How to grant or revoke lake formation by boto3 for IAM groups?

Question

I'm trying to use AWS lake formation to perform grants and revokes of permissions for AWS IAM groups, via console I can normally, but via Boto3 or AWS CLI I get an error stating that IAM groups are not accepted in these actions.

ERROR BOTO3 IMAGE

Answer 1

You can't. Groups aren't principals and can't be granted permissions using resource-based permission policies. If your Group and your LakeFormation stuff are in the same account, you should attach your LakeFormation permissions to the Group rather than using a resource-based permission policy. If they are in different accounts, allow the Group members to assume a Role from the LakeFormation account and give permissions to that.