Closed hrvining closed 1 year ago
Hello,
The docs referenced are a little out-of-date. There is a newer version of AWS::LakeFormation::Permissions named AWS::LakeFormation::PrincipalPermissions which I'd encourage you to consider using instead since it has some functionality improvements and the documentation is far more recent and thorough. I've included the link for that below.
However, for this particular issue, s3Resource should currently be supported by the AWS::LakeFormation::Permissions resource and the error message you're seeing (Resource does not exist or requester is not authorized to access requested permissions
) is indicating the CloudFormation resource is behaving correctly but the response from the underlying GrantPermissions request is getting an AccessDeniedException from the LakeFormation service.
This likely means a missing setup step required in LakeFormation prior to granting this permissions, such as registering the location, or making the granting role a DataLakeAdmin or providing it with Grantable permissions for that location.
Additional Information https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lakeformation-principalpermissions.html https://docs.aws.amazon.com/lake-formation/latest/dg/granting-location-permissions.html
Name of the resource
AWS::LakeFormation::Permissions
Resource name
No response
Description
DataLocationResource:S3Resource is not supported in CloudFormation as per the docs (refer to link below). May we add support for S3Resource for DataLocationResource. With our current LakeFormation Permission setup for DataLocationAccess Permission in Typescript -
we receive the following error:
We're assuming this is related to S3Resource not being supported by CloudFormation.
Other Details
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lakeformation-permissions-datalocationresource.html