Lake Formation grant should not use wildcard principal

What it checks

Lake Formation grant: uses IAM_ALLOWED_PRINCIPALS as the principal.

Where it applies

Terraform: aws_lakeformation_permissions

CloudFormation: AWS::LakeFormation::Permissions, AWS::LakeFormation::PrincipalPermissions

How to fix it

1. Replace IAM_ALLOWED_PRINCIPALS with specific IAM role or user ARNs. Review existing data lake access grants — IAM_ALLOWED_PRINCIPALS is often set by default during Lake Formation setup.
2. Audit the Lake Formation settings page and disable the 'Use only IAM access control' setting for all databases.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules