Tbac
APIs related to Tag Based Access Control(TBAC) functionality
📄️ Get user accessible Tags
Returns a paginated list of TBAC tags the caller has access to. Supports two modes controlled by the action query parameter:
📄️ Creates a new Tag
Creates a new TBAC (Tag-Based Access Control) tag. Creates a corresponding Lake Formation tag with access levels (owner, editor, read-only), grants LF permissions to the caller's IAM role, stores tag metadata in DynamoDB, and assigns owner access to the caller. If the environment uses Redshift, also creates a corresponding Redshift role.
📄️ Get all users in the system by tag key
Currently only supports key='user'. Returns a list of all users in the system with basic profile fields (UserId, Name, EmailId, IsActive). The response wraps the user list in a structure with hardcoded metadata fields (TagValue, CreationTime, etc. are all 'N/A'). Any key value other than 'user' returns error GE-1010.
📄️ Get details of a Tag key-value pair
Returns full metadata for a specific TBAC tag identified by TagKey and TagValue. Includes the tag's metadata fields, the caller's AccessType on the tag, and a ResourcesList showing all resources (datasets, jobs, dashboards, etc.) attached to this tag grouped by resource type and access level (owner/editor/read-only). Requires at least read-only access on the tag (AUTH-1012 if insufficient).
📄️ Update tag description and display name
Updates the TagDescription and optionally the DisplayName of an existing TBAC tag. Requires at least editor access on the tag (AUTH-1012 if insufficient). TagDescription is required in the request body. Concurrent updates are rejected if TagStatus is 'update_in_progress' (GE-1034). Synchronous — returns immediately.
📄️ Delete a tag by key and value
Permanently deletes a TBAC tag and its associated Lake Formation tag, Redshift role (if applicable), and ACL resource entries. Requires owner access (AUTH-1012 if insufficient). Before deletion, validates that the tag has no SAML group attachments (ROLE-1008), no dependent resources of any type (GE-1034), no tenant dependency conflicts (TAG-1021), and no domain dependency conflicts (TAG-1020). Synchronous — returns immediately on success.