{
  "typeName" : "AWS::LakeFormation::PrincipalPermissions",
  "description" : "The ``AWS::LakeFormation::PrincipalPermissions`` resource represents the permissions that a principal has on a GLUDC resource (such as GLUlong databases or GLUlong tables). When you create a ``PrincipalPermissions`` resource, the permissions are granted via the LFlong``GrantPermissions`` API operation. When you delete a ``PrincipalPermissions`` resource, the permissions on principal-resource pair are revoked via the LFlong``RevokePermissions`` API operation.",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
  "definitions" : {
    "CatalogIdString" : {
      "type" : "string",
      "minLength" : 12,
      "maxLength" : 12
    },
    "PathString" : {
      "type" : "string"
    },
    "ResourceArnString" : {
      "type" : "string"
    },
    "NameString" : {
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 255
    },
    "IAMRoleArn" : {
      "type" : "string",
      "pattern" : "arn:*:iam::[0-9]*:role/.*"
    },
    "LFTag" : {
      "type" : "object",
      "properties" : {
        "TagKey" : {
          "$ref" : "#/definitions/LFTagKey",
          "description" : "The key-name for the LF-tag."
        },
        "TagValues" : {
          "$ref" : "#/definitions/TagValueList",
          "description" : "A list of possible values of the corresponding ``TagKey`` of an LF-tag key-value pair."
        }
      },
      "additionalProperties" : false,
      "description" : "The LF-tag key and values attached to a resource."
    },
    "LFTagPair" : {
      "type" : "object",
      "properties" : {
        "CatalogId" : {
          "$ref" : "#/definitions/CatalogIdString"
        },
        "TagKey" : {
          "$ref" : "#/definitions/LFTagKey"
        },
        "TagValues" : {
          "$ref" : "#/definitions/TagValueList"
        }
      },
      "additionalProperties" : false,
      "required" : [ "TagKey", "TagValues" ],
      "description" : ""
    },
    "LFTagsList" : {
      "type" : "array",
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/LFTagPair"
      }
    },
    "Expression" : {
      "type" : "array",
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/LFTag"
      },
      "minItems" : 1,
      "maxItems" : 5
    },
    "DataLakePrincipalString" : {
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 255
    },
    "DataLakePrincipal" : {
      "type" : "object",
      "properties" : {
        "DataLakePrincipalIdentifier" : {
          "$ref" : "#/definitions/DataLakePrincipalString",
          "description" : "An identifier for the LFlong principal."
        }
      },
      "additionalProperties" : false,
      "description" : "The LFlong principal."
    },
    "ResourceType" : {
      "type" : "string",
      "enum" : [ "DATABASE", "TABLE" ]
    },
    "CatalogResource" : {
      "type" : "object",
      "additionalProperties" : false
    },
    "DatabaseResource" : {
      "type" : "object",
      "properties" : {
        "CatalogId" : {
          "$ref" : "#/definitions/CatalogIdString",
          "description" : "The identifier for the Data Catalog. By default, it is the account ID of the caller."
        },
        "Name" : {
          "$ref" : "#/definitions/NameString",
          "description" : "The name of the database resource. Unique to the Data Catalog."
        }
      },
      "additionalProperties" : false,
      "required" : [ "CatalogId", "Name" ],
      "description" : "A structure for the database object."
    },
    "TableWildcard" : {
      "type" : "object",
      "additionalProperties" : false
    },
    "TableResource" : {
      "type" : "object",
      "properties" : {
        "CatalogId" : {
          "$ref" : "#/definitions/CatalogIdString",
          "description" : "The identifier for the Data Catalog. By default, it is the account ID of the caller."
        },
        "DatabaseName" : {
          "$ref" : "#/definitions/NameString",
          "description" : "The name of the database for the table. Unique to a Data Catalog. A database is a set of associated table definitions organized into a logical group. You can Grant and Revoke database privileges to a principal."
        },
        "Name" : {
          "$ref" : "#/definitions/NameString",
          "description" : "The name of the table."
        },
        "TableWildcard" : {
          "$ref" : "#/definitions/TableWildcard",
          "description" : "A wildcard object representing every table under a database.\n At least one of ``TableResource$Name`` or ``TableResource$TableWildcard`` is required."
        }
      },
      "additionalProperties" : false,
      "required" : [ "CatalogId", "DatabaseName" ],
      "description" : "A structure for the table object. A table is a metadata definition that represents your data. You can Grant and Revoke table privileges to a principal."
    },
    "ColumnNames" : {
      "type" : "array",
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/NameString"
      }
    },
    "ColumnWildcard" : {
      "type" : "object",
      "properties" : {
        "ExcludedColumnNames" : {
          "$ref" : "#/definitions/ColumnNames",
          "description" : "Excludes column names. Any column with this name will be excluded."
        }
      },
      "additionalProperties" : false,
      "description" : "A wildcard object, consisting of an optional list of excluded column names or indexes."
    },
    "TableWithColumnsResource" : {
      "type" : "object",
      "properties" : {
        "CatalogId" : {
          "$ref" : "#/definitions/CatalogIdString",
          "description" : "The identifier for the GLUDC where the location is registered with LFlong."
        },
        "DatabaseName" : {
          "$ref" : "#/definitions/NameString",
          "description" : "The name of the database for the table with columns resource. Unique to the Data Catalog. A database is a set of associated table definitions organized into a logical group. You can Grant and Revoke database privileges to a principal."
        },
        "Name" : {
          "$ref" : "#/definitions/NameString",
          "description" : "The name of the table resource. A table is a metadata definition that represents your data. You can Grant and Revoke table privileges to a principal."
        },
        "ColumnNames" : {
          "$ref" : "#/definitions/ColumnNames",
          "description" : "The list of column names for the table. At least one of ``ColumnNames`` or ``ColumnWildcard`` is required."
        },
        "ColumnWildcard" : {
          "$ref" : "#/definitions/ColumnWildcard",
          "description" : "A wildcard specified by a ``ColumnWildcard`` object. At least one of ``ColumnNames`` or ``ColumnWildcard`` is required."
        }
      },
      "additionalProperties" : false,
      "required" : [ "CatalogId", "DatabaseName", "Name" ],
      "description" : "A structure for a table with columns object. This object is only used when granting a SELECT permission.\n This object must take a value for at least one of ``ColumnsNames``, ``ColumnsIndexes``, or ``ColumnsWildcard``."
    },
    "DataLocationResource" : {
      "type" : "object",
      "properties" : {
        "CatalogId" : {
          "$ref" : "#/definitions/CatalogIdString",
          "description" : "The identifier for the GLUDC where the location is registered with LFlong."
        },
        "ResourceArn" : {
          "$ref" : "#/definitions/ResourceArnString",
          "description" : "The Amazon Resource Name (ARN) that uniquely identifies the data location resource."
        }
      },
      "additionalProperties" : false,
      "required" : [ "CatalogId", "ResourceArn" ],
      "description" : "A structure for a data location object where permissions are granted or revoked."
    },
    "DataCellsFilterResource" : {
      "type" : "object",
      "properties" : {
        "TableCatalogId" : {
          "$ref" : "#/definitions/CatalogIdString",
          "description" : "The ID of the catalog to which the table belongs."
        },
        "DatabaseName" : {
          "$ref" : "#/definitions/NameString",
          "description" : "A database in the GLUDC."
        },
        "TableName" : {
          "$ref" : "#/definitions/NameString",
          "description" : "The name of the table."
        },
        "Name" : {
          "$ref" : "#/definitions/NameString",
          "description" : "The name given by the user to the data filter cell."
        }
      },
      "additionalProperties" : false,
      "required" : [ "TableCatalogId", "DatabaseName", "TableName", "Name" ],
      "description" : "A structure that describes certain columns on certain rows."
    },
    "LFTagKeyResource" : {
      "type" : "object",
      "properties" : {
        "CatalogId" : {
          "$ref" : "#/definitions/CatalogIdString",
          "description" : "The identifier for the GLUDC where the location is registered with GLUDC."
        },
        "TagKey" : {
          "$ref" : "#/definitions/NameString",
          "description" : "The key-name for the LF-tag."
        },
        "TagValues" : {
          "$ref" : "#/definitions/TagValueList",
          "description" : "A list of possible values for the corresponding ``TagKey`` of an LF-tag key-value pair."
        }
      },
      "additionalProperties" : false,
      "required" : [ "CatalogId", "TagKey", "TagValues" ],
      "description" : "A structure containing an LF-tag key and values for a resource."
    },
    "LFTagPolicyResource" : {
      "type" : "object",
      "properties" : {
        "CatalogId" : {
          "$ref" : "#/definitions/CatalogIdString",
          "description" : "The identifier for the GLUDC. The GLUDC is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your LFlong environment."
        },
        "ResourceType" : {
          "$ref" : "#/definitions/ResourceType",
          "description" : "The resource type for which the LF-tag policy applies."
        },
        "Expression" : {
          "$ref" : "#/definitions/Expression",
          "description" : "A list of LF-tag conditions that apply to the resource's LF-tag policy."
        }
      },
      "additionalProperties" : false,
      "required" : [ "CatalogId", "ResourceType", "Expression" ],
      "description" : "A list of LF-tag conditions that define a resource's LF-tag policy.\n A structure that allows an admin to grant user permissions on certain conditions. For example, granting a role access to all columns that do not have the LF-tag 'PII' in tables that have the LF-tag 'Prod'."
    },
    "Resource" : {
      "type" : "object",
      "properties" : {
        "Catalog" : {
          "$ref" : "#/definitions/CatalogResource",
          "description" : "The identifier for the Data Catalog. By default, the account ID. The Data Catalog is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your LFlong environment."
        },
        "Database" : {
          "$ref" : "#/definitions/DatabaseResource",
          "description" : "The database for the resource. Unique to the Data Catalog. A database is a set of associated table definitions organized into a logical group. You can Grant and Revoke database permissions to a principal."
        },
        "Table" : {
          "$ref" : "#/definitions/TableResource",
          "description" : "The table for the resource. A table is a metadata definition that represents your data. You can Grant and Revoke table privileges to a principal."
        },
        "TableWithColumns" : {
          "$ref" : "#/definitions/TableWithColumnsResource",
          "description" : "The table with columns for the resource. A principal with permissions to this resource can select metadata from the columns of a table in the Data Catalog and the underlying data in Amazon S3."
        },
        "DataLocation" : {
          "$ref" : "#/definitions/DataLocationResource",
          "description" : "The location of an Amazon S3 path where permissions are granted or revoked."
        },
        "DataCellsFilter" : {
          "$ref" : "#/definitions/DataCellsFilterResource",
          "description" : "A data cell filter."
        },
        "LFTag" : {
          "$ref" : "#/definitions/LFTagKeyResource",
          "description" : "The LF-tag key and values attached to a resource."
        },
        "LFTagPolicy" : {
          "$ref" : "#/definitions/LFTagPolicyResource",
          "description" : "A list of LF-tag conditions that define a resource's LF-tag policy."
        }
      },
      "additionalProperties" : false,
      "description" : "A structure for the resource."
    },
    "NullableBoolean" : {
      "type" : [ "boolean", "null" ]
    },
    "Permission" : {
      "type" : "string",
      "enum" : [ "ALL", "SELECT", "ALTER", "DROP", "DELETE", "INSERT", "DESCRIBE", "CREATE_DATABASE", "CREATE_TABLE", "DATA_LOCATION_ACCESS", "CREATE_LF_TAG", "ASSOCIATE", "GRANT_WITH_LF_TAG_EXPRESSION" ]
    },
    "LFTagKey" : {
      "type" : "string",
      "minLength" : 1,
      "maxLength" : 128
    },
    "LFTagValue" : {
      "type" : "string",
      "minLength" : 0,
      "maxLength" : 256
    },
    "DataLakePrincipalList" : {
      "type" : "array",
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/DataLakePrincipal"
      }
    },
    "PermissionList" : {
      "type" : "array",
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Permission"
      }
    },
    "TagValueList" : {
      "type" : "array",
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/LFTagValue"
      },
      "minItems" : 1,
      "maxItems" : 50
    },
    "PrincipalResourcePair" : {
      "type" : "object",
      "properties" : {
        "Principal" : {
          "$ref" : "#/definitions/DataLakePrincipal"
        },
        "Resource" : {
          "$ref" : "#/definitions/Resource"
        }
      },
      "additionalProperties" : false,
      "required" : [ "Principal", "Resource" ],
      "description" : ""
    },
    "PrincipalPermissions" : {
      "type" : "object",
      "properties" : {
        "DataLakePrincipal" : {
          "$ref" : "#/definitions/DataLakePrincipal"
        },
        "PermissionList" : {
          "$ref" : "#/definitions/PermissionList"
        }
      },
      "additionalProperties" : false,
      "description" : ""
    },
    "PrincipalPermissionsList" : {
      "type" : "array",
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/PrincipalPermissions"
      }
    }
  },
  "properties" : {
    "Catalog" : {
      "$ref" : "#/definitions/CatalogIdString",
      "description" : "The identifier for the GLUDC. By default, the account ID. The GLUDC is the persistent metadata store. It contains database definitions, table definitions, and other control information to manage your Lake Formation environment."
    },
    "Principal" : {
      "$ref" : "#/definitions/DataLakePrincipal",
      "description" : "The principal to be granted a permission."
    },
    "Resource" : {
      "$ref" : "#/definitions/Resource",
      "description" : "The resource to be granted or revoked permissions."
    },
    "Permissions" : {
      "$ref" : "#/definitions/PermissionList",
      "description" : "The permissions granted or revoked."
    },
    "PermissionsWithGrantOption" : {
      "$ref" : "#/definitions/PermissionList",
      "description" : "Indicates the ability to grant permissions (as a subset of permissions granted)."
    },
    "PrincipalIdentifier" : {
      "type" : "string",
      "description" : ""
    },
    "ResourceIdentifier" : {
      "type" : "string",
      "description" : ""
    }
  },
  "additionalProperties" : false,
  "required" : [ "Principal", "Resource", "Permissions", "PermissionsWithGrantOption" ],
  "createOnlyProperties" : [ "/properties/Catalog", "/properties/Principal", "/properties/Resource", "/properties/Permissions", "/properties/PermissionsWithGrantOption" ],
  "readOnlyProperties" : [ "/properties/PrincipalIdentifier", "/properties/ResourceIdentifier" ],
  "replacementStrategy" : "delete_then_create",
  "tagging" : {
    "taggable" : false
  },
  "primaryIdentifier" : [ "/properties/PrincipalIdentifier", "/properties/ResourceIdentifier" ],
  "propertyTransform" : {
    "/properties/Permissions" : "Permissions=[] ? null : Permissions",
    "/properties/PermissionsWithGrantOption" : "PermissionsWithGrantOption=[] ? null : PermissionsWithGrantOption"
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "lakeformation:GrantPermissions", "lakeformation:ListPermissions", "glue:GetTable", "glue:GetDatabase" ]
    },
    "read" : {
      "permissions" : [ "lakeformation:ListPermissions", "glue:GetTable", "glue:GetDatabase" ]
    },
    "delete" : {
      "permissions" : [ "lakeformation:RevokePermissions", "lakeformation:ListPermissions", "glue:GetTable", "glue:GetDatabase" ]
    }
  }
}