create_data_permissions_on_dataset¶

DatasetsApi.create_data_permissions_on_dataset(id, role_id, data_permissions, content_type=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)¶

Create a Lake Formation data filter on a dataset

Creates a Lake Formation data-cells filter and starts the async data-permission grant workflow (Step Functions). Caller (role_id) must be owner or editor of the dataset. Not supported for TBAC-enabled datasets. Name must not contain whitespace; Lake Formation filter name is derived as {Domain}_{DatasetName}_{Name} (truncated to 255). Not idempotent: recreating an existing filter name fails in Lake Formation (DS-1079).

Parameters:

id (str) – Dataset ID on which to create the data filter. (required)
role_id (str) – Amorphic role ID used for authorization. Must be a role the user belongs to with owner or editor permission on the dataset. (required)
data_permissions (DataPermissions) – (required)
content_type (str) – Must be application/json.
_request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.
_request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.
_content_type (str, Optional) – force content-type for the request.
_headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.
_host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

CreateDataPermissionsResponse

Returns:

Returns the result object.

Request and Response Examples¶

HTTP: POST /datasets/{id}/data-permissions

Request¶

Request / response example

{
  "Name": "df2",
  "Columns": {
    "Condition": "include",
    "Expression": [
      "CustomerID",
      "Gender"
    ]
  },
  "Rows": {
    "Condition": "all",
    "Expression": "all"
  },
  "AuthorizedTags": [
    "user#userid"
  ],
  "Encoding": "none"
}

Success (HTTP 200)¶

Data filter created in Lake Formation and metadata persisted; async tag grant/prepare workflow started. Message is “Data Permission create process started”.

Request / response example

{
  "Message": "Data Permission create process started"
}

Errors¶

Documented error codes: IPV-1055, IPV-1060, IPV-1007, IPV-1059, IPV-1045, AUTH-1010, DS-1079, GE-1034, DB-1002.

HTTP 400

Validation or authorization failure. Body is {“Message”: “<CODE> - <text>”} or a plain Message for some auth failures. Codes include IPV-1055 (missing Name/Columns/Rows/AuthorizedTags), IPV-1060 (wrong types), IPV-1007 (Name contains whitespace), IPV-1059 (invalid column names), IPV-1045 (empty Rows.Expression), AUTH-1010 (tag not eligible for data filter), DS-1079 (Lake Formation create failure), plus “Not authorized to create dataset data permissions” and GE-1034 for TBAC datasets.

Missing mandatory body fields

{
  "Message": "IPV-1055 - Missing mandatory params for updating user data permissions - {'Name'}"
}

Caller is not owner/editor

{
  "Message": "Not authorized to create dataset data permissions"
}

Column names not in dataset schema

{
  "Message": "IPV-1059 - Failed to assign permissions due to invalid columns {'BadCol'} present in the request body"
}

HTTP 500

Backend failure (e.g. DB-1002 when persisting the data filter metadata fails).