AWS Glue
Developer Guide

AWS Glue API Permissions: Actions and Resources Reference

Use the following table as a reference when you're setting up Authentication and Access Control for AWS Glue and writing a permissions policy to attach to an IAM identity (identity-based policy) or to a resource (resource policy). The table lists each AWS Glue API operation, the corresponding actions for which you can grant permissions to perform the action, and the AWS resource for which you can grant the permissions. You specify the actions in the policy's Action field, and you specify the resource value in the policy's Resource field.

Actions on some AWS Glue resources require that ancestor and child resource ARNs are also included in the policy's Resource field. For more information, see Data Catalog Amazon Resource Names (ARNs).

Generally, you can replace ARN segments with wildcards. For more information see IAM JSON Policy Elements in the IAM User Guide.

You can use AWS-wide condition keys in your AWS Glue policies to express conditions. For a complete list of AWS-wide keys, see Available Keys in the IAM User Guide.

Note

To specify an action, use the glue: prefix followed by the API operation name (for example, glue:GetTable).

If you see an expand arrow () in the upper-right corner of the table, you can open the table in a new window. To close the window, choose the close button (X) in the lower-right corner.

AWS Glue API and Required Permissions for Actions

AWS Glue API Operations Required Permissions (API Actions) Resources
BatchCreatePartition (batch_create_partition) glue:BatchCreatePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
BatchDeleteConnection (batch_delete_connection) glue:BatchDeleteConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog

Note

All the connection deletions to be performed by the call must be authorized by IAM. If any of these deletions is not authorized, the call fails and no connections are deleted.

BatchDeletePartition (batch_delete_partition) glue:BatchDeletePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog

Note

All the partition deletions to be performed by the call must be authorized by IAM. If any of these deletions is not authorized, the call fails and no partitions are deleted.

BatchDeleteTable (batch_delete_table) glue:BatchDeleteTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog

Note

All the table deletions to be performed by the call must be authorized by IAM. If any of these deletions is not authorized, the call fails and no tables are deleted.

BatchDeleteTableVersion (batch_delete_table_version) glue:BatchDeleteTableVersion
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
BatchGetPartition (batch_get_partition) glue:BatchGetPartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
BatchStopJobRun (batch_stop_job_run) glue:BatchStopJobRun *
CreateClassifier (create_classifier) glue:CreateClassifier *
CreateConnection (create_connection) glue:CreateConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
CreateCrawler (create_crawler) glue:CreateCrawler *
CreateDatabase (create_database) glue:CreateDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
CreateDevEndpoint (create_dev_endpoint) glue:CreateDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

or

arn:aws:glue:region:account-id:devEndpoint/*
CreateJob (create_job) glue:CreateJob *
CreatePartition (create_partition) glue:CreatePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
CreateScript (create_script) glue:CreateScript *
CreateSecurityConfiguration (create_security_configuration) glue:CreateSecurityConfiguration *
CreateTable (create_table) glue:CreateTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
CreateTrigger (create_trigger) glue:CreateTrigger *
CreateUserDefinedFunction (create_user_defined_function) glue:CreateUserDefinedFunction >
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteClassifier (delete_classifier) glue:DeleteClassifier *
DeleteConnection (delete_connection) glue:DeleteConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
DeleteCrawler (delete_crawler) glue:DeleteCrawler *
DeleteDatabase (delete_database) glue:DeleteDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:userDefinedFunction/database-name/* arn:aws:glue:region:account-id:table/database-name/* arn:aws:glue:region:account-id:catalog
DeleteDevEndpoint (delete_dev_endpoint) glue:DeleteDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

or

arn:aws:glue:region:account-id:devEndpoint/*
DeleteJob (delete_job) glue:DeleteJob *
DeletePartition (delete_partition) glue:DeletePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteResourcePolicy (delete_resource_policy) glue:DeleteResourcePolicy *
DeleteSecurityConfiguration (delete_security_configuration) glue:DeleteSecurityConfiguration *
DeleteTable (delete_table) glue:DeleteTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteTableVersion (delete_table_version) glue:DeleteTableVersion
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteTrigger (delete_trigger) glue:DeleteTrigger *
DeleteUserDefinedFunction (delete_user_defined_function) glue:DeleteUserDefinedFunction
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetCatalogImportStatus (get_catalog_import_status) glue:GetCatalogImportStatus
arn:aws:glue:region:account-id:catalog
GetClassifier (get_classifier) glue:GetClassifier *
GetClassifiers (get_classifiers) glue:GetClassifiers *
GetConnection (get_connection) glue:GetConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
GetConnections (get_connections) glue:GetConnections
arn:aws:glue:region:account-id:connection/connection-names arn:aws:glue:region:account-id:catalog
GetCrawler (get_crawler) glue:GetCrawler *
GetCrawlerMetrics (get_crawler_metrics) glue:GetCrawlerMetrics *
GetCrawlers (get_crawlers) glue:GetCrawlers *
GetDatabase (get_database) glue:GetDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetDatabases (get_databases) glue:GetDatabases
arn:aws:glue:region:account-id:database/database-names arn:aws:glue:region:account-id:catalog
GetDataCatalogEncryptionSettings (get_data_catalog_encryption_settings) glue:GetDataCatalogEncryptionSettings *
GetDataflowGraph (get_dataflow_graph) glue:GetDataflowGraph *
GetDevEndpoint (get_dev_endpoint) glue:GetDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

or

arn:aws:glue:region:account-id:devEndpoint/*
GetDevEndpoints (get_dev_endpoints) glue:GetDevEndpoints *
GetJob (get_job) glue:GetJob *
GetJobRun (get_job_run) glue:GetJobRun *
GetJobRuns (get_job_runs) glue:GetJobRuns *
GetJobs (get_jobs) glue:GetJobs *
GetMapping (get_mapping) glue:GetMapping *
GetPartition (get_partition) glue:GetPartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetPartitions (get_partitions) glue:GetPartitions
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetPlan (get_plan) glue:GetPlan *
GetResourcePolicy (get_resource_policy) glue:GetResourcePolicy *
GetSecurityConfiguration (get_security_configuration) glue:GetSecurityConfiguration *
GetSecurityConfigurations (get_security_configurations) glue:GetSecurityConfigurations *
GetTable (get_table) glue:GetTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTables (get_tables) glue:GetTables
arn:aws:glue:region:account-id:table/database-name/table-names arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTableVersion (get_table_version) glue:GetTableVersion
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTableVersions (get_table_versions) glue:GetTableVersions
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTrigger (get_trigger) glue:GetTrigger *
GetTriggers (get_triggers) glue:GetTriggers *
GetUserDefinedFunction (get_user_defined_function) glue:GetUserDefinedFunction
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetUserDefinedFunctions (get_user_defined_functions) glue:GetUserDefinedFunctions
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-names arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
ImportCatalogToGlue (import_catalog_to_glue) glue:ImportCatalogToGlue
arn:aws:glue:region:account-id:catalog
PutResourcePolicy (put_resource_policy) glue:PutResourcePolicy *
PutDataCatalogEncryptionSettings (put_data_catalog_encryption_settings) glue:PutDataCatalogEncryptionSettings *
ResetJobBookmark (reset_job_bookmark) glue:ResetJobBookmark *
StartCrawler (start_crawler) glue:StartCrawler *
StartCrawlerSchedule (start_crawler_schedule) glue:StartCrawlerSchedule *
StartJobRun (start_job_run) glue:StartJobRun *
StartTrigger (start_trigger) glue:StartTrigger *
StopCrawler (stop_crawler) glue:StopCrawler *
StopCrawlerSchedule (stop_crawler_schedule) glue:StopCrawlerSchedule *
StopTrigger (stop_trigger) glue:StopTrigger *
UpdateClassifier (update_classifier) glue:UpdateClassifier *
UpdateConnection (update_connection) glue:UpdateConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
UpdateCrawler (update_crawler) glue:UpdateCrawler *
UpdateCrawlerSchedule (update_crawler_schedule) glue:UpdateCrawlerSchedule *
UpdateDatabase (update_database) glue:UpdateDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
UpdateDevEndpoint (update_dev_endpoint) glue:UpdateDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

or

arn:aws:glue:region:account-id:devEndpoint/*
UpdateJob (update_job) glue:UpdateJob *
UpdatePartition (update_partition) glue:UpdatePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
UpdateTable (update_table) glue:UpdateTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
UpdateTrigger (update_trigger) glue:UpdateTrigger *
UpdateUserDefinedFunction (update_user_defined_function) glue:UpdateUserDefinedFunction
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog

On this page: