The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The database, table, or column resource to which to attach an LF-tag.

The LF-tags to attach to the resource.

A list of failures to tag the resource.

The response's http status code.

The time period, between 900 and 43,200 seconds, for the timeout of the temporary credentials.

A SAML assertion consisting of an assertion statement for the user who needs temporary credentials. This must match the SAML assertion that was issued to IAM. This must be Base64 encoded.

The role that represents an IAM principal whose scope down policy allows it to call credential vending APIs such as GetTemporaryTableCredentials. The caller must also have iam:PassRole permission on this role.

The Amazon Resource Name (ARN) of the SAML provider in IAM that describes the IdP.

The access key ID for the temporary credentials. (The access key consists of an access key ID and a secret key).

The date and time when the temporary credentials expire.

The secret key for the temporary credentials. (The access key consists of an access key ID and a secret key).

The session token for the temporary credentials.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

A list of up to 20 entries for resource permissions to be granted by batch operation to the principal.

A list of failures to grant permissions to the resources.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

A list of up to 20 entries for resource permissions to be revoked by batch operation to the principal.

A list of failures to revoke permissions to the resources.

The response's http status code.

The transaction to cancel.

The response's http status code.

The transaction to commit.

The status of the transaction.

The response's http status code.

A DataCellsFilter structure containing information about the data cells filter.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The key-name for the LF-tag.

A list of possible values an attribute can take.

The response's http status code.

A database in the Glue Data Catalog.

The name given by the user to the data filter cell.

The ID of the catalog to which the table belongs.

A table in the database.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The key-name for the LF-tag to delete.

The response's http status code.

The Glue data catalog that contains the governed table. Defaults to the current account ID.

The database that contains the governed table.

The name of the governed table.

ID of the transaction that the writes occur in.

A list of VirtualObject structures, which indicates the Amazon S3 objects to be deleted if the transaction cancels.

The response's http status code.

The Amazon Resource Name (ARN) of the resource that you want to deregister.

The response's http status code.

The resource ARN.

A structure containing information about an Lake Formation resource.

The response's http status code.

The transaction for which to return status.

Returns a TransactionDescription object containing information about the transaction.

The response's http status code.

The transaction to extend.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

A structure representing a list of Lake Formation principals designated as data lake administrators.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The maximum number of results to return.

A continuation token, if this is not the first call to retrieve this list.

The Amazon Resource Name (ARN) of the resource for which you want to get permissions.

A continuation token, if this is not the first call to retrieve this list.

A list of the permissions for the specified table or database resource located at the path in Amazon S3.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The key-name for the LF-tag.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The key-name for the LF-tag.

A list of possible values an attribute can take.

The response's http status code.

The ID of the plan query operation.

An error message when the operation fails.

The response's http status code.

The state of a query previously submitted. The possible states are:

• PENDING: the query is pending.
• WORKUNITS_AVAILABLE: some work units are ready for retrieval and execution.
• FINISHED: the query planning finished successfully, and all work units are ready for retrieval and execution.
• ERROR: an error occurred with the query, such as an invalid query ID or a backend error.

The ID of the plan query operation.

An ExecutionStatistics structure containing execution statistics.

A PlanningStatistics structure containing query planning statistics.

The time that the query was submitted.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

Indicates whether to show the assigned LF-tags.

The database, table, or column resource for which you want to return LF-tags.

A list of LF-tags applied to a database resource.

A list of LF-tags applied to a column resource.

A list of LF-tags applied to a table resource.

The response's http status code.

The catalog containing the governed table. Defaults to the caller’s account.

Specifies how many values to return in a page.

A continuation token if this is not the first call to retrieve these objects.

A predicate to filter the objects returned based on the partition keys defined in the governed table.

• The comparison operators supported are: =, >, <, >=, <=
• The logical operators supported are: AND
• The data types supported are integer, long, date(yyyy-MM-dd), timestamp(yyyy-MM-dd HH:mm:ssXXX or yyyy-MM-dd HH:mm:ss"), string and decimal.

The time as of when to read the governed table contents. If not set, the most recent transaction commit time is used. Cannot be specified along with TransactionId.

The transaction ID at which to read the governed table contents. If this transaction has aborted, an error is returned. If not set, defaults to the most recent committed transaction. Cannot be specified along with QueryAsOfTime.

The database containing the governed table.

The governed table for which to retrieve objects.

A continuation token indicating whether additional data is available.

A list of objects organized by partition keys.

The response's http status code.

A structure representing context to access a resource (column names, query ID, etc).

The time period, between 900 and 21,600 seconds, for the timeout of the temporary credentials.

Filters the request based on the user having been granted a list of specified permissions on the requested resource(s).

The ARN of the partitions' table.

A list of partition values identifying a single partition.

A list of supported permission types for the partition. Valid values are COLUMN_PERMISSION and CELL_FILTER_PERMISSION.

The access key ID for the temporary credentials.

The date and time when the temporary credentials expire.

The secret key for the temporary credentials.

The session token for the temporary credentials.

The response's http status code.

A structure representing context to access a resource (column names, query ID, etc).

The time period, between 900 and 21,600 seconds, for the timeout of the temporary credentials.

Filters the request based on the user having been granted a list of specified permissions on the requested resource(s).

The ARN identifying a table in the Data Catalog for the temporary credentials request.

A list of supported permission types for the table. Valid values are COLUMN_PERMISSION and CELL_FILTER_PERMISSION.

The access key ID for the temporary credentials.

The date and time when the temporary credentials expire.

The secret key for the temporary credentials.

The session token for the temporary credentials.

The response's http status code.

The ID of the plan query operation for which to get results.

The work unit ID for which to get results. Value generated by enumerating WorkUnitIdMin to WorkUnitIdMax (inclusive) from the WorkUnitRange in the output of GetWorkUnits.

A work token used to query the execution service. Token output from GetWorkUnits.

The response's http status code.

Rows returned from the GetWorkUnitResults operation as a stream of Apache Arrow v1.0 messages.

A continuation token, if this is a continuation call.

The size of each page to get in the Amazon Web Services service call. This does not affect the number of items returned in the command's output. Setting a smaller page size results in more calls to the Amazon Web Services service, retrieving fewer items in each call. This can help prevent the Amazon Web Services service calls from timing out.

The ID of the plan query operation.

A continuation token for paginating the returned list of tokens, returned if the current segment of the list is not the last.

The response's http status code.

The ID of the plan query operation.

A WorkUnitRangeList object that specifies the valid range of work unit IDs for querying the execution service.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

Indicates a list of the granted permissions that the principal may pass to other users. These permissions may only be a subset of the permissions granted in the Privileges.

The principal to be granted the permissions on the resource. Supported principals are IAM users or IAM roles, and they are defined by their principal type and their ARN.

Note that if you define a resource with a particular ARN, then later delete, and recreate a resource with that same ARN, the resource maintains the permissions already granted.

The resource to which permissions are to be granted. Resources in Lake Formation are the Data Catalog, databases, and tables.

The permissions granted to the principal on the resource. Lake Formation defines privileges to grant and revoke access to metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3. Lake Formation requires that each principal be authorized to perform a specific task on Lake Formation resources.

The response's http status code.

The maximum size of the response.

A continuation token, if this is a continuation call.

A table in the Glue Data Catalog.

A list of DataCellFilter structures.

A continuation token, if not all requested data cell filters have been returned.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The maximum number of results to return.

A continuation token, if this is not the first call to retrieve this list.

If resource share type is ALL, returns both in-account LF-tags and shared LF-tags that the requester has permission to view. If resource share type is FOREIGN, returns all share LF-tags that the requester can view. If no resource share type is passed, lists LF-tags in the given catalog ID that the requester has permission to view.

A list of LF-tags that the requested has permission to view.

A continuation token, present if the current list segment is not the last.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

Indicates that related permissions should be included in the results.

The maximum number of results to return.

A continuation token, if this is not the first call to retrieve this list.

Specifies a principal to filter the permissions returned.

A resource where you will get a list of the principal permissions.

This operation does not support getting privileges on a table with columns. Instead, call this operation on the table, and the operation returns the table and the table w columns.

Specifies a resource type to filter the permissions returned.

A continuation token, if this is not the first call to retrieve this list.

A list of principals and their permissions on the resource for the specified principal and resource types.

The response's http status code.

Any applicable row-level and/or column-level filtering conditions for the resources.

The maximum number of resource results.

A continuation token, if this is not the first call to retrieve these resources.

A continuation token, if this is not the first call to retrieve these resources.

A summary of the data lake resources.

The response's http status code.

The Catalog ID of the table.

The number of storage optimizers to return on each call.

A continuation token, if this is a continuation call.

The specific type of storage optimizers to list. The supported value is compaction.

Name of the database where the table is present.

Name of the table.

A continuation token for paginating the returned list of tokens, returned if the current segment of the list is not the last.

A list of the storage optimizers associated with a table.

The response's http status code.

The catalog for which to list transactions. Defaults to the account ID of the caller.

The maximum number of transactions to return in a single call.

A continuation token if this is not the first call to retrieve transactions.

A filter indicating the status of transactions to return. Options are ALL | COMPLETED | COMMITTED | ABORTED | ACTIVE. The default is ALL.

A continuation token indicating whether additional data is available.

A list of transactions. The record for each transaction is a TransactionDescription object.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

A structure representing a list of Lake Formation principals designated as data lake administrators.

The response's http status code.

The identifier for the role that registers the resource.

Designates an Identity and Access Management (IAM) service-linked role by registering this role with the Data Catalog. A service-linked role is a unique type of IAM role that is linked directly to Lake Formation.

For more information, see Using Service-Linked Roles for Lake Formation.

The Amazon Resource Name (ARN) of the resource that you want to register.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The database, table, or column resource where you want to remove an LF-tag.

The LF-tags to be removed from the resource.

A list of failures to untag a resource.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

Indicates a list of permissions for which to revoke the grant option allowing the principal to pass permissions to other principals.

The principal to be revoked permissions on the resource.

The resource to which permissions are to be revoked.

The permissions revoked to the principal on the resource. For information about permissions, see Security and Access Control to Metadata and Data.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The maximum number of results to return.

A continuation token, if this is not the first call to retrieve this list.

A list of conditions (LFTag structures) to search for in database resources.

A list of databases that meet the LF-tag conditions.

A continuation token, present if the current list segment is not the last.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The maximum number of results to return.

A continuation token, if this is not the first call to retrieve this list.

A list of conditions (LFTag structures) to search for in table resources.

A continuation token, present if the current list segment is not the last.

A list of tables that meet the LF-tag conditions.

The response's http status code.

A structure containing information about the query plan.

A PartiQL query statement used as an input to the planner service.

The response's http status code.

The ID of the plan query operation can be used to fetch the actual work unit descriptors that are produced as the result of the operation. The ID is also used to get the query state and as an input to the Execute operation.

Indicates whether this transaction should be read only or read and write. Writes made using a read-only transaction ID will be rejected. Read-only transactions do not need to be committed.

An opaque identifier for the transaction.

The response's http status code.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

A list of LF-tag values to add from the LF-tag.

A list of LF-tag values to delete from the LF-tag.

The key-name for the LF-tag for which to add or delete values.

The response's http status code.

The new role to use for the given resource registered in Lake Formation.

The resource ARN.

The response's http status code.

The catalog containing the governed table to update. Defaults to the caller’s account ID.

The transaction at which to do the write.

The database containing the governed table to update.

The governed table to update.

A list of WriteOperation objects that define an object to add to or delete from the manifest for a governed table.

The response's http status code.

The Catalog ID of the table.

Name of the database where the table is present.

Name of the table for which to enable the storage optimizer.

Name of the table for which to enable the storage optimizer.

A response indicating the success of failure of the operation.

The response's http status code.

A list of partition values for the object. A value must be specified for each partition key associated with the table.

The supported data types are integer, long, date(yyyy-MM-dd), timestamp(yyyy-MM-dd HH:mm:ssXXX or yyyy-MM-dd HH:mm:ss"), string and decimal.

The Amazon S3 location of the object.

The Amazon S3 ETag of the object. Returned by GetTableObjects for validation and used to identify changes to the underlying data.

The size of the Amazon S3 object in bytes.

The filter engine can populate the 'AdditionalAuditContext' information with the request ID for you to track. This information will be displayed in CloudTrail log in your account.

An error message that applies to the failure of the entry.

An identifier for an entry of the batch request.

The permissions to be granted.

Indicates if the option to pass permissions is granted.

The principal to be granted a permission.

The resource to which the principal is to be granted a permission.

A unique identifier for the batch permissions request entry.

The LF-tags attached to a column resource.

The name of a column resource.

Excludes column names. Any column with this name will be excluded.

A list of column names.

A wildcard with exclusions.

You must specify either a ColumnNames list or the ColumnWildCard.

A PartiQL predicate.

The ID of the catalog to which the table belongs.

A database in the Glue Data Catalog.

A table in the database.

The name given by the user to the data filter cell.

A database in the Glue Data Catalog.

The name of the data cells filter.

The ID of the catalog to which the table belongs.

The name of the table.

An identifier for the Lake Formation principal.

Whether to allow Amazon EMR clusters to access data managed by Lake Formation.

If true, you allow Amazon EMR clusters to access data in Amazon S3 locations that are registered with Lake Formation.

If false or null, no Amazon EMR clusters will be able to access data in Amazon S3 locations that are registered with Lake Formation.

For more information, see (Optional) Allow Data Filtering on Amazon EMR.

Lake Formation relies on a privileged process secured by Amazon EMR or the third party integrator to tag the user's role while assuming it. Lake Formation will publish the acceptable key-value pair, for example key = "LakeFormationTrustedCaller" and value = "TRUE" and the third party integrator must properly tag the temporary security credentials that will be used to call Lake Formation's administrative APIs.

Specifies whether access control on newly created database is managed by Lake Formation permissions or exclusively by IAM permissions.

A null value indicates access control by Lake Formation permissions. A value that assigns ALL to IAM_ALLOWED_PRINCIPALS indicates access control by IAM permissions. This is referred to as the setting "Use only IAM access control," and is for backward compatibility with the Glue permission model implemented by IAM permissions.

The only permitted values are an empty array or an array that contains a single JSON object that grants ALL to IAM_ALLOWED_PRINCIPALS.

For more information, see Changing the Default Security Settings for Your Data Lake.

Specifies whether access control on newly created table is managed by Lake Formation permissions or exclusively by IAM permissions.

A null value indicates access control by Lake Formation permissions. A value that assigns ALL to IAM_ALLOWED_PRINCIPALS indicates access control by IAM permissions. This is referred to as the setting "Use only IAM access control," and is for backward compatibility with the Glue permission model implemented by IAM permissions.

The only permitted values are an empty array or an array that contains a single JSON object that grants ALL to IAM_ALLOWED_PRINCIPALS.

For more information, see Changing the Default Security Settings for Your Data Lake.

A list of Lake Formation principals. Supported principals are IAM users or IAM roles.

A list of the account IDs of Amazon Web Services accounts with Amazon EMR clusters that are to perform data filtering.>

A key-value map that provides an additional configuration on your data lake. CrossAccountVersion is the key you can configure in the Parameters field. Accepted values for the CrossAccountVersion key are 1, 2, and 3.

A list of the resource-owning account IDs that the caller's account can use to share their user access details (user ARNs). The user ARNs can be logged in the resource owner's CloudTrail log.

You may want to specify this property when you are in a high-trust boundary, such as the same team or company.

The identifier for the Data Catalog where the location is registered with Lake Formation. By default, it is the account ID of the caller.

The Amazon Resource Name (ARN) that uniquely identifies the data location resource.

The identifier for the Data Catalog. By default, it is the account ID of the caller.

The name of the database resource. Unique to the Data Catalog.

The Amazon S3 ETag of the object. Returned by GetTableObjects for validation and used to identify changes to the underlying data.

A list of partition values for the object. A value must be specified for each partition key associated with the governed table.

The Amazon S3 location of the object to delete.

A resource share ARN for a catalog resource shared through RAM.

The code associated with this error.

A message describing the error.

The average time the request took to be executed.

The amount of data that was scanned in bytes.

The number of work units executed.

The comparison operator used in the filter condition.

The field to filter in the filter condition.

A string with values used in evaluating the filter condition.

The key-name for the LF-tag.

A list of possible values an attribute can take.

An error that occurred with the attachment or detachment of the LF-tag.

The key-name of the LF-tag.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The key-name for the LF-tag.

A list of possible values an attribute can take.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The key-name for the LF-tag.

A list of possible values an attribute can take.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

The resource type for which the LF-tag policy applies.

A list of LF-tag conditions that apply to the resource's LF-tag policy.

A list of table objects

A list of partition values.

The list of partition values.

An estimate of the data that was scanned in bytes.

The time that it took to process the request.

The time the request was in queue to be processed.

The number of work units generated.

The permissions that are granted to the principal.

The principal who is granted permissions.

This attribute can be used to return any additional details of PrincipalResourcePermissions. Currently returns only as a RAM resource share ARN.

The permissions to be granted or revoked on the resource.

Indicates whether to grant the ability to grant permissions (as a subset of permissions granted).

The Data Lake principal to be granted or revoked permissions.

The resource where permissions are to be granted or revoked.

The ID of the Data Catalog where the partition in question resides. If none is provided, the Amazon Web Services account ID is used by default.

The time as of when to read the table contents. If not set, the most recent transaction commit time will be used. Cannot be specified along with TransactionId.

A map consisting of key-value pairs.

The transaction ID at which to read the table contents. If this transaction is not committed, the read will be treated as part of that transaction and will see its writes. If this transaction has aborted, an error will be returned. If not set, defaults to the most recent committed transaction. Cannot be specified along with QueryAsOfTime.

The database containing the table.

The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment.

A data cell filter.

The location of an Amazon S3 path where permissions are granted or revoked.

The database for the resource. Unique to the Data Catalog. A database is a set of associated table definitions organized into a logical group. You can Grant and Revoke database permissions to a principal.

The LF-tag key and values attached to a resource.

A list of LF-tag conditions that define a resource's LF-tag policy.

The table for the resource. A table is a metadata definition that represents your data. You can Grant and Revoke table privileges to a principal.

The table with columns for the resource. A principal with permissions to this resource can select metadata from the columns of a table in the Data Catalog and the underlying data in Amazon S3.

The date and time the resource was last modified.

The Amazon Resource Name (ARN) of the resource.

The IAM role that registered a resource.

A wildcard for all rows.

A filter expression.

A map of the storage optimizer configuration. Currently contains only one key-value pair: is_enabled indicates true or false for acceleration.

A message that contains information about any error (if present).

When an acceleration result has an enabled status, the error message is empty.

When an acceleration result has a disabled status, the message describes an error or simply indicates "disabled by the user".

When an acceleration result has an enabled status, contains the details of the last job run.

The specific type of storage optimizer. The supported value is compaction.

A message that contains information about any warnings (if present).

The Amazon S3 ETag of the object. Returned by GetTableObjects for validation and used to identify changes to the underlying data.

The size of the Amazon S3 object in bytes.

The Amazon S3 location of the object.

The identifier for the Data Catalog. By default, it is the account ID of the caller.

The name of the table.

A wildcard object representing every table under a database.

At least one of TableResource$Name or TableResource$TableWildcard is required.

The name of the database for the table. Unique to a Data Catalog. A database is a set of associated table definitions organized into a logical group. You can Grant and Revoke database privileges to a principal.

The identifier for the Data Catalog. By default, it is the account ID of the caller.

The list of column names for the table. At least one of ColumnNames or ColumnWildcard is required.

A wildcard specified by a ColumnWildcard object. At least one of ColumnNames or ColumnWildcard is required.

The name of the database for the table with columns resource. Unique to the Data Catalog. A database is a set of associated table definitions organized into a logical group. You can Grant and Revoke database privileges to a principal.

The name of the table resource. A table is a metadata definition that represents your data. You can Grant and Revoke table privileges to a principal.

A database that has LF-tags attached to it.

A list of LF-tags attached to the database.

A list of LF-tags attached to the database where the table resides.

A list of LF-tags attached to columns in the table.

A list of LF-tags attached to the table.

A table that has LF-tags attached to it.

The time when the transaction committed or aborted, if it is not currently active.

The ID of the transaction.

The time when the transaction started.

A status of ACTIVE, COMMITTED, or ABORTED.

The ETag of the Amazon S3 object.

The path to the Amazon S3 object. Must start with s3://

Defines the maximum work unit ID in the range. The maximum value is inclusive.

Defines the minimum work unit ID in the range.

A work token used to query the execution service.

A new object to add to the governed table.

An object to delete from the governed table.