Troubleshooting AWS Lake Formation permissions for Amazon DataZone
This section contains troubleshooting instructions for issues that you might encounter when you Configure Lake Formation permissions for Amazon DataZone.
Error message in the Data Portal | Resolution |
---|---|
Unable to assume the Data Access Role. |
This error is displayed when Amazon DataZone is unable to assume the AmazonDataZoneGlueDataAccessRole that you used to enable the DefaultDataLakeBlueprint in your account. To fix the issue, go to the AWS IAM console in the account where your data asset exists and make sure that the AmazonDataZoneGlueDataAccessRole has the right trust relationship with the Amazon DataZone service principal. For more information, see AmazonDataZoneGlueAccess-<region>-<domainId> |
The Data Access Role does not have the necessary permissions to read the metadata of the asset you are trying to subscribe. |
This error is displayed when Amazon DataZone successfully assumes the AmazonDataZoneGlueDataAccessRole role, but the role does not have the necessary permissions. To fix the issue, go to the AWS IAM console in the account where your data asset exists and make sure that the role has the AmazonDataZoneGlueManageAccessRolePolicy attached it. For more information, see AmazonDataZoneGlueAccess-<region>-<domainId>. |
Asset is a resource link. Amazon DataZone does not support subscriptions to resource links. |
This error is displayed when the asset you are trying to publish to Amazon DataZone is a resource link to an AWS Glue table. |
Asset is not managed by AWS Lake Formation. |
This error indicates that the AWS Lake Formation permissions are not enforced on the asset that you want to publish. This can happen in the following cases.
|
Data Access role does not have necessary Lake Formation permissions to grant access to this asset. |
This error indicates that the AmazonDataZoneGlueDataAccessRole that you are using to enable the DefaultDataLakeBlueprint in your account does not have the necessary permissions for Amazon DataZone to manage permissions on the published asset. You can resolve the issue by either adding the AmazonDataZoneGlueDataAccessRole as the AWS Lake Formation administrator or by granting the following permissions to the AmazonDataZoneGlueDataAccessRole on the asset that you want to publish.
|