get_temporary_data_location_credentials ¶

def get_temporary_data_location_credentials(
    self,
    *,
    config_overrides: Optional[LakeFormationClientConfig] = None,
    duration_seconds: Optional[
        "capo_lakeformation.types.credential_timeout_duration_second_integer.CredentialTimeoutDurationSecondInteger"
    ] = None,
    audit_context: Optional[
        "capo_lakeformation.types.audit_context.AuditContext"
    ] = None,
    data_locations: Optional[
        "capo_lakeformation.types.path_string_list.PathStringList"
    ] = None,
    credentials_scope: Optional[
        "capo_lakeformation.types.credentials_scope.CredentialsScope"
    ] = None,
) -> "capo_lakeformation.types.get_temporary_data_location_credentials_response.GetTemporaryDataLocationCredentialsResponse":
    """<p>Allows a user or application in a secure environment to access data in a specific Amazon S3 location registered with Lake Formation by providing temporary scoped credentials that are limited to the requested data location and the caller's authorized access level.</p> <p> <code>GetDataAccess</code> is logged in CloudTrail whenever a principal requests temporary data location credentials to access data in a data lake location that is registered with Lake Formation.</p> <p> The API operation returns an error in the following scenarios:</p> <ul> <li> <p>The data location is not registered with Lake Formation. </p> </li> <li> <p>No Glue table is associated with the data location.</p> </li> <li> <p>The caller doesn't have required permissions on the associated table. The caller must have <code>SELECT</code> or <code>SUPER</code> permissions on the associated table, and credential vending for full table access must be enabled in the data lake settings. </p> <p>For more information, see <a href="https://docs.aws.amazon.com/lake-formation/latest/dg/full-table-credential-vending.html">Application integration for full table access</a>.</p> </li> <li> <p>The data location is in a different Amazon Web Services Region. Lake Formation doesn't support cross-Region access when vending credentials for a data location. Lake Formation only supports Amazon S3 paths registered within the same Region as the API call. </p> </li> </ul>

    Args:
        duration_seconds: <p>The time period, between 900 and 43,200 seconds, for the timeout of the temporary credentials.</p>
        data_locations: <p>The Amazon S3 data location that you want to access.</p>
        credentials_scope: <p>The credential scope is determined by the caller's Lake Formation permission on the associated table. Credential scope can be either:</p> <ul> <li> <p>READ - Provides read-only access to the data location.</p> </li> <li> <p>READ_WRITE - Provides both read and write access to the data location.</p> </li> </ul>

    Raises:
        capo_lakeformation.errors.access_denied_exception.AccessDeniedException: <p>Access to a resource was denied.</p>
        capo_lakeformation.errors.conflict_exception.ConflictException: <p>Multiple resources exist with the same Amazon S3 location</p>
        capo_lakeformation.errors.entity_not_found_exception.EntityNotFoundException: <p>A specified entity does not exist.</p>
        capo_lakeformation.errors.glue_encryption_exception.GlueEncryptionException: <p>An encryption operation failed.</p>
        capo_lakeformation.errors.internal_service_exception.InternalServiceException: <p>An internal service error occurred.</p>
        capo_lakeformation.errors.invalid_input_exception.InvalidInputException: <p>The input provided was not valid.</p>
        capo_lakeformation.errors.operation_timeout_exception.OperationTimeoutException: <p>The operation timed out.</p>
        capo_lakeformation.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_lakeformation.types.get_temporary_data_location_credentials_request.GetTemporaryDataLocationCredentialsRequest]",
    ) -> OperationResponse[
        "capo_lakeformation.types.get_temporary_data_location_credentials_response.GetTemporaryDataLocationCredentialsResponse"
    ]:
        import capo_lakeformation._operations.aws_lake_formation.get_temporary_data_location_credentials

        output, http_response = (
            capo_lakeformation._operations.aws_lake_formation.get_temporary_data_location_credentials.get_temporary_data_location_credentials(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("GetTemporaryDataLocationCredentials")
    )
    input_: capo_lakeformation.types.get_temporary_data_location_credentials_request.GetTemporaryDataLocationCredentialsRequest = {}
    if duration_seconds is not None:
        input_["duration_seconds"] = duration_seconds
    if audit_context is not None:
        input_["audit_context"] = audit_context
    if data_locations is not None:
        input_["data_locations"] = data_locations
    if credentials_scope is not None:
        input_["credentials_scope"] = credentials_scope

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output