Getting started with the standard permissions mode in Amazon QLDB

Use this section to get started with the standard permissions mode in Amazon QLDB. This section provides a reference table to help you when writing an identity-based policy in AWS Identity and Access Management (IAM) for PartiQL actions and table resources in QLDB. It also includes a step-by-step tutorial for creating permissions policies in IAM, and instructions for finding a table ARN and creating table tags in QLDB.

The STANDARD permissions mode

QLDB now supports a STANDARD permissions mode for ledger resources. The standard permissions mode enables access control with finer granularity for ledgers, tables, and PartiQL commands. By default, this mode denies all requests to run any PartiQL commands on any tables in a ledger.

To allow commands in the standard mode, you must create a permissions policy in IAM for specific table resources and PartiQL actions. This is in addition to the SendCommand API permission for the ledger. To facilitate policies in this mode, QLDB introduced a set of IAM actions for PartiQL commands, and Amazon Resource Names (ARNs) for QLDB tables. For more information about the QLDB data object model, see Core concepts and terminology in Amazon QLDB.

PartiQL permissions reference

The following table lists each QLDB PartiQL command, the corresponding IAM actions that you must grant permissions for to perform the command, and the AWS resources that you can grant the permissions for. You specify the actions in the policy's Action field, and you specify the resource value in the policy's Resource field.

For examples of IAM policy documents that grant permissions to these PartiQL commands, proceed to Quick start tutorial: Creating permissions policies or see Identity-based policy examples for Amazon QLDB.

Finding a table ID and ARN

You can find a table ID by using the AWS Management Console or by querying the table information_schema.user_tables. To view table details on the console, or to query this system catalog table, you must have SELECT permission on the system catalog resource. For example, to find the table ID of the Vehicle table, you can run the following statement.

SELECT * FROM information_schema.user_tables
WHERE name = 'Vehicle'

This query returns results in a format similar to the following example.

{
    tableId: "Au1EiThbt8s0z9wM26REZN",
    name: "Vehicle",
    indexes: [
        { indexId: "Djg2nt0yIs2GY0T29Kud1z", expr: "[VIN]", status: "ONLINE" },
        { indexId: "4tPW3fUhaVhDinRgKRLhGU", expr: "[LicensePlateNumber]", status: "BUILDING" }
    ],
    status: "ACTIVE"
}

To grant permissions to run PartiQL statements on a table, you specify a table resource in the following ARN format.

arn:aws:qldb:${region}:${account-id}:ledger/${ledger-name}/table/${table-id}

The following is an example of a table ARN for table ID Au1EiThbt8s0z9wM26REZN.

arn:aws:qldb:us-east-1:123456789012:ledger/myExampleLedger/table/Au1EiThbt8s0z9wM26REZN

Tagging tables

You can tag your table resources. To manage tags for existing tables, use the AWS Management Console or the API operations TagResource, UntagResource, and ListTagsForResource. For more information, see Tagging Amazon QLDB resources.

You can also define table tags while you're creating the table by using the QLDB console or by specifying them in a CREATE TABLE PartiQL statement. The following example creates a table named Vehicle with the tag environment=production.

CREATE TABLE Vehicle WITH (aws_tags = `{'environment': 'production'}`)

Tagging tables on creation requires access to both the qldb:PartiQLCreateTable and qldb:TagResource actions.

By tagging resources while they're being created, you can eliminate the need to run custom tagging scripts after resource creation. After a table is tagged, you can control access to the table based on those tags. For example, you can grant full access only to tables that have a specific tag. For a JSON policy example, see Full access to all actions based on table tags.

Quick start tutorial: Creating permissions policies

This tutorial guides you through steps to create permissions policies in IAM for an Amazon QLDB ledger in the STANDARD permissions mode. You can then assign the permissions to your users, groups, or roles.

For more examples of IAM policy documents that grant permissions to PartiQL commands and table resources, see Identity-based policy examples for Amazon QLDB.

Prerequisites

Before you get started, make sure that you do the following:

Creating a read-only policy

To use the JSON policy editor to create a read-only policy for all tables in a ledger in the standard permissions mode, do the following:

Creating a full access policy

To create a full access policy for all tables in a QLDB ledger in the standard permissions mode, do the following:

Creating a read-only policy for a specific table

To create a read-only access policy for a specific table in a QLDB ledger in the standard permissions mode, do the following:

Assigning permissions

After creating a QLDB permissions policy, you then assign the permissions as follows.

To provide access, add permissions to your users, groups, or roles: