Adding permissions for data resources for an IAM role
To connect to data, AWS Glue DataBrew needs to have an IAM role that it can pass on behalf of the user. Following, you can find how to create the policy that you later attach to an IAM role.
The AwsGlueDataBrewDataResourcePolicy policy grants the permissions
needed to connect to data using DataBrew. For any operation that accesses data in
another AWS resource, such as accessing your objects in Amazon S3, DataBrew needs permission
to access the resource on your behalf.
To define the AwsGlueDataBrewDataResourcePolicy IAM policy for DataBrew (console)
-
Download the JSON for
AwsGlueDataBrewDataResourcePolicy. -
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/
. -
In the navigation pane, choose Policies.
-
For each policy, choose Create Policy.
-
On the Create Policy screen, navigate to the JSON tab.
-
Copy the policy JSON statement that you downloaded. Paste it over the sample statement in the editor.
-
Verify that the policy is customized to your account, security requirements, and required AWS resources. If you need to make changes, you can make them in the editor.
-
Choose Review policy.
To define the AwsGlueDataBrewDataResourcePolicy IAM policy for DataBrew (AWS CLI)
-
Download the JSON for
AwsGlueDataBrewDataResourcePolicy. -
Customize the policy as described in the first step of the previous procedure.
-
Run the following command to create the policy.
aws iam create-policy --policy-name AwsGlueDataBrewDataResourcePolicy --policy-document file://iam-policy-AwsGlueDataBrewDataResourcePolicy.json
