALYZE TABLE | database:DESCRIBE table:DESCRIBE table:SELECT table:ALTER | "lakeformation:database:describe", "lakeformation:table:describe", "lakeformation:table:alter" |
| DESCRIBE DATABASE | database:DESCRIBE | "lakeformation:database:describe" | |
| DESCRIBE FUNCTION | database:DESCRIBE function:DESCRIBE | "lakeformation:database:describe", "lakeformation:function:describe" | |
| DESCRIBE QUERY | database:DESCRIBE table:DESCRIBE table:SELECT | "lakeformation:database:describe", "lakeformation:table:describe" | |
| DESCRIBE TABLE | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| REFRESH TABLE | database:DESCRIBE table:DESCRIBE column:SELECT | "lakeformation:database:describe", "lakeformation:table:describe" | |
| REFRESH FUNCTION | database:DESCRIBE function:DESCRIBE | "lakeformation:database:describe", "lakeformation:function:describe" | |
| SHOW COLUMNS | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW CREATE TABLE | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW DATABASES | catalog:LIST_DATABASE database:DESCRIBE | "lakeformation:database:describe" | |
| SHOW FUNCTIONS | database:DESCRIBE | "lakeformation:database:describe", "lakeformation:function:describe" | |
| SHOW PARTITIONS | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW TABLE EXTENDED | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW TABLES | database:LIST_TABLE database:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW TBLPROPERTIES | database:DESCRIBE table:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" | |
| SHOW VIEWS | catalog:LIST_DATABASE database:LIST_TABLE database:DESCRIBE | "lakeformation:database:describe", "lakeformation:table:describe" |
