AttachRLSPolicy
Attaches a row-level security policy to a resource for a principal. When the principal queries the resource, AWS Lake Formation applies the policy's filter expression so that only the permitted rows are returned.
Request Syntax
POST /AttachRLSPolicy HTTP/1.1
Content-type: application/json
{
"Condition": {
"Expression": "string"
},
"Name": "string",
"Principal": {
"DataLakePrincipalIdentifier": "string"
},
"Resource": {
"Catalog": {
"Id": "string"
},
"Database": {
"CatalogId": "string",
"Name": "string"
},
"DataCellsFilter": {
"DatabaseName": "string",
"Name": "string",
"TableCatalogId": "string",
"TableName": "string"
},
"DataLocation": {
"CatalogId": "string",
"ResourceArn": "string"
},
"LFTag": {
"CatalogId": "string",
"TagKey": "string",
"TagValues": [ "string" ]
},
"LFTagExpression": {
"CatalogId": "string",
"Name": "string"
},
"LFTagPolicy": {
"CatalogId": "string",
"Expression": [
{
"TagKey": "string",
"TagValues": [ "string" ]
}
],
"ExpressionName": "string",
"ResourceType": "string"
},
"RLSPolicy": {
"CatalogId": "string",
"Name": "string"
},
"Table": {
"CatalogId": "string",
"DatabaseName": "string",
"Name": "string",
"TableWildcard": {
}
},
"TableWithColumns": {
"CatalogId": "string",
"ColumnNames": [ "string" ],
"ColumnWildcard": {
"ExcludedColumnNames": [ "string" ]
},
"DatabaseName": "string",
"Name": "string"
}
},
"SetDefault": boolean
}URI Request Parameters
The request does not use any URI parameters.
Request Body
The request accepts the following data in JSON format.
- Condition
-
A Lake Formation condition, which applies to the row-level security policy attachment and contains an expression.
Type: Condition object
Required: No
- Name
-
The name of the row-level security policy to attach.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 255.
Pattern:
[\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF\t]*Required: Yes
- Principal
-
The principal to which the row-level security policy applies.
Type: DataLakePrincipal object
Required: No
- Resource
-
The resource to which the row-level security policy is attached.
Type: Resource object
Required: Yes
- SetDefault
-
Indicates whether this policy becomes the default row-level security policy for the resource. The default policy applies to all principals by default.
Type: Boolean
Required: No
Response Syntax
HTTP/1.1 200
Response Elements
If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.
Errors
For information about the errors that are common to all actions, see Common Error Types.
- AccessDeniedException
-
Access to a resource was denied.
- Message
-
A message describing the problem.
HTTP Status Code: 403
- AlreadyExistsException
-
A resource to be created or added already exists.
- Message
-
A message describing the problem.
HTTP Status Code: 400
- ConcurrentModificationException
-
Two processes are trying to modify a resource simultaneously.
- Message
-
A message describing the problem.
HTTP Status Code: 400
- EntityNotFoundException
-
A specified entity does not exist.
- Message
-
A message describing the problem.
HTTP Status Code: 400
- InternalServiceException
-
An internal service error occurred.
- Message
-
A message describing the problem.
HTTP Status Code: 500
- InvalidInputException
-
The input provided was not valid.
- Message
-
A message describing the problem.
HTTP Status Code: 400
- OperationTimeoutException
-
The operation timed out.
- Message
-
A message describing the problem.
HTTP Status Code: 400
- ResourceNumberLimitExceededException
-
A resource numerical limit was exceeded.
- Message
-
A message describing the problem.
HTTP Status Code: 400
Examples
Request example
This example illustrates one usage of AttachRLSPolicy.
{ "Name": "sales-east-region", "Resource": { "Table": { "DatabaseName": "sales", "Name": "orders" } }, "Principal": { "DataLakePrincipalIdentifier": "arn:aws:iam::111122223333:role/Analyst" }, "SetDefault": false }
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following: