lakeformation

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 25 Imported by: 0

README

Lake Formation

Parity grade: A · SDK aws-sdk-go-v2/service/lakeformation@v1.47.3 · last audited 2026-07-24 (4691484d9)

Coverage

Metric Value
Operations audited 61 (61 ok)
Feature families 3 (3 ok)
Known gaps 4
Deferred items 0
Resource leaks clean
Known gaps
  • PrincipalResourcePermissions.LastUpdatedBy is never populated (stays empty/omitted) -- the real value is the calling principal's ARN, but GrantPermissions/RevokePermissions have no caller-identity context threaded through them (unlike GetDataLakePrincipal, which derives a synthetic identity from awsmeta.Account(ctx) but takes a ctx param GrantPermissions doesn't have). Omitting an optional field is valid per protocol, so this is a completeness gap, not a wire-shape bug. Follow-up: thread ctx into GrantPermissions/RevokePermissions if worth the interface churn.
  • PrincipalResourcePermissions.AdditionalDetails (DetailsMap.ResourceShare, RAM resource-share info) is never populated -- gopherstack has no RAM integration for Lake Formation resource shares, so this optional field is correctly always omitted rather than fabricated.
  • LFTagPolicy-based permission grants are stored and returned literally (exact CatalogId+ResourceType+Expression match) but are NOT expanded into effective per-resource permissions -- i.e. GetEffectivePermissionsForPath/SearchTablesByLFTags/SearchDatabasesByLFTags do not cross-reference an LFTagPolicy grant against a table's actual LF-tags to compute implied access. This mirrors gopherstack's existing scope: no LakeFormation operation in this backend enforces authorization at all (permissions are bookkeeping, not an enforcement engine), so this is consistent with pre-existing behavior rather than a new gap, but is called out explicitly since LFTagPolicy is new this pass.
  • GetResourceLFTags/AddLFTagsToResource/RemoveLFTagsFromResource accept any Resource kind (no restriction to Database/Table/TableWithColumns as AWS's docs describe) -- permissive superset, not under-permissive, so a real client's valid calls are unaffected; not tightened this pass given no observed client-visible symptom.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ErrNilAppContext = errors.New("lakeformation: nil AppContext")

ErrNilAppContext is returned when Provider.Init is called with a nil AppContext.

View Source 
var ErrValidation = errors.New("validation error")

ErrValidation is returned when input validation fails.

Functions

This section is empty.

Types

type AllRowsWildcard added in v1.2.0 

type AllRowsWildcard struct{}

AllRowsWildcard indicates that all rows in a data cells filter are included.

type AuditContext 

type AuditContext struct {
	AdditionalAuditContext string `json:"AdditionalAuditContext,omitempty"`
}

AuditContext carries audit information.

type BatchFailureEntry 

type BatchFailureEntry struct {
	RequestEntry *BatchPermissionsRequestEntry `json:"RequestEntry,omitempty"`
	Error        *errorDetail                  `json:"Error,omitempty"`
}

BatchFailureEntry reports a failure for a single entry in a batch operation.

type BatchPermissionsRequestEntry added in v1.2.0 

type BatchPermissionsRequestEntry struct {
	Principal                  *DataLakePrincipal `json:"Principal,omitempty"`
	Resource                   *Resource          `json:"Resource,omitempty"`
	Condition                  *Condition         `json:"Condition,omitempty"`
	ID                         string             `json:"Id"`
	Permissions                []string           `json:"Permissions,omitempty"`
	PermissionsWithGrantOption []string           `json:"PermissionsWithGrantOption,omitempty"`
}

BatchPermissionsRequestEntry is a single entry of a BatchGrantPermissions or BatchRevokePermissions request. Unlike PermissionEntry (used directly by GrantPermissions/RevokePermissions), the real AWS API requires a caller-supplied Id per entry so BatchGrantPermissionsOutput/BatchRevokePermissionsOutput's Failures can be correlated back to the request that produced them.

type CatalogResource 

type CatalogResource struct {
	ID string `json:"Id,omitempty"`
}

CatalogResource represents the data catalog resource.

type ColumnLFTag 

type ColumnLFTag struct {
	Name   string      `json:"Name,omitempty"`
	LFTags []LFTagPair `json:"LFTags,omitempty"`
}

ColumnLFTag holds LF-tags for a column.

type ColumnWildcard added in v1.2.0 

type ColumnWildcard struct {
	ExcludedColumnNames []string `json:"ExcludedColumnNames,omitempty"`
}

ColumnWildcard is a wildcard object, consisting of an optional list of excluded column names.

type Condition added in v1.2.0 

type Condition struct {
	Expression string `json:"Expression,omitempty"`
}

Condition is a Lake Formation condition (Cedar expression) which applies to permissions and opt-ins.

type DataCellsFilter 

type DataCellsFilter struct {
	RowFilter      *RowFilter      `json:"RowFilter,omitempty"`
	ColumnWildcard *ColumnWildcard `json:"ColumnWildcard,omitempty"`
	TableCatalogID string          `json:"TableCatalogId"`
	DatabaseName   string          `json:"DatabaseName"`
	TableName      string          `json:"TableName"`
	Name           string          `json:"Name"`
	VersionID      string          `json:"VersionId,omitempty"`
	ColumnNames    []string        `json:"ColumnNames,omitempty"`
}

DataCellsFilter holds the definition of a cell-level access filter.

type DataCellsFilterResource added in v1.2.0 

type DataCellsFilterResource struct {
	TableCatalogID string `json:"TableCatalogId,omitempty"`
	DatabaseName   string `json:"DatabaseName,omitempty"`
	TableName      string `json:"TableName,omitempty"`
	Name           string `json:"Name,omitempty"`
}

DataCellsFilterResource identifies a data cells filter as a permission resource.

type DataLakePrincipal 

type DataLakePrincipal struct {
	DataLakePrincipalIdentifier string `json:"DataLakePrincipalIdentifier"`
}

DataLakePrincipal represents an IAM principal in the data lake.

type DataLakeSettings 

type DataLakeSettings struct {
	DataLakeAdmins                   []DataLakePrincipal    `json:"DataLakeAdmins,omitempty"`
	ReadOnlyAdmins                   []DataLakePrincipal    `json:"ReadOnlyAdmins,omitempty"`
	CreateDatabaseDefaultPermissions []PrincipalPermissions `json:"CreateDatabaseDefaultPermissions,omitempty"`
	CreateTableDefaultPermissions    []PrincipalPermissions `json:"CreateTableDefaultPermissions,omitempty"`
	TrustedResourceOwners            []string               `json:"TrustedResourceOwners,omitempty"`
	Parameters                       map[string]string      `json:"Parameters,omitempty"`
	ExternalDataFilteringAllowList   []DataLakePrincipal    `json:"ExternalDataFilteringAllowList,omitempty"`
	AllowExternalDataFiltering       *bool                  `json:"AllowExternalDataFiltering,omitempty"`
	AllowFullTableExternalDataAccess *bool                  `json:"AllowFullTableExternalDataAccess,omitempty"`
	AuthorizedSessionTagValueList    []string               `json:"AuthorizedSessionTagValueList,omitempty"`
}

DataLakeSettings contains the data lake settings for an account.

type DataLocationResource 

type DataLocationResource struct {
	ResourceArn string `json:"ResourceArn"`
	CatalogID   string `json:"CatalogId,omitempty"`
}

DataLocationResource represents an Amazon S3 data location resource.

type DatabaseResource 

type DatabaseResource struct {
	Name      string `json:"Name"`
	CatalogID string `json:"CatalogId,omitempty"`
}

DatabaseResource represents a database resource.

type ExecutionStatistics 

type ExecutionStatistics struct {
	AverageExecutionTimeMillis *int64 `json:"AverageExecutionTimeMillis,omitempty"`
	DataScannedBytes           *int64 `json:"DataScannedBytes,omitempty"`
	WorkUnitsExecutedCount     *int64 `json:"WorkUnitsExecutedCount,omitempty"`
}

ExecutionStatistics holds statistics for a query execution.

type ExportedResourceInfo 

type ExportedResourceInfo = ResourceInfo

ExportedResourceInfo is a compatibility alias used by the dashboard package.

type ExternalFilteringConfiguration 

type ExternalFilteringConfiguration struct {
	Status            string   `json:"Status,omitempty"`
	AuthorizedTargets []string `json:"AuthorizedTargets,omitempty"`
}

ExternalFilteringConfiguration holds external filtering config.

type Handler 

type Handler struct {
	Backend StorageBackend

	AccountID     string
	DefaultRegion string
	// contains filtered or unexported fields
}

Handler is the HTTP handler for the Lake Formation REST API.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new Lake Formation handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this handler handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name by stripping the leading slash.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(_ *echo.Context) string

ExtractResource returns an empty string (LakeFormation uses body-level resources).

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported Lake Formation operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for Lake Formation requests.

func (*Handler) HandlerOpsLen 

func (h *Handler) HandlerOpsLen() int

HandlerOpsLen returns the number of cached dispatch operations in the handler (test helper).

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority for this service.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset resets the backend to a clean state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Lake Formation REST API requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

h.Backend is the StorageBackend interface, which does not declare Snapshot/Restore, so InMemoryBackend.Snapshot/Restore (above) are not promoted to Handler automatically. Without this delegation, cli.go's setupPersistence type-asserts the registered service.Registerable (this *Handler) against persistence.Persistable, fails silently, and never registers lakeformation for snapshot/restore despite the backend being fully capable. Mirrors services/securityhub's Handler-level delegation.

InMemoryBackend.Snapshot has a different shape than persistence.Persistable (no ctx parameter, and it returns an error instead of logging one itself), so this adapts: it calls the backend's Snapshot() and logs+swallows any marshal error, matching the Persistable contract (a nil snapshot is skipped by the persistence Manager).

type IdentityCenterConfiguration 

type IdentityCenterConfiguration struct {
	ExternalFiltering *ExternalFilteringConfiguration `json:"ExternalFiltering,omitempty"`
	CatalogID         string                          `json:"CatalogId,omitempty"`
	InstanceArn       string                          `json:"InstanceArn,omitempty"`
	ApplicationArn    string                          `json:"ApplicationArn,omitempty"`
	ApplicationStatus string                          `json:"ApplicationStatus,omitempty"`
	ShareRecipients   []DataLakePrincipal             `json:"ShareRecipients,omitempty"`
}

IdentityCenterConfiguration holds the IAM Identity Center integration configuration.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory backend for Lake Formation.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates a new in-memory Lake Formation backend.

func (*InMemoryBackend) AddDataCellsFilterInternal 

func (b *InMemoryBackend) AddDataCellsFilterInternal(filter *DataCellsFilter)

AddDataCellsFilterInternal seeds a DataCellsFilter directly for testing.

func (*InMemoryBackend) AddLFTagExpressionInternal 

func (b *InMemoryBackend) AddLFTagExpressionInternal(expr *LFTagExpression)

AddLFTagExpressionInternal seeds an LFTagExpression directly for testing.

func (*InMemoryBackend) AddLFTagInternal 

func (b *InMemoryBackend) AddLFTagInternal(catalogID, tagKey string, tagValues []string)

AddLFTagInternal seeds an LF-tag directly for testing.

func (*InMemoryBackend) AddLFTagsToResource 

func (b *InMemoryBackend) AddLFTagsToResource(catalogID string, resource *Resource, lfTags []LFTagPair) []LFTagError

AddLFTagsToResource attaches LF-tags to the specified resource. Valid tags are always stored; failures are returned for any tag not found. This mirrors AWS behavior where valid tags are applied even if some fail.

func (*InMemoryBackend) AddPermissionInternal 

func (b *InMemoryBackend) AddPermissionInternal(entry *PermissionEntry)

AddPermissionInternal seeds a permission entry directly for testing.

func (*InMemoryBackend) AddResourceInternal 

func (b *InMemoryBackend) AddResourceInternal(resourceArn, roleArn string)

AddResourceInternal seeds a registered resource directly for testing.

func (*InMemoryBackend) AssumeDecoratedRoleWithSAML 

func (b *InMemoryBackend) AssumeDecoratedRoleWithSAML(
	_, _, _ string,
	durationSeconds *int32,
) *SAMLCredentials

AssumeDecoratedRoleWithSAML returns synthetic temporary credentials. The actual SAML assertion and role are not validated in the in-memory backend.

func (*InMemoryBackend) BatchGrantPermissions 

func (b *InMemoryBackend) BatchGrantPermissions(entries []*BatchPermissionsRequestEntry) []*BatchFailureEntry

BatchGrantPermissions grants permissions for multiple entries.

func (*InMemoryBackend) BatchRevokePermissions 

func (b *InMemoryBackend) BatchRevokePermissions(entries []*BatchPermissionsRequestEntry) []*BatchFailureEntry

BatchRevokePermissions revokes permissions for multiple entries.

func (*InMemoryBackend) CancelTransaction 

func (b *InMemoryBackend) CancelTransaction(transactionID string) error

CancelTransaction cancels an in-flight transaction. Returns an error if the transaction is already committed.

func (*InMemoryBackend) CommitTransaction 

func (b *InMemoryBackend) CommitTransaction(transactionID string) (string, error)

CommitTransaction commits an in-flight transaction. Returns an error if the transaction is already aborted.

func (*InMemoryBackend) CreateDataCellsFilter 

func (b *InMemoryBackend) CreateDataCellsFilter(filter *DataCellsFilter) error

CreateDataCellsFilter stores a new data cells filter.

func (*InMemoryBackend) CreateLFTag 

func (b *InMemoryBackend) CreateLFTag(catalogID, tagKey string, tagValues []string) error

CreateLFTag creates a new LF tag with the given values.

func (*InMemoryBackend) CreateLFTagExpression 

func (b *InMemoryBackend) CreateLFTagExpression(name, description, catalogID string, expression []LFTag) error

CreateLFTagExpression stores a new named LF-tag expression.

func (*InMemoryBackend) CreateLakeFormationIdentityCenterConfiguration 

func (b *InMemoryBackend) CreateLakeFormationIdentityCenterConfiguration(
	catalogID, instanceArn string,
	externalFiltering *ExternalFilteringConfiguration,
	shareRecipients []DataLakePrincipal,
) (string, error)

CreateLakeFormationIdentityCenterConfiguration creates or replaces the IAM Identity Center integration for the given catalog and returns a synthetic application ARN.

func (*InMemoryBackend) CreateLakeFormationOptIn 

func (b *InMemoryBackend) CreateLakeFormationOptIn(
	principal *DataLakePrincipal, resource *Resource, condition *Condition,
) error

CreateLakeFormationOptIn adds an opt-in enforcement entry for a principal and resource.

func (*InMemoryBackend) DataCellsFilterCount 

func (b *InMemoryBackend) DataCellsFilterCount() int

DataCellsFilterCount returns the number of data cells filters in the backend (test helper).

func (*InMemoryBackend) DeleteDataCellsFilter 

func (b *InMemoryBackend) DeleteDataCellsFilter(tableCatalogID, databaseName, tableName, name string) error

DeleteDataCellsFilter removes the named data cells filter.

func (*InMemoryBackend) DeleteLFTag 

func (b *InMemoryBackend) DeleteLFTag(catalogID, tagKey string) error

DeleteLFTag removes a LF tag.

func (*InMemoryBackend) DeleteLFTagExpression 

func (b *InMemoryBackend) DeleteLFTagExpression(name, catalogID string) error

DeleteLFTagExpression removes the named LF-tag expression.

func (*InMemoryBackend) DeleteLakeFormationIdentityCenterConfiguration 

func (b *InMemoryBackend) DeleteLakeFormationIdentityCenterConfiguration(catalogID string) error

DeleteLakeFormationIdentityCenterConfiguration removes the identity center config for a catalog.

func (*InMemoryBackend) DeleteLakeFormationOptIn 

func (b *InMemoryBackend) DeleteLakeFormationOptIn(
	principal *DataLakePrincipal, resource *Resource, _ *Condition,
) error

DeleteLakeFormationOptIn removes an opt-in enforcement entry for a principal and resource.

func (*InMemoryBackend) DeleteObjectsOnCancel 

func (b *InMemoryBackend) DeleteObjectsOnCancel(transactionID string) error

DeleteObjectsOnCancel removes governed table objects written during a cancelled transaction. AWS requires the transaction to be in ABORTED state before objects can be deleted.

func (*InMemoryBackend) DeregisterResource 

func (b *InMemoryBackend) DeregisterResource(resourceArn string) error

DeregisterResource removes a registered data lake resource and its associated permissions.

func (*InMemoryBackend) DescribeLakeFormationIdentityCenterConfiguration 

func (b *InMemoryBackend) DescribeLakeFormationIdentityCenterConfiguration(
	catalogID string,
) (*IdentityCenterConfiguration, error)

DescribeLakeFormationIdentityCenterConfiguration returns the identity center config for a catalog.

func (*InMemoryBackend) DescribeResource 

func (b *InMemoryBackend) DescribeResource(resourceArn string) (*ResourceInfo, error)

DescribeResource returns information about a registered resource.

func (*InMemoryBackend) DescribeTransaction 

func (b *InMemoryBackend) DescribeTransaction(transactionID string) (*Transaction, error)

DescribeTransaction returns the status of a specific transaction.

func (*InMemoryBackend) ExtendTransaction 

func (b *InMemoryBackend) ExtendTransaction(transactionID string) error

ExtendTransaction validates that a transaction is active and records the extension.

func (*InMemoryBackend) GetDataCellsFilter 

func (b *InMemoryBackend) GetDataCellsFilter(
	tableCatalogID, databaseName, tableName, name string,
) (*DataCellsFilter, error)

GetDataCellsFilter returns the named data cells filter.

func (*InMemoryBackend) GetDataLakePrincipal 

func (b *InMemoryBackend) GetDataLakePrincipal(ctx context.Context) *DataLakePrincipal

GetDataLakePrincipal returns a synthetic caller-identity principal. In a real deployment, this returns the ARN of the calling IAM entity.

func (*InMemoryBackend) GetDataLakeSettings 

func (b *InMemoryBackend) GetDataLakeSettings() *DataLakeSettings

GetDataLakeSettings returns the current data lake settings.

func (*InMemoryBackend) GetEffectivePermissionsForPath 

func (b *InMemoryBackend) GetEffectivePermissionsForPath(
	resourceArn string, maxResults int, nextToken string,
) ([]*PermissionEntry, string)

GetEffectivePermissionsForPath returns effective permissions for a resource path. Unlike ListPermissions, the real GetEffectivePermissionsForPathInput filters by a flat ResourceArn string, so this uses permissionMatchesARN directly rather than ListPermissions' Resource-shaped filter.

func (*InMemoryBackend) GetLFTag 

func (b *InMemoryBackend) GetLFTag(catalogID, tagKey string) (*LFTag, error)

GetLFTag returns the LF tag for the given catalog and key.

func (*InMemoryBackend) GetLFTagExpression 

func (b *InMemoryBackend) GetLFTagExpression(name, catalogID string) (*LFTagExpression, error)

GetLFTagExpression returns the named LF-tag expression.

func (*InMemoryBackend) GetQueryState 

func (b *InMemoryBackend) GetQueryState(queryID string) (string, error)

GetQueryState returns the current state of a query.

func (*InMemoryBackend) GetQueryStatistics 

func (b *InMemoryBackend) GetQueryStatistics(queryID string) (*ExecutionStatistics, *PlanningStatistics, error)

GetQueryStatistics returns synthetic statistics for a query.

func (*InMemoryBackend) GetResourceLFTags 

func (b *InMemoryBackend) GetResourceLFTags(_ string, resource *Resource) ([]LFTagPair, error)

GetResourceLFTags returns the LF-tags currently attached to a resource.

func (*InMemoryBackend) GetTableObjects 

func (b *InMemoryBackend) GetTableObjects(
	catalogID, databaseName, tableName, _ string,
	maxResults int, nextToken string,
) ([]PartitionedTableObjectsList, string)

GetTableObjects returns a paginated list of governed table objects.

func (*InMemoryBackend) GetTemporaryCredentials 

func (b *InMemoryBackend) GetTemporaryCredentials(durationSeconds *int32) *TemporaryCredentials

GetTemporaryCredentials returns synthetic temporary AWS credentials.

func (*InMemoryBackend) GetWorkUnitResults 

func (b *InMemoryBackend) GetWorkUnitResults(queryID, _ string) (string, error)

GetWorkUnitResults validates that the query exists and returns its content.

func (*InMemoryBackend) GetWorkUnits 

func (b *InMemoryBackend) GetWorkUnits(queryID string) ([]WorkUnitRange, string, error)

GetWorkUnits returns the work unit ranges for a completed query plan.

func (*InMemoryBackend) GrantPermissions 

func (b *InMemoryBackend) GrantPermissions(entry *PermissionEntry) error

GrantPermissions adds a permission entry.

func (*InMemoryBackend) IdentityCenterConfigCount 

func (b *InMemoryBackend) IdentityCenterConfigCount() int

IdentityCenterConfigCount returns the number of Identity Center configurations (test helper).

func (*InMemoryBackend) LFTagExpressionCount 

func (b *InMemoryBackend) LFTagExpressionCount() int

LFTagExpressionCount returns the number of LF-tag expressions in the backend (test helper).

func (*InMemoryBackend) ListDataCellsFilter 

func (b *InMemoryBackend) ListDataCellsFilter(
	tableCatalogID, databaseName, tableName string,
	maxResults int,
	nextToken string,
) ([]*DataCellsFilter, string)

ListDataCellsFilter returns a paginated list of data cells filters. Optional tableCatalogID, databaseName, and tableName act as filters.

func (*InMemoryBackend) ListLFTagExpressions 

func (b *InMemoryBackend) ListLFTagExpressions(
	catalogID string,
	maxResults int,
	nextToken string,
) ([]*LFTagExpression, string)

ListLFTagExpressions returns a paginated list of LF-tag expressions for the given catalog.

func (*InMemoryBackend) ListLFTags 

func (b *InMemoryBackend) ListLFTags(catalogID string, maxResults int, nextToken string) ([]*LFTag, string)

ListLFTags returns a paginated list of LF tags for the given catalog.

func (*InMemoryBackend) ListLakeFormationOptIns 

func (b *InMemoryBackend) ListLakeFormationOptIns(
	principalIdentifier string,
	resource *Resource,
	maxResults int,
	nextToken string,
) ([]*LFOptIn, string)

ListLakeFormationOptIns returns a paginated list of opt-in entries. Optional principalIdentifier acts as a filter.

func (*InMemoryBackend) ListPermissions 

func (b *InMemoryBackend) ListPermissions(
	resource *Resource,
	maxResults int,
	nextToken string,
	principal *DataLakePrincipal,
	resourceType string,
) ([]*PermissionEntry, string)

ListPermissions returns a paginated list of permission entries filtered by resource, principal, and/or resource type. resource mirrors the real ListPermissionsInput.Resource shape (a nested Resource union), not a flat ARN -- see permissionMatchesResource.

func (*InMemoryBackend) ListResources 

func (b *InMemoryBackend) ListResources(maxResults int, nextToken string) ([]*ResourceInfo, string)

ListResources returns a paginated list of registered resources.

func (*InMemoryBackend) ListTableStorageOptimizers 

func (b *InMemoryBackend) ListTableStorageOptimizers(
	catalogID, databaseName, tableName, storageOptimizerType string,
) []StorageOptimizer

ListTableStorageOptimizers returns the storage optimizers for a table, filtered by type if specified.

func (*InMemoryBackend) ListTransactions 

func (b *InMemoryBackend) ListTransactions(
	statusFilter string, maxResults int, nextToken string,
) ([]*Transaction, string)

ListTransactions returns a paginated list of transactions, optionally filtered by status.

func (*InMemoryBackend) OptInCount 

func (b *InMemoryBackend) OptInCount() int

OptInCount returns the number of opt-in entries in the backend (test helper).

func (*InMemoryBackend) PermissionCount 

func (b *InMemoryBackend) PermissionCount() int

PermissionCount returns the number of permission entries in the backend (test helper).

func (*InMemoryBackend) PutDataLakeSettings 

func (b *InMemoryBackend) PutDataLakeSettings(settings *DataLakeSettings)

PutDataLakeSettings replaces the data lake settings.

func (*InMemoryBackend) RegisterResource 

func (b *InMemoryBackend) RegisterResource(resourceArn, roleArn string, opts RegisterResourceOptions) error

RegisterResource registers an S3 location as a data lake resource.

func (*InMemoryBackend) RemoveLFTagsFromResource 

func (b *InMemoryBackend) RemoveLFTagsFromResource(
	_ string,
	resource *Resource,
	lfTags []LFTagPair,
) []LFTagError

RemoveLFTagsFromResource detaches LF-tags from the specified resource. Failures are returned for any tag not currently attached to the resource.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset restores the backend to a clean initial state.

func (*InMemoryBackend) ResourceCount 

func (b *InMemoryBackend) ResourceCount() int

ResourceCount returns the number of registered resources in the backend (test helper).

func (*InMemoryBackend) ResourceLFTagCount 

func (b *InMemoryBackend) ResourceLFTagCount() int

ResourceLFTagCount returns the number of resources with LF-tag associations (test helper).

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserialises a snapshot produced by Snapshot back into the backend.

func (*InMemoryBackend) RevokePermissions 

func (b *InMemoryBackend) RevokePermissions(entry *PermissionEntry) error

RevokePermissions removes specific permissions from a matching entry. If all permissions are revoked, the entry is deleted.

func (*InMemoryBackend) SearchDatabasesByLFTags 

func (b *InMemoryBackend) SearchDatabasesByLFTags(
	expression []LFTag,
	_ string,
	maxResults int,
	nextToken string,
) ([]TaggedDatabase, string)

SearchDatabasesByLFTags returns databases whose LF-tags match all of the given expression tags.

func (*InMemoryBackend) SearchTablesByLFTags 

func (b *InMemoryBackend) SearchTablesByLFTags(
	expression []LFTag,
	catalogID string,
	maxResults int,
	nextToken string,
) ([]TaggedTable, string)

SearchTablesByLFTags returns tables whose LF-tags match all of the given expression tags. It scans b.resourceLFTags for resources of type "table:" and checks whether all expression tags are present in the resource's tag set.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot() ([]byte, error)

Snapshot serialises the backend state to JSON for persistence.

func (*InMemoryBackend) StartJanitor 

func (b *InMemoryBackend) StartJanitor(ctx context.Context)

StartJanitor starts a background goroutine to clean up stale transactions.

func (*InMemoryBackend) StartQueryPlanning 

func (b *InMemoryBackend) StartQueryPlanning(queryString string) string

StartQueryPlanning registers a new query and returns its ID.

func (*InMemoryBackend) StartTransaction 

func (b *InMemoryBackend) StartTransaction(transactionType string) string

StartTransaction begins a new in-flight transaction and returns its ID.

func (*InMemoryBackend) TagCount 

func (b *InMemoryBackend) TagCount() int

TagCount returns the number of LF-tags in the backend (test helper).

func (*InMemoryBackend) TransactionCount 

func (b *InMemoryBackend) TransactionCount() int

TransactionCount returns the number of stored transactions in the backend (test helper).

func (*InMemoryBackend) UpdateDataCellsFilter 

func (b *InMemoryBackend) UpdateDataCellsFilter(filter *DataCellsFilter) error

UpdateDataCellsFilter replaces an existing data cells filter.

func (*InMemoryBackend) UpdateLFTag 

func (b *InMemoryBackend) UpdateLFTag(catalogID, tagKey string, tagValuesToAdd, tagValuesToDelete []string) error

UpdateLFTag adds and removes values from an existing LF tag. TagValues are sorted after modification for deterministic output.

func (*InMemoryBackend) UpdateLFTagExpression 

func (b *InMemoryBackend) UpdateLFTagExpression(name, catalogID, description string, expression []LFTag) error

UpdateLFTagExpression updates the description and expression of an existing LF-tag expression.

func (*InMemoryBackend) UpdateLakeFormationIdentityCenterConfiguration 

func (b *InMemoryBackend) UpdateLakeFormationIdentityCenterConfiguration(
	catalogID string, externalFiltering *ExternalFilteringConfiguration, appStatus string,
) error

UpdateLakeFormationIdentityCenterConfiguration updates or creates the identity center config.

func (*InMemoryBackend) UpdateResource 

func (b *InMemoryBackend) UpdateResource(resourceArn, roleArn string, opts RegisterResourceOptions) error

UpdateResource updates the role ARN of an already registered resource.

func (*InMemoryBackend) UpdateTableObjects 

func (b *InMemoryBackend) UpdateTableObjects(
	catalogID, databaseName, tableName, transactionID string,
	writes []WriteOperation,
) error

UpdateTableObjects validates the transaction and records the write operations.

func (*InMemoryBackend) UpdateTableStorageOptimizer 

func (b *InMemoryBackend) UpdateTableStorageOptimizer(
	catalogID, databaseName, tableName string, config map[string]map[string]string,
) string

UpdateTableStorageOptimizer replaces the storage optimizer config for a table.

type LFOptIn 

type LFOptIn struct {
	Principal     *DataLakePrincipal `json:"Principal,omitempty"`
	Resource      *Resource          `json:"Resource,omitempty"`
	Condition     *Condition         `json:"Condition,omitempty"`
	LastModified  string             `json:"LastModified,omitempty"`
	LastUpdatedBy string             `json:"LastUpdatedBy,omitempty"`
}

LFOptIn associates a principal and resource for opt-in enforcement. This is the internal representation -- LastModified is an RFC3339 string for business-logic convenience. HTTP responses must go through toLFOptInWire, which re-encodes it as epoch seconds to match the real wire format (see lfOptInWire).

type LFTag 

type LFTag struct {
	CatalogID string   `json:"CatalogId,omitempty"`
	TagKey    string   `json:"TagKey"`
	TagValues []string `json:"TagValues"`
}

LFTag represents a Lake Formation tag with its allowed values.

type LFTagError 

type LFTagError struct {
	LFTag *LFTagPair   `json:"LFTag,omitempty"`
	Error *errorDetail `json:"Error,omitempty"`
}

LFTagError represents a failure to attach or detach a single LF-tag.

type LFTagExpression 

type LFTagExpression struct {
	Name        string  `json:"Name"`
	Description string  `json:"Description,omitempty"`
	CatalogID   string  `json:"CatalogId,omitempty"`
	Expression  []LFTag `json:"Expression,omitempty"`
}

LFTagExpression holds a saved, named LF-tag expression.

type LFTagExpressionResource added in v1.2.0 

type LFTagExpressionResource struct {
	Name      string `json:"Name"`
	CatalogID string `json:"CatalogId,omitempty"`
}

LFTagExpressionResource identifies a saved LF-tag expression as a permission resource.

type LFTagKeyResource added in v1.2.0 

type LFTagKeyResource struct {
	CatalogID string   `json:"CatalogId,omitempty"`
	TagKey    string   `json:"TagKey"`
	TagValues []string `json:"TagValues"`
}

LFTagKeyResource identifies an LF-tag key/values pair as a permission resource.

type LFTagPair 

type LFTagPair struct {
	CatalogID string   `json:"CatalogId,omitempty"`
	TagKey    string   `json:"TagKey"`
	TagValues []string `json:"TagValues"`
}

LFTagPair represents an LF-tag key with its associated values attached to a resource.

type LFTagPolicyResource added in v1.2.0 

type LFTagPolicyResource struct {
	CatalogID      string  `json:"CatalogId,omitempty"`
	ResourceType   string  `json:"ResourceType"`
	ExpressionName string  `json:"ExpressionName,omitempty"`
	Expression     []LFTag `json:"Expression,omitempty"`
}

LFTagPolicyResource identifies an LF-tag policy (a set of LF-tag conditions, or a reference to a saved expression) applying to DATABASE or TABLE resources.

type Partition 

type Partition struct {
	Values []string `json:"Values,omitempty"`
}

Partition represents a Glue partition.

type PartitionedTableObjectsList 

type PartitionedTableObjectsList struct {
	PartitionValues []string      `json:"PartitionValues,omitempty"`
	Objects         []TableObject `json:"Objects,omitempty"`
}

PartitionedTableObjectsList holds objects for a partition.

type PermissionEntry 

type PermissionEntry struct {
	Principal                  *DataLakePrincipal `json:"Principal,omitempty"`
	Resource                   *Resource          `json:"Resource,omitempty"`
	Condition                  *Condition         `json:"Condition,omitempty"`
	LastUpdated                *time.Time         `json:"LastUpdated,omitempty"`
	LastUpdatedBy              string             `json:"LastUpdatedBy,omitempty"`
	Permissions                []string           `json:"Permissions,omitempty"`
	PermissionsWithGrantOption []string           `json:"PermissionsWithGrantOption,omitempty"`
}

PermissionEntry associates a principal and resource with a set of permissions.

type PlanningStatistics 

type PlanningStatistics struct {
	EstimatedDataToScanBytes *int64 `json:"EstimatedDataToScanBytes,omitempty"`
	PlanningTimeMillis       *int64 `json:"PlanningTimeMillis,omitempty"`
	QueueTimeMillis          *int64 `json:"QueueTimeMillis,omitempty"`
	WorkUnitsGeneratedCount  *int64 `json:"WorkUnitsGeneratedCount,omitempty"`
}

PlanningStatistics holds query planning statistics.

type PrincipalPermissions 

type PrincipalPermissions struct {
	Principal   *DataLakePrincipal `json:"Principal,omitempty"`
	Permissions []string           `json:"Permissions,omitempty"`
}

PrincipalPermissions pairs a principal with a set of permissions.

type Provider 

type Provider struct{}

Provider implements service.Provider for the Lake Formation service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Lake Formation service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type QueryPlanningContext 

type QueryPlanningContext struct {
	CatalogID       string            `json:"CatalogId,omitempty"`
	DatabaseName    string            `json:"DatabaseName"`
	QueryAsOfTime   *string           `json:"QueryAsOfTime,omitempty"`
	QueryParameters map[string]string `json:"QueryParameters,omitempty"`
	TransactionID   string            `json:"TransactionId,omitempty"`
}

QueryPlanningContext provides context for query planning.

type RegisterResourceOptions added in v1.2.0 

type RegisterResourceOptions struct {
	ExpectedResourceOwnerAccount string
	WithFederation               bool
	WithPrivilegedAccess         bool
	HybridAccessEnabled          bool
}

RegisterResourceOptions carries the RegisterResource/UpdateResource fields beyond ResourceArn/RoleArn that the real AWS API supports (see types.RegisterResourceInput / types.UpdateResourceInput). A zero value matches the pre-existing 2-arg registration behavior.

type Resource 

type Resource struct {
	Catalog          *CatalogResource          `json:"Catalog,omitempty"`
	Database         *DatabaseResource         `json:"Database,omitempty"`
	Table            *TableResource            `json:"Table,omitempty"`
	TableWithColumns *TableWithColumnsResource `json:"TableWithColumns,omitempty"`
	DataLocation     *DataLocationResource     `json:"DataLocation,omitempty"`
	DataCellsFilter  *DataCellsFilterResource  `json:"DataCellsFilter,omitempty"`
	LFTag            *LFTagKeyResource         `json:"LFTag,omitempty"`
	LFTagExpression  *LFTagExpressionResource  `json:"LFTagExpression,omitempty"`
	LFTagPolicy      *LFTagPolicyResource      `json:"LFTagPolicy,omitempty"`
}

Resource describes the resource to which permissions are granted.

type ResourceInfo 

type ResourceInfo struct {
	LastModified                 *time.Time `json:"LastModified,omitempty"`
	ResourceArn                  string     `json:"ResourceArn"`
	RoleArn                      string     `json:"RoleArn"`
	ExpectedResourceOwnerAccount string     `json:"ExpectedResourceOwnerAccount,omitempty"`
	VerificationStatus           string     `json:"VerificationStatus,omitempty"`
	HybridAccessEnabled          bool       `json:"HybridAccessEnabled,omitempty"`
	WithFederation               bool       `json:"WithFederation,omitempty"`
	WithPrivilegedAccess         bool       `json:"WithPrivilegedAccess,omitempty"`
}

ResourceInfo holds registration info for a data lake resource. This is the internal/persisted representation -- LastModified is a *time.Time for business-logic convenience. HTTP responses must go through toResourceInfoWire, which re-encodes LastModified as epoch seconds to match the real wire format (see resourceInfoWire).

type RowFilter 

type RowFilter struct {
	AllRowsWildcard  *AllRowsWildcard `json:"AllRowsWildcard,omitempty"`
	FilterExpression string           `json:"FilterExpression,omitempty"`
}

RowFilter holds a filter expression for a data cells filter.

type SAMLCredentials 

type SAMLCredentials struct {
	AccessKeyID     string  `json:"AccessKeyId,omitempty"`
	SecretAccessKey string  `json:"SecretAccessKey,omitempty"`
	SessionToken    string  `json:"SessionToken,omitempty"`
	Expiration      float64 `json:"Expiration,omitempty"`
}

SAMLCredentials is the response body for AssumeDecoratedRoleWithSAML. Expiration is emitted as epoch seconds (a JSON number) via awstime.Epoch, matching the real AssumeDecoratedRoleWithSAMLOutput.Expiration wire format -- the aws-sdk-go-v2 deserializer rejects an RFC3339 string here.

type StorageBackend 

type StorageBackend interface {
	Reset()

	GetDataLakeSettings() *DataLakeSettings
	PutDataLakeSettings(settings *DataLakeSettings)

	RegisterResource(resourceArn, roleArn string, opts RegisterResourceOptions) error
	UpdateResource(resourceArn, roleArn string, opts RegisterResourceOptions) error
	DeregisterResource(resourceArn string) error
	DescribeResource(resourceArn string) (*ResourceInfo, error)
	ListResources(maxResults int, nextToken string) ([]*ResourceInfo, string)

	GrantPermissions(entry *PermissionEntry) error
	RevokePermissions(entry *PermissionEntry) error
	ListPermissions(
		resource *Resource,
		maxResults int,
		nextToken string,
		principal *DataLakePrincipal,
		resourceType string,
	) ([]*PermissionEntry, string)

	CreateLFTag(catalogID, tagKey string, tagValues []string) error
	DeleteLFTag(catalogID, tagKey string) error
	GetLFTag(catalogID, tagKey string) (*LFTag, error)
	UpdateLFTag(catalogID, tagKey string, tagValuesToAdd, tagValuesToDelete []string) error
	ListLFTags(catalogID string, maxResults int, nextToken string) ([]*LFTag, string)

	BatchGrantPermissions(entries []*BatchPermissionsRequestEntry) []*BatchFailureEntry
	BatchRevokePermissions(entries []*BatchPermissionsRequestEntry) []*BatchFailureEntry

	AddLFTagsToResource(catalogID string, resource *Resource, lfTags []LFTagPair) []LFTagError
	RemoveLFTagsFromResource(catalogID string, resource *Resource, lfTags []LFTagPair) []LFTagError
	GetResourceLFTags(catalogID string, resource *Resource) ([]LFTagPair, error)

	AssumeDecoratedRoleWithSAML(
		principalArn, roleArn, samlAssertion string,
		durationSeconds *int32,
	) *SAMLCredentials

	StartTransaction(transactionType string) string
	CancelTransaction(transactionID string) error
	CommitTransaction(transactionID string) (string, error)
	DescribeTransaction(transactionID string) (*Transaction, error)
	ListTransactions(statusFilter string, maxResults int, nextToken string) ([]*Transaction, string)

	CreateDataCellsFilter(filter *DataCellsFilter) error
	DeleteDataCellsFilter(tableCatalogID, databaseName, tableName, name string) error
	ListDataCellsFilter(
		tableCatalogID, databaseName, tableName string,
		maxResults int,
		nextToken string,
	) ([]*DataCellsFilter, string)

	CreateLFTagExpression(name, description, catalogID string, expression []LFTag) error
	DeleteLFTagExpression(name, catalogID string) error
	ListLFTagExpressions(catalogID string, maxResults int, nextToken string) ([]*LFTagExpression, string)

	CreateLakeFormationIdentityCenterConfiguration(
		catalogID, instanceArn string,
		externalFiltering *ExternalFilteringConfiguration,
		shareRecipients []DataLakePrincipal,
	) (string, error)
	DeleteLakeFormationIdentityCenterConfiguration(catalogID string) error
	DescribeLakeFormationIdentityCenterConfiguration(catalogID string) (*IdentityCenterConfiguration, error)
	UpdateLakeFormationIdentityCenterConfiguration(
		catalogID string,
		externalFiltering *ExternalFilteringConfiguration,
		appStatus string,
	) error

	CreateLakeFormationOptIn(principal *DataLakePrincipal, resource *Resource, condition *Condition) error
	DeleteLakeFormationOptIn(principal *DataLakePrincipal, resource *Resource, condition *Condition) error
	ListLakeFormationOptIns(
		principalIdentifier string,
		resource *Resource,
		maxResults int,
		nextToken string,
	) ([]*LFOptIn, string)

	GetDataLakePrincipal(ctx context.Context) *DataLakePrincipal

	ExtendTransaction(transactionID string) error
	DeleteObjectsOnCancel(transactionID string) error

	GetDataCellsFilter(tableCatalogID, databaseName, tableName, name string) (*DataCellsFilter, error)
	UpdateDataCellsFilter(filter *DataCellsFilter) error

	GetLFTagExpression(name, catalogID string) (*LFTagExpression, error)
	UpdateLFTagExpression(name, catalogID, description string, expression []LFTag) error

	GetEffectivePermissionsForPath(resourceArn string, maxResults int, nextToken string) ([]*PermissionEntry, string)

	GetTemporaryCredentials(durationSeconds *int32) *TemporaryCredentials

	GetTableObjects(
		catalogID, databaseName, tableName, transactionID string,
		maxResults int,
		nextToken string,
	) ([]PartitionedTableObjectsList, string)
	UpdateTableObjects(catalogID, databaseName, tableName, transactionID string, writes []WriteOperation) error

	StartQueryPlanning(queryString string) string
	GetQueryState(queryID string) (string, error)
	GetQueryStatistics(queryID string) (*ExecutionStatistics, *PlanningStatistics, error)
	GetWorkUnits(queryID string) ([]WorkUnitRange, string, error)
	GetWorkUnitResults(queryID, workUnitToken string) (string, error)

	ListTableStorageOptimizers(catalogID, databaseName, tableName, storageOptimizerType string) []StorageOptimizer
	UpdateTableStorageOptimizer(catalogID, databaseName, tableName string, config map[string]map[string]string) string

	SearchDatabasesByLFTags(
		expression []LFTag, catalogID string, maxResults int, nextToken string,
	) ([]TaggedDatabase, string)
	SearchTablesByLFTags(
		expression []LFTag, catalogID string, maxResults int, nextToken string,
	) ([]TaggedTable, string)
}

StorageBackend is the interface for Lake Formation backend operations.

type StorageOptimizer 

type StorageOptimizer struct {
	StorageOptimizerType string            `json:"StorageOptimizerType,omitempty"`
	Config               map[string]string `json:"Config,omitempty"`
	ErrorMessage         string            `json:"ErrorMessage,omitempty"`
}

StorageOptimizer holds storage optimizer info.

type TableObject 

type TableObject struct {
	Size *int64 `json:"Size,omitempty"`
	URI  string `json:"Uri"`
	ETag string `json:"ETag,omitempty"`
}

TableObject represents an object in a governed table.

type TableResource 

type TableResource struct {
	TableWildcard *TableWildcard `json:"TableWildcard,omitempty"`
	CatalogID     string         `json:"CatalogId,omitempty"`
	DatabaseName  string         `json:"DatabaseName"`
	Name          string         `json:"Name,omitempty"`
}

TableResource represents a table resource.

type TableWildcard added in v1.2.0 

type TableWildcard struct{}

TableWildcard is a structure that indicates all tables in a database.

type TableWithColumnsResource 

type TableWithColumnsResource struct {
	ColumnWildcard *ColumnWildcard `json:"ColumnWildcard,omitempty"`
	CatalogID      string          `json:"CatalogId,omitempty"`
	DatabaseName   string          `json:"DatabaseName"`
	Name           string          `json:"Name"`
	ColumnNames    []string        `json:"ColumnNames,omitempty"`
}

TableWithColumnsResource represents a table resource with column-level access.

type TaggedDatabase 

type TaggedDatabase struct {
	Database *DatabaseResource `json:"Database,omitempty"`
	LFTags   []LFTagPair       `json:"LFTags,omitempty"`
}

TaggedDatabase holds a database with its LF-tags.

type TaggedTable 

type TaggedTable struct {
	Table           *TableResource `json:"Table,omitempty"`
	LFTagOnDatabase []LFTagPair    `json:"LFTagOnDatabase,omitempty"`
	LFTagsOnTable   []LFTagPair    `json:"LFTagsOnTable,omitempty"`
	LFTagsOnColumns []ColumnLFTag  `json:"LFTagsOnColumns,omitempty"`
}

TaggedTable holds a table with its LF-tags.

type TemporaryCredentials 

type TemporaryCredentials struct {
	AccessKeyID     string  `json:"AccessKeyId,omitempty"`
	SecretAccessKey string  `json:"SecretAccessKey,omitempty"`
	SessionToken    string  `json:"SessionToken,omitempty"`
	Expiration      float64 `json:"Expiration,omitempty"`
}

TemporaryCredentials holds temporary AWS credentials. Expiration is emitted as epoch seconds (a JSON number) via awstime.Epoch, matching the real types.TemporaryCredentials.Expiration wire format.

type Transaction 

type Transaction struct {
	TransactionID        string `json:"TransactionId"`
	TransactionStatus    string `json:"TransactionStatus"`
	TransactionStartTime string `json:"TransactionStartTime,omitempty"`
	TransactionEndTime   string `json:"TransactionEndTime,omitempty"`
}

Transaction represents an in-flight Lake Formation governed table transaction. This is the internal representation -- TransactionStartTime and TransactionEndTime are RFC3339 strings for business-logic convenience. HTTP responses must go through toTransactionWire, which re-encodes them as epoch seconds to match the real wire format (see transactionWire).

type VirtualObject 

type VirtualObject struct {
	URI  string `json:"Uri"`
	ETag string `json:"ETag,omitempty"`
}

VirtualObject is a reference to an S3 object.

type WorkUnitRange 

type WorkUnitRange struct {
	WorkUnitToken string `json:"WorkUnitToken"`
	WorkUnitIDMax int64  `json:"WorkUnitIdMax"`
	WorkUnitIDMin int64  `json:"WorkUnitIdMin"`
}

WorkUnitRange represents a range of work units.

type WriteOperation 

type WriteOperation struct {
	AddObject    *TableObject   `json:"AddObject,omitempty"`
	DeleteObject *VirtualObject `json:"DeleteObject,omitempty"`
}

WriteOperation represents a single governed table write.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.