diff --git a/website/docs/r/lakeformation_permissions.html.markdown b/website/docs/r/lakeformation_permissions.html.markdown index 48fe50e51f0..4679303fce4 100644 --- a/website/docs/r/lakeformation_permissions.html.markdown +++ b/website/docs/r/lakeformation_permissions.html.markdown @@ -87,6 +87,21 @@ The resulting permissions depend on whether the table had `IAMAllowedPrincipals` | ---- | ---- | | `SELECT` column wildcard (i.e., all columns) | `SELECT` on `"event"` (as expected) | +## `ALLIAMPrincipals` group + +AllIAMPrincipals is a pseudo-entity group that acts like a Lake Formation principal. The group includes all IAMs in the account that is defined. + +resource "aws_lakeformation_permissions" "example" { + permissions = ["SELECT"] + principal = "123456789012:IAMPrincipals" + + table_with_columns { + database_name = aws_glue_catalog_table.example.database_name + name = aws_glue_catalog_table.example.name + column_names = ["event"] + } +} + ## Using Lake Formation Permissions Lake Formation grants implicit permissions to data lake administrators, database creators, and table creators. These implicit permissions cannot be revoked _per se_. If this resource reads implicit permissions, it will attempt to revoke them, which causes an error when the resource is destroyed.