# Approve and manage access
Project members discover tables through catalog search and request access to the ones they need. As an administrator, you review these requests from the **Subscriptions** page in the admin portal and decide whether to approve or reject them. You can also proactively grant access to specific projects or IAM roles without waiting for a request.
Subscriptions control which IAM roles can query a given asset's underlying data. When a project member requests access to an asset, the system submits a subscription request on behalf of the project's execution role (the IAM role that the project uses to run queries and access data in Lake Formation). When you approve the request, a grant is created in Lake Formation for that execution role.
**Note**
All projects that share the same execution role gain access because the grant is created for the underlying IAM role of the project.
You can also grant access by creating a subscription directly for a project or for a specific IAM role, without waiting for someone to submit a request.
All subscription management happens on the **Subscriptions** page in the admin portal. The page has two tabs:
+ The **Requests** tab shows incoming subscription requests. Each request identifies the person who submitted it and the execution role that will receive the Lake Formation grant.
+ The **Grants** tab shows all active grants across the domain. The **Granted to** column shows either a project name or an IAM role ARN, depending on how the grant was created.
## Review subscription requests
When a project member requests access to an asset, the request appears on the **Requests** tab with a **Pending** status. The **Requested by** column shows the user who requested access. This can be a single sign-on user in IAM Identity Center or an IAM user or role.
**Note**
The user or role that requests access is not necessarily getting the access. The access is granted to the project's execution role which may be different than the user or role requesting access.
Use the **Status** filter to show requests by state: **Pending**, **Approved**, or **Rejected**.
## Approve a request
**To approve a subscription request**
1. Navigate to Amazon SageMaker Unified Studio and choose **Domain management** to open the admin portal.
1. In the left navigation pane under **Catalog**, choose **Subscriptions**.
1. On the **Requests** tab, find the request you want to review.
1. In the **Actions** column, choose **Actions**, then choose **View request**.
1. In the **Review subscription request** panel, review the request details (**Requested for**, **Requested by**, **Reason for access**, **Request date**) and the **Access will be granted to** section showing the IAM execution role ARN.
1. Under **Decision details**, select **Approve**.
1. (Optional) For **Decision comment**, enter a response (up to 150 characters).
1. Choose **Save**.
After approval, Amazon SageMaker Unified Studio creates a Lake Formation grant for the execution role. Project members whose project uses that execution role can then see the asset in their data explorer and query it using the Query Editor or notebooks.
## Reject a request
**To reject a subscription request**
1. Navigate to Amazon SageMaker Unified Studio and choose **Domain management** to open the admin portal.
1. In the left navigation pane under **Catalog**, choose **Subscriptions**.
1. On the **Requests** tab, find the request you want to reject.
1. In the **Actions** column, choose **Actions**, then choose **View request**.
1. Under **Decision details**, select **Reject**.
1. (Optional) For **Decision comment**, enter a response (up to 150 characters).
1. Choose **Save**.
The requesting user sees the rejection status on their Subscriptions page. They can submit a new request with additional justification if needed.
## Grant access directly
You can also grant access to an asset without waiting for someone to submit a request. You can grant access to a project (which resolves to the project's execution role) or directly to a specific IAM role.
**To grant access directly**
1. Navigate to Amazon SageMaker Unified Studio and choose **Domain management** to open the admin portal.
1. In the left navigation pane under **Catalog**, choose **Browse**.
1. Choose the asset you want to share.
1. Choose **Actions**, then choose **Create subscription**.
1. In the **Create subscription** panel, for **Principal type**, choose **Project** or **IAM role**.
+ **Project** lets you select from the projects in the domain. The system grants access to the project's execution role.
+ **IAM role** lets you search for and select a specific IAM role ARN directly.
1. For **Select a project** (or **Find IAM role**), choose the principals you want to grant access to.
1. Choose **Create**.
After the subscription is created, the selected principals gain read access to the asset.
## View and manage existing grants
The **Grants** tab shows all active subscriptions across the domain. Each row shows the asset, who it was granted to, the status, and the date access was granted. The **Granted to** column shows either a project name (for project-level grants) or a full IAM role ARN (for role-level grants).
Use the **Status** filter to narrow the list:
+ **Approved** means access was granted through a subscription request that was approved.
+ **Revoked** means access was previously granted but has been revoked.
Grants created directly by an administrator (through Create subscription) show a status of **Shared**.
To view the full details of a grant, choose the menu icon in the **Actions** column, then choose **View Details**. The details panel shows who requested access, when it was approved, and the approver's comment.
## Revoke access
Revoking a subscription removes the Lake Formation grant from the execution role. The IAM role can no longer query the underlying data for that asset.
**To revoke access**
1. Navigate to Amazon SageMaker Unified Studio and choose **Domain management** to open the admin portal.
1. In the left navigation pane under **Catalog**, choose **Subscriptions**.
1. Choose the **Grants** tab.
1. Find the grant you want to revoke. In the **Actions** column, choose **Actions**, then choose **Revoke**.
1. In the **Revoke access** dialog, review the warning about downstream effects.
1. For **To confirm revoke, type "confirm"**, enter **confirm**.
1. Choose **Revoke**.
After revoking, the asset is no longer queryable by any project that uses the affected execution role. If they need access again, they must submit a new subscription request.