Package: lakecli
IntroductionLakeCLI is a SQL interface (CLI) for managingAWS Lake FormationandAWS Gluepermissions.FeaturesLakeCLI provides aninformation schemaand supports SQL GRANT/REVOKE statements. These features help administratorsUse familiar SQL features to view and manage permissionsWrite scripts to automate on-boarding and removing permissions.Write scripts to monitor & alert permissions to ensure best practices and policies are followed.Information SchemaLakeCLI provides two tables:database_privilegestable_privilegesDatabase PrivilegesColumnDescriptionidPrimary Keyschema_nameName of the SchemaprincipalAWS IAM Role or UserpermissionPermission type (Described in a later section)grantBoolean. Describes if the principal is allowed to grant permission to othersTable PrivilegesColumnDescriptionidPrimary Keyschema_nameSchema Name of the Tabletable_nameName of the TableprincipalAWS IAM Role or UserpermissionPermission type (Described in a later section)grantBoolean. Describes if the principal is allowed to grant permission to othersGRANT/REVOKE StatementsGRANT/REVOKE { { PERMISSION TYPE }
    [, ...] }
    ON { [ TABLE | DATABASE ] name }
    TO role_specificationPermission TypesALLSELECTALTERDROPDELETEINSERTCREATE_DATABASECREATE_TABLEDATA_LOCATION_ACCESSExamplesTable Privileges\r:iamdb> SELECT * FROM table_privileges;
+----+-------------+----------------+--------------+------------+-------+
| id | schema_name | table_name     | principal    | permission | grant |
+----+-------------+----------------+--------------+------------+-------+
| 1  | taxidata    | raw_misc       | role/lakecli | ALL        | 1     |
| 2  | taxidata    | raw_misc       | role/lakecli | ALTER      | 1     |
| 3  | taxidata    | raw_misc       | role/lakecli | DELETE     | 1     |
+----+-------------+----------------+--------------+------------+-------+Database Privileges\r:iamdb> SELECT * FROM database_privileges;
+----+-------------+--------------------------------+--------------+-------+
| id | schema_name | principal                      | permission   | grant |
+----+-------------+--------------------------------+--------------+-------+
| 9  | taxilake    | role/LakeFormationWorkflowRole | CREATE_TABLE | 1     |
| 10 | taxilake    | role/LakeFormationWorkflowRole | DROP         | 1     |
| 11 | default     | user/datalake_user             | ALTER        | 0     |
| 12 | default     | user/datalake_user             | CREATE_TABLE | 0     |
| 13 | default     | user/datalake_user             | DROP         | 0     |
+----+-------------+--------------------------------+--------------+-------+GRANT\r:iamdb> grant SELECT ON TABLE 'taxidata'.'raw_misc' TO 'user/datalake_user';
GRANT
Time: 1.467sREVOKE\r:iamdb> revoke SELECT ON TABLE 'taxidata'.'raw_misc' TO 'user/datalake_user';
REVOKE
Time: 1.450sQuick StartInstall$pipinstalllakecliConfigA config file is automatically created at~/.lakecli/lakeclircat first launch (run lakecli).
See the file itself for a description of all available options.Below 4 variables are required.# AWS credentials
aws_access_key_id = ''
aws_secret_access_key = ''
region = '' # e.g us-west-2, us-east-1
account_id = ''or you can also use environment variables:$exportAWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY_ID
$exportAWS_SECRET_ACCESS_KEY=YOUR_SECRET_ACCESS_KEY
$exportAWS_DEFAULT_REGION=us-west-2
$exportAWS_ACCOUNT_ID=ACCOUNT_IDFeaturesAuto-completes as you type for SQL keywords as well as tables and columns in the database.Syntax highlighting.Smart-completion will suggest context-sensitive completion.SELECT * FROM <tab>will only show table names.SELECT * FROM users WHERE <tab>will only show column names.Pretty prints tabular data and various table formats.Some special commands. e.g. Favorite queries.Alias support. Column completions will work even when table names are aliased.Usages$lakecli--help
Usage:lakecli[OPTIONS]AAthenaterminalclientwithauto-completionandsyntaxhighlighting.Examples:-lakecli-lakeclimy_database

Options:-e,--executeTEXTExecuteacommand(orafile)andquit.-r,--regionTEXTAWSregion.--aws-access-key-idTEXTAWSaccesskeyid.--aws-secret-access-keyTEXTAWSsecretaccesskey.--aws-account-idTEXTAmazonAccountID.--lake-cli-rcFILELocationoflake_cli_rcfile.--profileTEXTAWSprofile--scan/--no-scan--helpShowthismessageandexit.CreditsLakeCLI is based onAthenaCLIand the excellentDBCliproject. A big thanks to all of them for providing a great foundation to build SQL CLI projects.