AWS Glue
Developer Guide

Step 5: Create an IAM Role for Notebooks

If you plan to use notebooks with development endpoints, you need to grant the IAM role permissions. You provide those permissions by using AWS Identity and Access Management, through an IAM role.


When you create an IAM role using the IAM console, the console creates an instance profile automatically and gives it the same name as the role to which it corresponds.

To create an IAM role for notebooks

  1. Sign in to the AWS Management Console and open the IAM console at

  2. In the left navigation pane, choose Roles.

  3. Choose Create New Role.

  4. Choose AWS Service Roles, find Amazon EC2, and choose Select.

  5. On the Attach Policy page, choose the policies that contain the required permissions; for example, AWSGlueServiceNotebookRole for general AWS Glue permissions and the AWS managed policy AmazonS3FullAccess for access to Amazon S3 resources. Then choose Next Step.


    Ensure that one of the policies in this role grants permissions to your Amazon S3 sources and targets. Also confirm that your policy allows full access to the location where you store your notebook when you create a notebook server. You might want to provide your own policy for access to specific Amazon S3 resources.

    If you plan to access Amazon S3 sources and targets that are encrypted with SSE-KMS, then attach a policy which allows notebooks to decrypt the data. For more information, see Protecting Data Using Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS). For example:

    { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "kms:Decrypt" ], "Resource":[ "arn:aws:kms:*:account-id-without-hyphens:key/key-id" ] } ] }
  6. For Role Name, type a name for your role. Create the role with the name prefixed with the string AWSGlueServiceNotebookRole to allow the role to be passed from console users to the notebook server. AWS Glue provided policies expect IAM service roles to begin with AWSGlueServiceNotebookRole. Otherwise you must add a policy to your users to allow the iam:PassRole permission for IAM roles to match your naming convention. For example, type AWSGlueServiceNotebookRoleDefault. Then choose Create Role.