Skip to main content
 print this page

Trigger resource access update for a job

POST 
/jobs/:id/resourceaccess

Replaces extra dataset, domain, parameter, and shared-library grants on the job role and starts the resource-access step function. Success Message is "Updating resource access" (HTTP 200); IAM and Lake Formation apply asynchronously. GET /jobs/{id}/resourceaccess to poll Status. Caller must send a valid role_id and have at least editor access (AUTH-1012 if below editor, AUTH-1010 if no permission). Unknown JobId returns IPV-1002. RoleUsed must start with {projectShortName}-custom- (IPV-1002 otherwise). A concurrent update (ResourceAccessStatus=in_progress) returns GE-1033. Body must include DatasetAccess, ParameterAccess, DomainAccess, and SharedLibraries (IPV-1008). DatasetAccess must have Owner, ReadOnly, and ReadOnlyFileLevel (the handler fills omitted lists as empty). Each list replaces the current extra grant of that type. Store datasets are rejected (JOB-1043). Tag-based datasets cannot be ReadOnly (JOB-1031). System datasets cannot be Owner (IPV-1041). ReadOnlyFileLevel requires S3 non-external non-view datasets (DS-1040) and FileLevelTags the user can access (AUTH-1031). Owner access on LF-targeted external datasets returns IPV-1042. Allocation over policy budget returns JOB-1020 / JOB-1021.

Request​

Responses​

Step function started. Message is "Updating resource access". Poll GET /jobs/{id}/resourceaccess for Status.

Response Headers
    Access-Control-Allow-Origin
    Access-Control-Allow-Methods
    Access-Control-Allow-Headers