Setup for Lake Formation Push Mode - Access Management¶

Perform following steps to configure AWS Lake Formation connector using Push mode:

1. SSH to the instance where Privacera is installed.

2. Run the following command to navigate to the /config directory.

   Bash
   1	cd ~/privacera/privacera-manager/config

3. Run the following command to create a new directory:

   Bash
   1	mkdir -p custom-vars/connectors/lakeformation/instance1

4. Run the following command to copy the sample vars:

   Bash
   1	cp sample-vars/vars.connector.lakeformation.push.yml custom-vars/connectors/lakeformation/instance1/

5. Run the following command to open the .yml file to be edited.

   Bash
   1	vi custom-vars/connectors/lakeformation/instance1/vars.connector.lakeformation.push.yml

6. Modify the following properties:

   • CONNECTOR_LAKEFORMATION_AWS_ACCOUNT_ID - Enter the AWS Account ID of the account you will be running the AWS Lake Formation connector.

   • CONNECTOR_LAKEFORMATION_AWS_REGION - Set AWS region to connect to your AWS Lake Formation instance.

   • CONNECTOR_LAKEFORMATION_ENABLE_PUSH_POLICIES_TO_RANGER - Set this to true, if you want to push policies to other policy repositories.

   • CONNECTOR_LAKEFORMATION_SINK_HIVE_SERVICE_APP_ID - Set the policy repository name where you want the connector to push policies for the hive.

7. Once the properties are configured, run the following commands to update your Privacera Manager platform instance:

   Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

   Bash
   1 2	cd ~/privacera/privacera-manager ./privacera-manager.sh setup

   Step 2 - Apply the Privacera Manager helm charts.

   Bash
   1 2	cd ~/privacera/privacera-manager ./pm_with_helm.sh upgrade

   Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

   Bash
   1 2	cd ~/privacera/privacera-manager ./privacera-manager.sh post-install

1. In PrivaceraCloud, go to Settings -> Applications.

2. On the Applications screen, select Lakeformation Push Mode.

3. Enter the application Name and Description. Click Save. Name could be any name of your choice. E.g. AWS Lake Formation Connector for account 123456.

4. Open the AWS Lake Formation application.

5. Enable the Access Management option with toggle button.

6. Under the BASIC tab, enter the values for:

7. AWS Account ID : 12345XXX

8. AWS Assume IAM Role ARN : Use the role ARN created for the AWS Lake Formation connector.

9. AWS Region : e.g. us-east-1

10. Click SAVE.

11. The configured AWS Lake Formation connector appears under Applications.

12. Once saved and enabled, the AWS Lake Formation connector will start. Then you can hover on the VIEW LOGS button to check the status, either Running or Stopped.

13. Perform following steps to restart the AWS Lake formation connector application:

    1. Go to Settings → Applications → select the****Lake formation** connector application** .

    2. Edit the application → Disable it → and Save it.

    3. Open the same application again and then: Enable it → and Save it.

The Omni Connector is configured from the Trust3 AI portal on a Runtime Plane (Self-Managed or Partially Managed (D2P)). For an overview and the data platform prerequisites, see Omni Connector.

1. In the portal, navigate to Settings → Runtime Plane and open your Runtime Plane.

2. Open the Connectors tab and select Add New.

3. Select Lakeformation Push Mode from the available connectors.

4. Enter the Name and an optional Description. The name can contain lowercase letters, numbers and hyphens, with a single space allowed only between words. It must start and end with a letter or number, and be unique within the Runtime Plane. For example, lakeformation-1.

5. Select the Deployment Mode, then select Continue.

   • Shared: the connector runs inside the Runtime Plane's shared omni-connector application.
   • Dedicated: the connector runs in its own application.
   • The deployment mode cannot be changed after the connector is created. See Deployment mode.

6. Under ACCESS CONTROL CONFIGS, in the Lake Formation section, enter:

   • Regions: comma-separated AWS regions to govern. For example, us-east-1,us-west-2.
   • Auth mode: Default credential chain (IRSA) (default), Assume role or Static access keys. Use IRSA where possible, so that no keys are stored in the configuration.
   • Assume role ARN and Assume role external ID: for Assume role.
   • AWS access key ID, AWS secret access key and AWS session token: for static keys. Use for development only.
   • Allowed principal accounts: comma-separated AWS account IDs whose principals may be granted access. * (default) allows any.

7. In the Managed Resources section, enter one name or wildcard pattern per line under Include. Names are region.catalogId.database.table. For example, us-east-1.123456789012.sales governs one database.

   A new connector governs nothing until you add an Include entry

   Include is empty by default, which means deny-all. Enter * alone to govern everything.

8. Optionally, set the Scan Schedule. Both schedules are off by default, so a new connector scans only when triggered manually. For example, set Metadata scan schedule to 0 0 */4 * * *. See Scan schedule.

9. Optionally, turn on Event ingestion so that resource changes from Amazon MSK or Apache Kafka update the connector in near real time. Event ingestion is available on Self-Managed planes only. See Omni Connector Event Ingestion.

10. Select Save. The connector starts after it is saved.

    • Shared: saving restarts the shared omni-connector pod, so every Shared connector on the Runtime Plane is briefly interrupted. Select View status on the connector row to check the shared application.
    • Dedicated: the connector's own application starts.