lakeformation

package
v1.3.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 19, 2026 License: MIT Imports: 25 Imported by: 0

README

Lake Formation

Parity grade: A · SDK aws-sdk-go-v2/service/lakeformation@v1.50.4 · last audited 2026-08-15 (HEAD)

Coverage

Metric Value
Operations audited 61 (61 ok)
Feature families 3 (3 ok)
Known gaps 6
Deferred items 0
Resource leaks clean
Known gaps
  • NOT FIXED (gopherstack-6flj, 2026-08-15): DescribeLakeFormationIdentityCenterConfigurationOutput.ResourceShare (*string, the RAM resource-share ARN AWS creates server-side when ShareRecipients is set) is still never populated. This backend's InMemoryBackend carries no account/region fields at the storage layer (region only exists as Handler.DefaultRegion, set post-construction and never threaded into any backend call in this service), and there is no real RAM cross-service integration (same already-documented gap as AdditionalDetails below). Synthesizing a value would mean either fabricating a region or introducing new region-threading plumbing disproportionate to a single-op fix. Disclosed, not fabricated.
  • NOT FIXED (gopherstack-6flj, 2026-08-15): GetTemporaryGlueTableCredentialsInput.QuerySessionContext (real, api_op_GetTemporaryGlueTableCredentials.go) is unmodeled anywhere in this service, and likely shared by several query-planning ops (GetWorkUnits/StartQueryPlanning/GetWorkUnitResults use similar context structures). A broader structural feature spanning the query-family ops; out of scope for this pass's discarded-input fixes, which were limited to S3Path/VendedS3Path on this same op.
  • FIXED (gopherstack-kbnu): PrincipalResourcePermissions.LastUpdatedBy is now populated by GrantPermissions/RevokePermissions/BatchGrantPermissions/BatchRevokePermissions with a synthetic caller ARN derived from awsmeta.Account(ctx) (callerPrincipalARN, credentials.go -- same identity GetDataLakePrincipal reports). Interface signatures gained a ctx context.Context first parameter; all callers updated.
  • PrincipalResourcePermissions.AdditionalDetails (DetailsMap.ResourceShare, RAM resource-share info) is still never populated. Re-checked this pass: gopherstack DOES have a standalone services/ram package (resource shares, principals, permissions), but there is no cross-service wiring between it and lakeformation anywhere in the codebase (no service in this repo reaches into another service's InMemoryBackend directly -- checked s3<->kms as a second data point, same finding). Populating this would require introducing a new cross-service backend-injection pattern, which is out of scope for a single-service follow-up. Correctly omitted rather than fabricated.
  • PARTIALLY FIXED (gopherstack-kbnu): LFTagPolicy-based permission grants are now expanded into effective per-resource permissions in GetEffectivePermissionsForPath (resolves the resourceArn to a Database/Table, looks up its actual LF-tags, and evaluates each LFTagPolicy grant's Expression/ExpressionName against them -- AND across tag keys, OR across one key's values, per https://docs.aws.amazon.com/lake-formation/latest/dg/managing-tag-expressions.html). ListPermissions filtered by a concrete resource intentionally still does NOT expand tag-policy grants: AWS's own documented behavior is that LF-Tag-based grants are queried via their own LFTagPolicy/LF_TAG_POLICY_* resource type, not by listing the concrete resource they happen to cover (a tag-based grant 'may not appear in ListPermissions results for specific resources'). SearchTablesByLFTags/SearchDatabasesByLFTags remain untouched (out of scope for this pass -- they answer 'which resources have these tags', not 'what permissions apply to this resource'). No LakeFormation operation in this backend enforces authorization at runtime (permissions are bookkeeping, not an enforcement engine); this pass only makes the LF-Tag-derived permission record visible where AWS documents it should be, it does not add access control.
  • FIXED (gopherstack-kbnu): GetResourceLFTags/AddLFTagsToResource/RemoveLFTagsFromResource now reject Resource kinds other than Database/Table/TableWithColumns with InvalidInputException, matching the documented restriction ("The database, table, or column resource...", api_op_GetResourceLFTags.go:30-33 / api_op_AddLFTagsToResource.go:29-31; RemoveLFTagsFromResource states it explicitly: "Only database, table, or tableWithColumns resource are allowed.", api_op_RemoveLFTagsFromResource.go:12-14, aws-sdk-go-v2/service/lakeformation@v1.50.4). Was a permissive superset (accepted Catalog/DataLocation/DataCellsFilter/LFTag/LFTagExpression/LFTagPolicy too) -- the same bug class as a glacier-pass finding the same day (gopherstack accepting a clause AWS rejects).

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ErrNilAppContext = errors.New("lakeformation: nil AppContext")

ErrNilAppContext is returned when Provider.Init is called with a nil AppContext.

View Source 
var ErrValidation = errors.New("validation error")

ErrValidation is returned when input validation fails.

Functions

This section is empty.

Types

type AllRowsWildcard added in v1.2.0 

type AllRowsWildcard struct{}

AllRowsWildcard indicates that all rows in a data cells filter are included.

type AuditContext 

type AuditContext struct {
	AdditionalAuditContext string `json:"AdditionalAuditContext,omitempty"`
}

AuditContext carries audit information.

type BatchFailureEntry 

type BatchFailureEntry struct {
	RequestEntry *BatchPermissionsRequestEntry `json:"RequestEntry,omitempty"`
	Error        *errorDetail                  `json:"Error,omitempty"`
}

BatchFailureEntry reports a failure for a single entry in a batch operation.

type BatchPermissionsRequestEntry added in v1.2.0 

type BatchPermissionsRequestEntry struct {
	Principal                  *DataLakePrincipal `json:"Principal,omitempty"`
	Resource                   *Resource          `json:"Resource,omitempty"`
	Condition                  *Condition         `json:"Condition,omitempty"`
	ID                         string             `json:"Id"`
	Permissions                []string           `json:"Permissions,omitempty"`
	PermissionsWithGrantOption []string           `json:"PermissionsWithGrantOption,omitempty"`
}

BatchPermissionsRequestEntry is a single entry of a BatchGrantPermissions or BatchRevokePermissions request. Unlike PermissionEntry (used directly by GrantPermissions/RevokePermissions), the real AWS API requires a caller-supplied Id per entry so BatchGrantPermissionsOutput/BatchRevokePermissionsOutput's Failures can be correlated back to the request that produced them.

type CatalogResource 

type CatalogResource struct {
	ID string `json:"Id,omitempty"`
}

CatalogResource represents the data catalog resource.

type ColumnLFTag 

type ColumnLFTag struct {
	Name   string      `json:"Name,omitempty"`
	LFTags []LFTagPair `json:"LFTags,omitempty"`
}

ColumnLFTag holds LF-tags for a column.

type ColumnWildcard added in v1.2.0 

type ColumnWildcard struct {
	ExcludedColumnNames []string `json:"ExcludedColumnNames,omitempty"`
}

ColumnWildcard is a wildcard object, consisting of an optional list of excluded column names.

type Condition added in v1.2.0 

type Condition struct {
	Expression string `json:"Expression,omitempty"`
}

Condition is a Lake Formation condition (Cedar expression) which applies to permissions and opt-ins.

type DataCellsFilter 

type DataCellsFilter struct {
	RowFilter      *RowFilter      `json:"RowFilter,omitempty"`
	ColumnWildcard *ColumnWildcard `json:"ColumnWildcard,omitempty"`
	TableCatalogID string          `json:"TableCatalogId"`
	DatabaseName   string          `json:"DatabaseName"`
	TableName      string          `json:"TableName"`
	Name           string          `json:"Name"`
	VersionID      string          `json:"VersionId,omitempty"`
	ColumnNames    []string        `json:"ColumnNames,omitempty"`
}

DataCellsFilter holds the definition of a cell-level access filter.

type DataCellsFilterResource added in v1.2.0 

type DataCellsFilterResource struct {
	TableCatalogID string `json:"TableCatalogId,omitempty"`
	DatabaseName   string `json:"DatabaseName,omitempty"`
	TableName      string `json:"TableName,omitempty"`
	Name           string `json:"Name,omitempty"`
}

DataCellsFilterResource identifies a data cells filter as a permission resource.

type DataLakePrincipal 

type DataLakePrincipal struct {
	DataLakePrincipalIdentifier string `json:"DataLakePrincipalIdentifier"`
}

DataLakePrincipal represents an IAM principal in the data lake.

type DataLakeSettings 

type DataLakeSettings struct {
	DataLakeAdmins                   []DataLakePrincipal    `json:"DataLakeAdmins,omitempty"`
	ReadOnlyAdmins                   []DataLakePrincipal    `json:"ReadOnlyAdmins,omitempty"`
	CreateDatabaseDefaultPermissions []PrincipalPermissions `json:"CreateDatabaseDefaultPermissions,omitempty"`
	CreateTableDefaultPermissions    []PrincipalPermissions `json:"CreateTableDefaultPermissions,omitempty"`
	TrustedResourceOwners            []string               `json:"TrustedResourceOwners,omitempty"`
	Parameters                       map[string]string      `json:"Parameters,omitempty"`
	ExternalDataFilteringAllowList   []DataLakePrincipal    `json:"ExternalDataFilteringAllowList,omitempty"`
	AllowExternalDataFiltering       *bool                  `json:"AllowExternalDataFiltering,omitempty"`
	AllowFullTableExternalDataAccess *bool                  `json:"AllowFullTableExternalDataAccess,omitempty"`
	AuthorizedSessionTagValueList    []string               `json:"AuthorizedSessionTagValueList,omitempty"`
}

DataLakeSettings contains the data lake settings for an account.

type DataLocationResource 

type DataLocationResource struct {
	ResourceArn string `json:"ResourceArn"`
	CatalogID   string `json:"CatalogId,omitempty"`
}

DataLocationResource represents an Amazon S3 data location resource.

type DatabaseResource 

type DatabaseResource struct {
	Name      string `json:"Name"`
	CatalogID string `json:"CatalogId,omitempty"`
}

DatabaseResource represents a database resource.

type ExecutionStatistics 

type ExecutionStatistics struct {
	AverageExecutionTimeMillis *int64 `json:"AverageExecutionTimeMillis,omitempty"`
	DataScannedBytes           *int64 `json:"DataScannedBytes,omitempty"`
	WorkUnitsExecutedCount     *int64 `json:"WorkUnitsExecutedCount,omitempty"`
}

ExecutionStatistics holds statistics for a query execution.

type ExportedResourceInfo 

type ExportedResourceInfo = ResourceInfo

ExportedResourceInfo is a compatibility alias used by the dashboard package.

type ExternalFilteringConfiguration 

type ExternalFilteringConfiguration struct {
	Status            string   `json:"Status,omitempty"`
	AuthorizedTargets []string `json:"AuthorizedTargets,omitempty"`
}

ExternalFilteringConfiguration holds external filtering config.

type Handler 

type Handler struct {
	Backend StorageBackend

	AccountID     string
	DefaultRegion string
	// contains filtered or unexported fields
}

Handler is the HTTP handler for the Lake Formation REST API.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new Lake Formation handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this handler handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name by stripping the leading slash.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(_ *echo.Context) string

ExtractResource returns an empty string (LakeFormation uses body-level resources).

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported Lake Formation operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for Lake Formation requests.

func (*Handler) HandlerOpsLen 

func (h *Handler) HandlerOpsLen() int

HandlerOpsLen returns the number of cached dispatch operations in the handler (test helper).

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority for this service.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset resets the backend to a clean state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Lake Formation REST API requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

h.Backend is the StorageBackend interface, which does not declare Snapshot/Restore, so InMemoryBackend.Snapshot/Restore (above) are not promoted to Handler automatically. Without this delegation, cli.go's setupPersistence type-asserts the registered service.Registerable (this *Handler) against persistence.Persistable, fails silently, and never registers lakeformation for snapshot/restore despite the backend being fully capable. Mirrors services/securityhub's Handler-level delegation.

InMemoryBackend.Snapshot has a different shape than persistence.Persistable (no ctx parameter, and it returns an error instead of logging one itself), so this adapts: it calls the backend's Snapshot() and logs+swallows any marshal error, matching the Persistable contract (a nil snapshot is skipped by the persistence Manager).

type IdentityCenterConfiguration 

type IdentityCenterConfiguration struct {
	ExternalFiltering   *ExternalFilteringConfiguration `json:"ExternalFiltering,omitempty"`
	CatalogID           string                          `json:"CatalogId,omitempty"`
	InstanceArn         string                          `json:"InstanceArn,omitempty"`
	ApplicationArn      string                          `json:"ApplicationArn,omitempty"`
	ApplicationStatus   string                          `json:"ApplicationStatus,omitempty"`
	ShareRecipients     []DataLakePrincipal             `json:"ShareRecipients,omitempty"`
	ServiceIntegrations []ServiceIntegration            `json:"ServiceIntegrations,omitempty"`
}

IdentityCenterConfiguration holds the IAM Identity Center integration configuration for internal storage/persistence. Its JSON tags are for the snapshot/restore DTO shape only, NOT the AWS wire shape -- the HTTP response is built field-by-field in describeLakeFormationIdentityCenterConfigurationOutput. ApplicationStatus is tracked here (set only via UpdateLakeFormationIdentityCenterConfigurationInput.ApplicationStatus) but deliberately excluded from that wire output: the real DescribeLakeFormationIdentityCenterConfigurationOutput has no ApplicationStatus member at all (confirmed against deserializers.go's awsRestjson1_deserializeOpDocumentDescribeLakeFormationIdentityCenterConfigurationOutput case list) -- ApplicationStatus is real only as an Update *request* field.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory backend for Lake Formation.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates a new in-memory Lake Formation backend.

func (*InMemoryBackend) AddDataCellsFilterInternal 

func (b *InMemoryBackend) AddDataCellsFilterInternal(filter *DataCellsFilter)

AddDataCellsFilterInternal seeds a DataCellsFilter directly for testing.

func (*InMemoryBackend) AddLFTagExpressionInternal 

func (b *InMemoryBackend) AddLFTagExpressionInternal(expr *LFTagExpression)

AddLFTagExpressionInternal seeds an LFTagExpression directly for testing.

func (*InMemoryBackend) AddLFTagInternal 

func (b *InMemoryBackend) AddLFTagInternal(catalogID, tagKey string, tagValues []string)

AddLFTagInternal seeds an LF-tag directly for testing.

func (*InMemoryBackend) AddLFTagsToResource 

func (b *InMemoryBackend) AddLFTagsToResource(catalogID string, resource *Resource, lfTags []LFTagPair) []LFTagError

AddLFTagsToResource attaches LF-tags to the specified resource. Valid tags are always stored; failures are returned for any tag not found. This mirrors AWS behavior where valid tags are applied even if some fail.

func (*InMemoryBackend) AddPermissionInternal 

func (b *InMemoryBackend) AddPermissionInternal(entry *PermissionEntry)

AddPermissionInternal seeds a permission entry directly for testing.

func (*InMemoryBackend) AddResourceInternal 

func (b *InMemoryBackend) AddResourceInternal(resourceArn, roleArn string)

AddResourceInternal seeds a registered resource directly for testing.

func (*InMemoryBackend) AssumeDecoratedRoleWithSAML 

func (b *InMemoryBackend) AssumeDecoratedRoleWithSAML(
	_, _, _ string,
	durationSeconds *int32,
) *SAMLCredentials

AssumeDecoratedRoleWithSAML returns synthetic temporary credentials. The actual SAML assertion and role are not validated in the in-memory backend.

func (*InMemoryBackend) BatchGrantPermissions 

func (b *InMemoryBackend) BatchGrantPermissions(
	ctx context.Context, entries []*BatchPermissionsRequestEntry,
) []*BatchFailureEntry

BatchGrantPermissions grants permissions for multiple entries.

func (*InMemoryBackend) BatchRevokePermissions 

func (b *InMemoryBackend) BatchRevokePermissions(
	ctx context.Context, entries []*BatchPermissionsRequestEntry,
) []*BatchFailureEntry

BatchRevokePermissions revokes permissions for multiple entries.

func (*InMemoryBackend) CancelTransaction 

func (b *InMemoryBackend) CancelTransaction(transactionID string) error

CancelTransaction cancels an in-flight transaction. Returns an error if the transaction is already committed.

func (*InMemoryBackend) CommitTransaction 

func (b *InMemoryBackend) CommitTransaction(transactionID string) (string, error)

CommitTransaction commits an in-flight transaction. Returns an error if the transaction is already aborted.

func (*InMemoryBackend) CreateDataCellsFilter 

func (b *InMemoryBackend) CreateDataCellsFilter(filter *DataCellsFilter) error

CreateDataCellsFilter stores a new data cells filter.

func (*InMemoryBackend) CreateLFTag 

func (b *InMemoryBackend) CreateLFTag(catalogID, tagKey string, tagValues []string) error

CreateLFTag creates a new LF tag with the given values.

func (*InMemoryBackend) CreateLFTagExpression 

func (b *InMemoryBackend) CreateLFTagExpression(name, description, catalogID string, expression []LFTag) error

CreateLFTagExpression stores a new named LF-tag expression.

func (*InMemoryBackend) CreateLakeFormationIdentityCenterConfiguration 

func (b *InMemoryBackend) CreateLakeFormationIdentityCenterConfiguration(
	catalogID, instanceArn string,
	externalFiltering *ExternalFilteringConfiguration,
	shareRecipients []DataLakePrincipal,
	serviceIntegrations []ServiceIntegration,
) (string, error)

CreateLakeFormationIdentityCenterConfiguration creates or replaces the IAM Identity Center integration for the given catalog and returns a synthetic application ARN.

func (*InMemoryBackend) CreateLakeFormationOptIn 

func (b *InMemoryBackend) CreateLakeFormationOptIn(
	principal *DataLakePrincipal, resource *Resource, condition *Condition,
) error

CreateLakeFormationOptIn adds an opt-in enforcement entry for a principal and resource.

func (*InMemoryBackend) DataCellsFilterCount 

func (b *InMemoryBackend) DataCellsFilterCount() int

DataCellsFilterCount returns the number of data cells filters in the backend (test helper).

func (*InMemoryBackend) DeleteDataCellsFilter 

func (b *InMemoryBackend) DeleteDataCellsFilter(tableCatalogID, databaseName, tableName, name string) error

DeleteDataCellsFilter removes the named data cells filter.

func (*InMemoryBackend) DeleteLFTag 

func (b *InMemoryBackend) DeleteLFTag(catalogID, tagKey string) error

DeleteLFTag removes a LF tag.

func (*InMemoryBackend) DeleteLFTagExpression 

func (b *InMemoryBackend) DeleteLFTagExpression(name, catalogID string) error

DeleteLFTagExpression removes the named LF-tag expression.

func (*InMemoryBackend) DeleteLakeFormationIdentityCenterConfiguration 

func (b *InMemoryBackend) DeleteLakeFormationIdentityCenterConfiguration(catalogID string) error

DeleteLakeFormationIdentityCenterConfiguration removes the identity center config for a catalog.

func (*InMemoryBackend) DeleteLakeFormationOptIn 

func (b *InMemoryBackend) DeleteLakeFormationOptIn(
	principal *DataLakePrincipal, resource *Resource, _ *Condition,
) error

DeleteLakeFormationOptIn removes an opt-in enforcement entry for a principal and resource.

func (*InMemoryBackend) DeleteObjectsOnCancel 

func (b *InMemoryBackend) DeleteObjectsOnCancel(transactionID string) error

DeleteObjectsOnCancel removes governed table objects written during a cancelled transaction. AWS requires the transaction to be in ABORTED state before objects can be deleted.

func (*InMemoryBackend) DeregisterResource 

func (b *InMemoryBackend) DeregisterResource(resourceArn string) error

DeregisterResource removes a registered data lake resource and its associated permissions.

func (*InMemoryBackend) DescribeLakeFormationIdentityCenterConfiguration 

func (b *InMemoryBackend) DescribeLakeFormationIdentityCenterConfiguration(
	catalogID string,
) (*IdentityCenterConfiguration, error)

DescribeLakeFormationIdentityCenterConfiguration returns the identity center config for a catalog.

func (*InMemoryBackend) DescribeResource 

func (b *InMemoryBackend) DescribeResource(resourceArn string) (*ResourceInfo, error)

DescribeResource returns information about a registered resource.

func (*InMemoryBackend) DescribeTransaction 

func (b *InMemoryBackend) DescribeTransaction(transactionID string) (*Transaction, error)

DescribeTransaction returns the status of a specific transaction.

func (*InMemoryBackend) ExtendTransaction 

func (b *InMemoryBackend) ExtendTransaction(transactionID string) error

ExtendTransaction validates that a transaction is active and records the extension.

func (*InMemoryBackend) GetDataCellsFilter 

func (b *InMemoryBackend) GetDataCellsFilter(
	tableCatalogID, databaseName, tableName, name string,
) (*DataCellsFilter, error)

GetDataCellsFilter returns the named data cells filter.

func (*InMemoryBackend) GetDataLakePrincipal 

func (b *InMemoryBackend) GetDataLakePrincipal(ctx context.Context) *DataLakePrincipal

GetDataLakePrincipal returns a synthetic caller-identity principal. In a real deployment, this returns the ARN of the calling IAM entity.

func (*InMemoryBackend) GetDataLakeSettings 

func (b *InMemoryBackend) GetDataLakeSettings() *DataLakeSettings

GetDataLakeSettings returns the current data lake settings.

func (*InMemoryBackend) GetEffectivePermissionsForPath 

func (b *InMemoryBackend) GetEffectivePermissionsForPath(
	resourceArn string, maxResults int, nextToken string,
) ([]*PermissionEntry, string)

GetEffectivePermissionsForPath returns effective permissions for a resource path. Unlike ListPermissions, the real GetEffectivePermissionsForPathInput filters by a flat ResourceArn string, so this uses permissionMatchesARN directly rather than ListPermissions' Resource-shaped filter. Also expands LFTagPolicy grants matching the resource's LF-tags (see expandLFTagPolicyGrantsLocked) since those carry no Database/Table field to match against resourceArn directly.

func (*InMemoryBackend) GetLFTag 

func (b *InMemoryBackend) GetLFTag(catalogID, tagKey string) (*LFTag, error)

GetLFTag returns the LF tag for the given catalog and key.

func (*InMemoryBackend) GetLFTagExpression 

func (b *InMemoryBackend) GetLFTagExpression(name, catalogID string) (*LFTagExpression, error)

GetLFTagExpression returns the named LF-tag expression.

func (*InMemoryBackend) GetQueryState 

func (b *InMemoryBackend) GetQueryState(queryID string) (string, error)

GetQueryState returns the current state of a query.

func (*InMemoryBackend) GetQueryStatistics 

func (b *InMemoryBackend) GetQueryStatistics(queryID string) (*ExecutionStatistics, *PlanningStatistics, error)

GetQueryStatistics returns synthetic statistics for a query.

func (*InMemoryBackend) GetResourceLFTags 

func (b *InMemoryBackend) GetResourceLFTags(_ string, resource *Resource) ([]LFTagPair, error)

GetResourceLFTags returns the LF-tags currently attached to a resource.

func (*InMemoryBackend) GetTableObjects 

func (b *InMemoryBackend) GetTableObjects(
	catalogID, databaseName, tableName, _ string,
	maxResults int, nextToken string,
) ([]PartitionedTableObjectsList, string)

GetTableObjects returns a paginated list of governed table objects.

func (*InMemoryBackend) GetTemporaryCredentials 

func (b *InMemoryBackend) GetTemporaryCredentials(durationSeconds *int32) *TemporaryCredentials

GetTemporaryCredentials returns synthetic temporary AWS credentials.

func (*InMemoryBackend) GetWorkUnitResults 

func (b *InMemoryBackend) GetWorkUnitResults(queryID string, workUnitID int64, _ string) (string, error)

GetWorkUnitResults validates that the query exists and that workUnitID names a real work unit -- GetWorkUnits always returns exactly one range (WorkUnitIDMin/Max both 0, see GetWorkUnits above), so only 0 is valid today, but a caller-supplied ID is no longer silently ignored.

func (*InMemoryBackend) GetWorkUnits 

func (b *InMemoryBackend) GetWorkUnits(queryID string) ([]WorkUnitRange, string, error)

GetWorkUnits returns the work unit ranges for a completed query plan.

func (*InMemoryBackend) GrantPermissions 

func (b *InMemoryBackend) GrantPermissions(ctx context.Context, entry *PermissionEntry) error

GrantPermissions adds a permission entry, stamping LastUpdatedBy with the caller identity derived from ctx (see callerPrincipalARN).

func (*InMemoryBackend) IdentityCenterConfigCount 

func (b *InMemoryBackend) IdentityCenterConfigCount() int

IdentityCenterConfigCount returns the number of Identity Center configurations (test helper).

func (*InMemoryBackend) LFTagExpressionCount 

func (b *InMemoryBackend) LFTagExpressionCount() int

LFTagExpressionCount returns the number of LF-tag expressions in the backend (test helper).

func (*InMemoryBackend) ListDataCellsFilter 

func (b *InMemoryBackend) ListDataCellsFilter(
	tableCatalogID, databaseName, tableName string,
	maxResults int,
	nextToken string,
) ([]*DataCellsFilter, string)

ListDataCellsFilter returns a paginated list of data cells filters. Optional tableCatalogID, databaseName, and tableName act as filters.

func (*InMemoryBackend) ListLFTagExpressions 

func (b *InMemoryBackend) ListLFTagExpressions(
	catalogID string,
	maxResults int,
	nextToken string,
) ([]*LFTagExpression, string)

ListLFTagExpressions returns a paginated list of LF-tag expressions for the given catalog.

func (*InMemoryBackend) ListLFTags 

func (b *InMemoryBackend) ListLFTags(catalogID string, maxResults int, nextToken string) ([]*LFTag, string)

ListLFTags returns a paginated list of LF tags for the given catalog.

func (*InMemoryBackend) ListLakeFormationOptIns 

func (b *InMemoryBackend) ListLakeFormationOptIns(
	principalIdentifier string,
	resource *Resource,
	maxResults int,
	nextToken string,
) ([]*LFOptIn, string)

ListLakeFormationOptIns returns a paginated list of opt-in entries. Optional principalIdentifier acts as a filter.

func (*InMemoryBackend) ListPermissions 

func (b *InMemoryBackend) ListPermissions(
	resource *Resource,
	maxResults int,
	nextToken string,
	principal *DataLakePrincipal,
	resourceType string,
) ([]*PermissionEntry, string)

ListPermissions returns a paginated list of permission entries filtered by resource, principal, and/or resource type. resource mirrors the real ListPermissionsInput.Resource shape (a nested Resource union), not a flat ARN -- see permissionMatchesResource.

func (*InMemoryBackend) ListResources 

func (b *InMemoryBackend) ListResources(maxResults int, nextToken string) ([]*ResourceInfo, string)

ListResources returns a paginated list of registered resources.

func (*InMemoryBackend) ListTableStorageOptimizers 

func (b *InMemoryBackend) ListTableStorageOptimizers(
	catalogID, databaseName, tableName, storageOptimizerType string,
) []StorageOptimizer

ListTableStorageOptimizers returns the storage optimizers for a table, filtered by type if specified.

func (*InMemoryBackend) ListTransactions 

func (b *InMemoryBackend) ListTransactions(
	statusFilter string, maxResults int, nextToken string,
) ([]*Transaction, string)

ListTransactions returns a paginated list of transactions, optionally filtered by status.

func (*InMemoryBackend) OptInCount 

func (b *InMemoryBackend) OptInCount() int

OptInCount returns the number of opt-in entries in the backend (test helper).

func (*InMemoryBackend) PermissionCount 

func (b *InMemoryBackend) PermissionCount() int

PermissionCount returns the number of permission entries in the backend (test helper).

func (*InMemoryBackend) PutDataLakeSettings 

func (b *InMemoryBackend) PutDataLakeSettings(settings *DataLakeSettings)

PutDataLakeSettings replaces the data lake settings.

func (*InMemoryBackend) RegisterResource 

func (b *InMemoryBackend) RegisterResource(resourceArn, roleArn string, opts RegisterResourceOptions) error

RegisterResource registers an S3 location as a data lake resource.

func (*InMemoryBackend) RemoveLFTagsFromResource 

func (b *InMemoryBackend) RemoveLFTagsFromResource(
	_ string,
	resource *Resource,
	lfTags []LFTagPair,
) []LFTagError

RemoveLFTagsFromResource detaches LF-tags from the specified resource. Failures are returned for any tag not currently attached to the resource.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset restores the backend to a clean initial state.

func (*InMemoryBackend) ResourceCount 

func (b *InMemoryBackend) ResourceCount() int

ResourceCount returns the number of registered resources in the backend (test helper).

func (*InMemoryBackend) ResourceLFTagCount 

func (b *InMemoryBackend) ResourceLFTagCount() int

ResourceLFTagCount returns the number of resources with LF-tag associations (test helper).

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserialises a snapshot produced by Snapshot back into the backend.

func (*InMemoryBackend) RevokePermissions 

func (b *InMemoryBackend) RevokePermissions(ctx context.Context, entry *PermissionEntry) error

RevokePermissions removes specific permissions from a matching entry. If all permissions are revoked, the entry is deleted.

func (*InMemoryBackend) SearchDatabasesByLFTags 

func (b *InMemoryBackend) SearchDatabasesByLFTags(
	expression []LFTag,
	_ string,
	maxResults int,
	nextToken string,
) ([]TaggedDatabase, string)

SearchDatabasesByLFTags returns databases whose LF-tags match all of the given expression tags.

func (*InMemoryBackend) SearchTablesByLFTags 

func (b *InMemoryBackend) SearchTablesByLFTags(
	expression []LFTag,
	catalogID string,
	maxResults int,
	nextToken string,
) ([]TaggedTable, string)

SearchTablesByLFTags returns tables whose LF-tags match all of the given expression tags. It scans b.resourceLFTags for resources of type "table:" and checks whether all expression tags are present in the resource's tag set.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot() ([]byte, error)

Snapshot serialises the backend state to JSON for persistence.

func (*InMemoryBackend) StartJanitor 

func (b *InMemoryBackend) StartJanitor(ctx context.Context)

StartJanitor starts a background goroutine to clean up stale transactions.

func (*InMemoryBackend) StartQueryPlanning 

func (b *InMemoryBackend) StartQueryPlanning(queryString string) string

StartQueryPlanning registers a new query and returns its ID.

func (*InMemoryBackend) StartTransaction 

func (b *InMemoryBackend) StartTransaction(transactionType string) string

StartTransaction begins a new in-flight transaction and returns its ID.

func (*InMemoryBackend) TagCount 

func (b *InMemoryBackend) TagCount() int

TagCount returns the number of LF-tags in the backend (test helper).

func (*InMemoryBackend) TransactionCount 

func (b *InMemoryBackend) TransactionCount() int

TransactionCount returns the number of stored transactions in the backend (test helper).

func (*InMemoryBackend) UpdateDataCellsFilter 

func (b *InMemoryBackend) UpdateDataCellsFilter(filter *DataCellsFilter) error

UpdateDataCellsFilter replaces an existing data cells filter.

func (*InMemoryBackend) UpdateLFTag 

func (b *InMemoryBackend) UpdateLFTag(catalogID, tagKey string, tagValuesToAdd, tagValuesToDelete []string) error

UpdateLFTag adds and removes values from an existing LF tag. TagValues are sorted after modification for deterministic output.

func (*InMemoryBackend) UpdateLFTagExpression 

func (b *InMemoryBackend) UpdateLFTagExpression(name, catalogID, description string, expression []LFTag) error

UpdateLFTagExpression updates the description and expression of an existing LF-tag expression.

func (*InMemoryBackend) UpdateLakeFormationIdentityCenterConfiguration 

func (b *InMemoryBackend) UpdateLakeFormationIdentityCenterConfiguration(
	catalogID string, externalFiltering *ExternalFilteringConfiguration, appStatus string,
	shareRecipients []DataLakePrincipal, serviceIntegrations []ServiceIntegration,
) error

UpdateLakeFormationIdentityCenterConfiguration updates or creates the identity center config. shareRecipients/serviceIntegrations use a nil-vs-non-nil-empty-slice distinction to match the real API's "unspecified leaves it unchanged, explicit empty list clears it" semantics (encoding/json already distinguishes an omitted/null JSON field, which unmarshals to a nil Go slice, from an explicit "[]", which unmarshals to a non-nil empty slice).

func (*InMemoryBackend) UpdateResource 

func (b *InMemoryBackend) UpdateResource(resourceArn, roleArn string, opts RegisterResourceOptions) error

UpdateResource updates the role ARN of an already registered resource.

func (*InMemoryBackend) UpdateTableObjects 

func (b *InMemoryBackend) UpdateTableObjects(
	catalogID, databaseName, tableName, transactionID string,
	writes []WriteOperation,
) error

UpdateTableObjects validates the transaction and records the write operations.

func (*InMemoryBackend) UpdateTableStorageOptimizer 

func (b *InMemoryBackend) UpdateTableStorageOptimizer(
	catalogID, databaseName, tableName string, config map[string]map[string]string,
) string

UpdateTableStorageOptimizer replaces the storage optimizer config for a table.

type LFOptIn 

type LFOptIn struct {
	Principal     *DataLakePrincipal `json:"Principal,omitempty"`
	Resource      *Resource          `json:"Resource,omitempty"`
	Condition     *Condition         `json:"Condition,omitempty"`
	LastModified  string             `json:"LastModified,omitempty"`
	LastUpdatedBy string             `json:"LastUpdatedBy,omitempty"`
}

LFOptIn associates a principal and resource for opt-in enforcement. This is the internal representation -- LastModified is an RFC3339 string for business-logic convenience. HTTP responses must go through toLFOptInWire, which re-encodes it as epoch seconds to match the real wire format (see lfOptInWire).

type LFTag 

type LFTag struct {
	CatalogID string   `json:"CatalogId,omitempty"`
	TagKey    string   `json:"TagKey"`
	TagValues []string `json:"TagValues"`
}

LFTag represents a Lake Formation tag with its allowed values.

type LFTagError 

type LFTagError struct {
	LFTag *LFTagPair   `json:"LFTag,omitempty"`
	Error *errorDetail `json:"Error,omitempty"`
}

LFTagError represents a failure to attach or detach a single LF-tag.

type LFTagExpression 

type LFTagExpression struct {
	Name        string  `json:"Name"`
	Description string  `json:"Description,omitempty"`
	CatalogID   string  `json:"CatalogId,omitempty"`
	Expression  []LFTag `json:"Expression,omitempty"`
}

LFTagExpression holds a saved, named LF-tag expression.

type LFTagExpressionResource added in v1.2.0 

type LFTagExpressionResource struct {
	Name      string `json:"Name"`
	CatalogID string `json:"CatalogId,omitempty"`
}

LFTagExpressionResource identifies a saved LF-tag expression as a permission resource.

type LFTagKeyResource added in v1.2.0 

type LFTagKeyResource struct {
	CatalogID string   `json:"CatalogId,omitempty"`
	TagKey    string   `json:"TagKey"`
	TagValues []string `json:"TagValues"`
}

LFTagKeyResource identifies an LF-tag key/values pair as a permission resource.

type LFTagPair 

type LFTagPair struct {
	CatalogID string   `json:"CatalogId,omitempty"`
	TagKey    string   `json:"TagKey"`
	TagValues []string `json:"TagValues"`
}

LFTagPair represents an LF-tag key with its associated values attached to a resource.

type LFTagPolicyResource added in v1.2.0 

type LFTagPolicyResource struct {
	CatalogID      string  `json:"CatalogId,omitempty"`
	ResourceType   string  `json:"ResourceType"`
	ExpressionName string  `json:"ExpressionName,omitempty"`
	Expression     []LFTag `json:"Expression,omitempty"`
}

LFTagPolicyResource identifies an LF-tag policy (a set of LF-tag conditions, or a reference to a saved expression) applying to DATABASE or TABLE resources.

type Partition 

type Partition struct {
	Values []string `json:"Values,omitempty"`
}

Partition represents a Glue partition.

type PartitionedTableObjectsList 

type PartitionedTableObjectsList struct {
	PartitionValues []string      `json:"PartitionValues,omitempty"`
	Objects         []TableObject `json:"Objects,omitempty"`
}

PartitionedTableObjectsList holds objects for a partition.

type PermissionEntry 

type PermissionEntry struct {
	Principal                  *DataLakePrincipal `json:"Principal,omitempty"`
	Resource                   *Resource          `json:"Resource,omitempty"`
	Condition                  *Condition         `json:"Condition,omitempty"`
	LastUpdated                *time.Time         `json:"LastUpdated,omitempty"`
	LastUpdatedBy              string             `json:"LastUpdatedBy,omitempty"`
	Permissions                []string           `json:"Permissions,omitempty"`
	PermissionsWithGrantOption []string           `json:"PermissionsWithGrantOption,omitempty"`
}

PermissionEntry associates a principal and resource with a set of permissions.

type PlanningStatistics 

type PlanningStatistics struct {
	EstimatedDataToScanBytes *int64 `json:"EstimatedDataToScanBytes,omitempty"`
	PlanningTimeMillis       *int64 `json:"PlanningTimeMillis,omitempty"`
	QueueTimeMillis          *int64 `json:"QueueTimeMillis,omitempty"`
	WorkUnitsGeneratedCount  *int64 `json:"WorkUnitsGeneratedCount,omitempty"`
}

PlanningStatistics holds query planning statistics.

type PrincipalPermissions 

type PrincipalPermissions struct {
	Principal   *DataLakePrincipal `json:"Principal,omitempty"`
	Permissions []string           `json:"Permissions,omitempty"`
}

PrincipalPermissions pairs a principal with a set of permissions.

type Provider 

type Provider struct{}

Provider implements service.Provider for the Lake Formation service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Lake Formation service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type QueryPlanningContext 

type QueryPlanningContext struct {
	CatalogID       string            `json:"CatalogId,omitempty"`
	DatabaseName    string            `json:"DatabaseName"`
	QueryAsOfTime   *string           `json:"QueryAsOfTime,omitempty"`
	QueryParameters map[string]string `json:"QueryParameters,omitempty"`
	TransactionID   string            `json:"TransactionId,omitempty"`
}

QueryPlanningContext provides context for query planning.

type RedshiftConnect added in v1.3.1 

type RedshiftConnect struct {
	Authorization string `json:"Authorization,omitempty"`
}

RedshiftConnect describes the Redshift Connect service-integration authorization state, matching the real types.RedshiftConnect.

type RedshiftScopeUnion added in v1.3.1 

type RedshiftScopeUnion struct {
	RedshiftConnect *RedshiftConnect `json:"RedshiftConnect,omitempty"`
}

RedshiftScopeUnion wraps a single Redshift-scoped service integration entry, matching the real types.RedshiftScopeUnion (currently a single-member union: RedshiftConnect).

type RegisterResourceOptions added in v1.2.0 

type RegisterResourceOptions struct {
	ExpectedResourceOwnerAccount string
	WithFederation               bool
	WithPrivilegedAccess         bool
	HybridAccessEnabled          bool
}

RegisterResourceOptions carries the RegisterResource/UpdateResource fields beyond ResourceArn/RoleArn that the real AWS API supports (see types.RegisterResourceInput / types.UpdateResourceInput). A zero value matches the pre-existing 2-arg registration behavior.

type Resource 

type Resource struct {
	Catalog          *CatalogResource          `json:"Catalog,omitempty"`
	Database         *DatabaseResource         `json:"Database,omitempty"`
	Table            *TableResource            `json:"Table,omitempty"`
	TableWithColumns *TableWithColumnsResource `json:"TableWithColumns,omitempty"`
	DataLocation     *DataLocationResource     `json:"DataLocation,omitempty"`
	DataCellsFilter  *DataCellsFilterResource  `json:"DataCellsFilter,omitempty"`
	LFTag            *LFTagKeyResource         `json:"LFTag,omitempty"`
	LFTagExpression  *LFTagExpressionResource  `json:"LFTagExpression,omitempty"`
	LFTagPolicy      *LFTagPolicyResource      `json:"LFTagPolicy,omitempty"`
}

Resource describes the resource to which permissions are granted.

type ResourceInfo 

type ResourceInfo struct {
	LastModified                 *time.Time `json:"LastModified,omitempty"`
	ResourceArn                  string     `json:"ResourceArn"`
	RoleArn                      string     `json:"RoleArn"`
	ExpectedResourceOwnerAccount string     `json:"ExpectedResourceOwnerAccount,omitempty"`
	VerificationStatus           string     `json:"VerificationStatus,omitempty"`
	HybridAccessEnabled          bool       `json:"HybridAccessEnabled,omitempty"`
	WithFederation               bool       `json:"WithFederation,omitempty"`
	WithPrivilegedAccess         bool       `json:"WithPrivilegedAccess,omitempty"`
}

ResourceInfo holds registration info for a data lake resource. This is the internal/persisted representation -- LastModified is a *time.Time for business-logic convenience. HTTP responses must go through toResourceInfoWire, which re-encodes LastModified as epoch seconds to match the real wire format (see resourceInfoWire).

type RowFilter 

type RowFilter struct {
	AllRowsWildcard  *AllRowsWildcard `json:"AllRowsWildcard,omitempty"`
	FilterExpression string           `json:"FilterExpression,omitempty"`
}

RowFilter holds a filter expression for a data cells filter.

type SAMLCredentials 

type SAMLCredentials struct {
	AccessKeyID     string  `json:"AccessKeyId,omitempty"`
	SecretAccessKey string  `json:"SecretAccessKey,omitempty"`
	SessionToken    string  `json:"SessionToken,omitempty"`
	Expiration      float64 `json:"Expiration,omitempty"`
}

SAMLCredentials is the response body for AssumeDecoratedRoleWithSAML. Expiration is emitted as epoch seconds (a JSON number) via awstime.Epoch, matching the real AssumeDecoratedRoleWithSAMLOutput.Expiration wire format -- the aws-sdk-go-v2 deserializer rejects an RFC3339 string here.

type ServiceIntegration added in v1.3.1 

type ServiceIntegration struct {
	Redshift []RedshiftScopeUnion `json:"Redshift,omitempty"`
}

ServiceIntegration is one entry of CreateLakeFormationIdentityCenterConfigurationInput.ServiceIntegrations / UpdateLakeFormationIdentityCenterConfigurationInput.ServiceIntegrations / DescribeLakeFormationIdentityCenterConfigurationOutput.ServiceIntegrations, matching the real types.ServiceIntegrationUnion (currently a single-member union: Redshift).

type StorageBackend 

type StorageBackend interface {
	Reset()

	GetDataLakeSettings() *DataLakeSettings
	PutDataLakeSettings(settings *DataLakeSettings)

	RegisterResource(resourceArn, roleArn string, opts RegisterResourceOptions) error
	UpdateResource(resourceArn, roleArn string, opts RegisterResourceOptions) error
	DeregisterResource(resourceArn string) error
	DescribeResource(resourceArn string) (*ResourceInfo, error)
	ListResources(maxResults int, nextToken string) ([]*ResourceInfo, string)

	GrantPermissions(ctx context.Context, entry *PermissionEntry) error
	RevokePermissions(ctx context.Context, entry *PermissionEntry) error
	ListPermissions(
		resource *Resource,
		maxResults int,
		nextToken string,
		principal *DataLakePrincipal,
		resourceType string,
	) ([]*PermissionEntry, string)

	CreateLFTag(catalogID, tagKey string, tagValues []string) error
	DeleteLFTag(catalogID, tagKey string) error
	GetLFTag(catalogID, tagKey string) (*LFTag, error)
	UpdateLFTag(catalogID, tagKey string, tagValuesToAdd, tagValuesToDelete []string) error
	ListLFTags(catalogID string, maxResults int, nextToken string) ([]*LFTag, string)

	BatchGrantPermissions(ctx context.Context, entries []*BatchPermissionsRequestEntry) []*BatchFailureEntry
	BatchRevokePermissions(ctx context.Context, entries []*BatchPermissionsRequestEntry) []*BatchFailureEntry

	AddLFTagsToResource(catalogID string, resource *Resource, lfTags []LFTagPair) []LFTagError
	RemoveLFTagsFromResource(catalogID string, resource *Resource, lfTags []LFTagPair) []LFTagError
	GetResourceLFTags(catalogID string, resource *Resource) ([]LFTagPair, error)

	AssumeDecoratedRoleWithSAML(
		principalArn, roleArn, samlAssertion string,
		durationSeconds *int32,
	) *SAMLCredentials

	StartTransaction(transactionType string) string
	CancelTransaction(transactionID string) error
	CommitTransaction(transactionID string) (string, error)
	DescribeTransaction(transactionID string) (*Transaction, error)
	ListTransactions(statusFilter string, maxResults int, nextToken string) ([]*Transaction, string)

	CreateDataCellsFilter(filter *DataCellsFilter) error
	DeleteDataCellsFilter(tableCatalogID, databaseName, tableName, name string) error
	ListDataCellsFilter(
		tableCatalogID, databaseName, tableName string,
		maxResults int,
		nextToken string,
	) ([]*DataCellsFilter, string)

	CreateLFTagExpression(name, description, catalogID string, expression []LFTag) error
	DeleteLFTagExpression(name, catalogID string) error
	ListLFTagExpressions(catalogID string, maxResults int, nextToken string) ([]*LFTagExpression, string)

	CreateLakeFormationIdentityCenterConfiguration(
		catalogID, instanceArn string,
		externalFiltering *ExternalFilteringConfiguration,
		shareRecipients []DataLakePrincipal,
		serviceIntegrations []ServiceIntegration,
	) (string, error)
	DeleteLakeFormationIdentityCenterConfiguration(catalogID string) error
	DescribeLakeFormationIdentityCenterConfiguration(catalogID string) (*IdentityCenterConfiguration, error)
	UpdateLakeFormationIdentityCenterConfiguration(
		catalogID string,
		externalFiltering *ExternalFilteringConfiguration,
		appStatus string,
		shareRecipients []DataLakePrincipal,
		serviceIntegrations []ServiceIntegration,
	) error

	CreateLakeFormationOptIn(principal *DataLakePrincipal, resource *Resource, condition *Condition) error
	DeleteLakeFormationOptIn(principal *DataLakePrincipal, resource *Resource, condition *Condition) error
	ListLakeFormationOptIns(
		principalIdentifier string,
		resource *Resource,
		maxResults int,
		nextToken string,
	) ([]*LFOptIn, string)

	GetDataLakePrincipal(ctx context.Context) *DataLakePrincipal

	ExtendTransaction(transactionID string) error
	DeleteObjectsOnCancel(transactionID string) error

	GetDataCellsFilter(tableCatalogID, databaseName, tableName, name string) (*DataCellsFilter, error)
	UpdateDataCellsFilter(filter *DataCellsFilter) error

	GetLFTagExpression(name, catalogID string) (*LFTagExpression, error)
	UpdateLFTagExpression(name, catalogID, description string, expression []LFTag) error

	GetEffectivePermissionsForPath(resourceArn string, maxResults int, nextToken string) ([]*PermissionEntry, string)

	GetTemporaryCredentials(durationSeconds *int32) *TemporaryCredentials

	GetTableObjects(
		catalogID, databaseName, tableName, transactionID string,
		maxResults int,
		nextToken string,
	) ([]PartitionedTableObjectsList, string)
	UpdateTableObjects(catalogID, databaseName, tableName, transactionID string, writes []WriteOperation) error

	StartQueryPlanning(queryString string) string
	GetQueryState(queryID string) (string, error)
	GetQueryStatistics(queryID string) (*ExecutionStatistics, *PlanningStatistics, error)
	GetWorkUnits(queryID string) ([]WorkUnitRange, string, error)
	GetWorkUnitResults(queryID string, workUnitID int64, workUnitToken string) (string, error)

	ListTableStorageOptimizers(catalogID, databaseName, tableName, storageOptimizerType string) []StorageOptimizer
	UpdateTableStorageOptimizer(catalogID, databaseName, tableName string, config map[string]map[string]string) string

	SearchDatabasesByLFTags(
		expression []LFTag, catalogID string, maxResults int, nextToken string,
	) ([]TaggedDatabase, string)
	SearchTablesByLFTags(
		expression []LFTag, catalogID string, maxResults int, nextToken string,
	) ([]TaggedTable, string)
}

StorageBackend is the interface for Lake Formation backend operations.

type StorageOptimizer 

type StorageOptimizer struct {
	StorageOptimizerType string            `json:"StorageOptimizerType,omitempty"`
	Config               map[string]string `json:"Config,omitempty"`
	ErrorMessage         string            `json:"ErrorMessage,omitempty"`
}

StorageOptimizer holds storage optimizer info.

type TableObject 

type TableObject struct {
	Size *int64 `json:"Size,omitempty"`
	URI  string `json:"Uri"`
	ETag string `json:"ETag,omitempty"`
}

TableObject represents an object in a governed table.

type TableResource 

type TableResource struct {
	TableWildcard *TableWildcard `json:"TableWildcard,omitempty"`
	CatalogID     string         `json:"CatalogId,omitempty"`
	DatabaseName  string         `json:"DatabaseName"`
	Name          string         `json:"Name,omitempty"`
}

TableResource represents a table resource.

type TableWildcard added in v1.2.0 

type TableWildcard struct{}

TableWildcard is a structure that indicates all tables in a database.

type TableWithColumnsResource 

type TableWithColumnsResource struct {
	ColumnWildcard *ColumnWildcard `json:"ColumnWildcard,omitempty"`
	CatalogID      string          `json:"CatalogId,omitempty"`
	DatabaseName   string          `json:"DatabaseName"`
	Name           string          `json:"Name"`
	ColumnNames    []string        `json:"ColumnNames,omitempty"`
}

TableWithColumnsResource represents a table resource with column-level access.

type TaggedDatabase 

type TaggedDatabase struct {
	Database *DatabaseResource `json:"Database,omitempty"`
	LFTags   []LFTagPair       `json:"LFTags,omitempty"`
}

TaggedDatabase holds a database with its LF-tags.

type TaggedTable 

type TaggedTable struct {
	Table           *TableResource `json:"Table,omitempty"`
	LFTagOnDatabase []LFTagPair    `json:"LFTagOnDatabase,omitempty"`
	LFTagsOnTable   []LFTagPair    `json:"LFTagsOnTable,omitempty"`
	LFTagsOnColumns []ColumnLFTag  `json:"LFTagsOnColumns,omitempty"`
}

TaggedTable holds a table with its LF-tags.

type TemporaryCredentials 

type TemporaryCredentials struct {
	AccessKeyID     string  `json:"AccessKeyId,omitempty"`
	SecretAccessKey string  `json:"SecretAccessKey,omitempty"`
	SessionToken    string  `json:"SessionToken,omitempty"`
	Expiration      float64 `json:"Expiration,omitempty"`
}

TemporaryCredentials holds temporary AWS credentials. Expiration is emitted as epoch seconds (a JSON number) via awstime.Epoch, matching the real types.TemporaryCredentials.Expiration wire format.

type Transaction 

type Transaction struct {
	TransactionID        string `json:"TransactionId"`
	TransactionStatus    string `json:"TransactionStatus"`
	TransactionStartTime string `json:"TransactionStartTime,omitempty"`
	TransactionEndTime   string `json:"TransactionEndTime,omitempty"`
}

Transaction represents an in-flight Lake Formation governed table transaction. This is the internal representation -- TransactionStartTime and TransactionEndTime are RFC3339 strings for business-logic convenience. HTTP responses must go through toTransactionWire, which re-encodes them as epoch seconds to match the real wire format (see transactionWire).

type VirtualObject 

type VirtualObject struct {
	URI  string `json:"Uri"`
	ETag string `json:"ETag,omitempty"`
}

VirtualObject is a reference to an S3 object.

type WorkUnitRange 

type WorkUnitRange struct {
	WorkUnitToken string `json:"WorkUnitToken"`
	WorkUnitIDMax int64  `json:"WorkUnitIdMax"`
	WorkUnitIDMin int64  `json:"WorkUnitIdMin"`
}

WorkUnitRange represents a range of work units.

type WriteOperation 

type WriteOperation struct {
	AddObject    *TableObject   `json:"AddObject,omitempty"`
	DeleteObject *VirtualObject `json:"DeleteObject,omitempty"`
}

WriteOperation represents a single governed table write.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.