CDK授予湖泊形成许可

我正在尝试创建Glue数据库，并在Lake Formation中授予其权限。我根据文档尝试了几种方法和IAM角色和策略，但每次都得到Insufficient Lake Formation permission(s): Required Create Database on Catalog。代码非常简单，当我在Lake Formations中定义权限时，我指定ALL值。当我从控制台执行此操作时，它会工作。我基本上是在代码中复制相同的内容，但由于某些原因，它不起作用。有人知道代码中缺少什么吗？非常感谢。

class ExampleStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        custom_data_bucket_arn = "arn:aws:s3:::transformed-v5"
        s3_location = "s3://transformed-v5"
        bucket_name = "transformed-v5"

        glue_role = cdk.aws_iam.Role(self, "glue_role", 
            assumed_by=cdk.aws_iam.ServicePrincipal('glue.amazonaws.com'),
            managed_policies= [
                cdk.aws_iam.ManagedPolicy.from_managed_policy_arn(self, 'ManagedGlueRole', 
                    managed_policy_arn='arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole'
                    )
                ]
        )
        
        glue_role.add_to_policy(cdk.aws_iam.PolicyStatement(actions=['s3:GetObject', 's3:PutObject'], effect=cdk.aws_iam.Effect.ALLOW, resources=["arn:aws:s3:::transformed-v5*"]))

        glue_db=cdk.aws_glue.CfnDatabase(self, "Database", 
            catalog_id=cdk.Aws.ACCOUNT_ID,
            database_input=cdk.aws_glue.CfnDatabase.DatabaseInputProperty(
                name="datalake-v5",
                location_uri = s3_location 
            )
        )

        location_resource = cdk.aws_lakeformation.CfnResource(self, 
                "DatalakeLocationResource", 
                resource_arn= custom_data_bucket_arn, 
                use_service_linked_role=True
        )
    
        location_permission = cdk.aws_lakeformation.CfnPermissions(self, "DatalakeLocationPermission",
                data_lake_principal=cdk.aws_lakeformation.CfnPermissions.DataLakePrincipalProperty(
                    data_lake_principal_identifier=glue_role.role_arn),
                resource=cdk.aws_lakeformation.CfnPermissions.ResourceProperty(
                    data_location_resource=cdk.aws_lakeformation.CfnPermissions.DataLocationResourceProperty(
                        s3_resource=custom_data_bucket_arn)),
                permissions=["DATA_LOCATION_ACCESS"]
            )
        #make sure the location resource is created first
        location_permission.add_dependency(location_resource)

        cdk.aws_lakeformation.CfnPermissions(self, "DatabasePermission",
                data_lake_principal=cdk.aws_lakeformation.CfnPermissions.DataLakePrincipalProperty(
                    data_lake_principal_identifier=glue_role.role_arn),
                resource=cdk.aws_lakeformation.CfnPermissions.ResourceProperty(
                    database_resource=cdk.aws_lakeformation.CfnPermissions.DatabaseResourceProperty(
                        name="datalake-v5")),
                permissions=["ALL"],
                permissions_with_grant_option=["ALL"]
            )