AWS Glue
Developer Guide

The AWS Documentation website is getting a new look!
Try it now and let us know what you think. Switch to the new look >>

You can return to the original look by selecting English in the language selector above.

AWS Glue API Permissions: Actions and Resources Reference

Use the following table as a reference when you're setting up Identity and Access Management in AWS Glue and writing a permissions policy to attach to an IAM identity (identity-based policy) or to a resource (resource policy). The table lists each AWS Glue API operation, the corresponding actions for which you can grant permissions to perform the action, and the AWS resource for which you can grant the permissions. You specify the actions in the policy's Action field, and you specify the resource value in the policy's Resource field.

Actions on some AWS Glue resources require that ancestor and child resource ARNs are also included in the policy's Resource field. For more information, see Data Catalog ARNs.

Generally, you can replace ARN segments with wildcards. For more information, see IAM JSON Policy Elements in the IAM User Guide.

Condition keys for IAM policies are listed by API operation. You can use AWS-wide condition keys in your AWS Glue policies to express conditions. For a complete list of AWS-wide keys, see AWS Global Condition Keys in the IAM User Guide.

Note

To specify an action, use the glue: prefix followed by the API operation name (for example, glue:GetTable).

If you see an expand arrow () in the upper-right corner of the table, you can open the table in a new window. To close the window, choose the close button (X) in the lower-right corner.

AWS Glue API and Required Permissions for Actions

AWS Glue API Operations Required Permissions (API Actions) Resources Condition Keys
BatchCreatePartition (batch_create_partition) glue:BatchCreatePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
BatchDeleteConnection (batch_delete_connection) glue:BatchDeleteConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog

Note

All the connection deletions to be performed by the call must be authorized by IAM. If any of these deletions is not authorized, the call fails and no connections are deleted.

BatchDeletePartition (batch_delete_partition) glue:BatchDeletePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog

Note

All the partition deletions to be performed by the call must be authorized by IAM. If any of these deletions is not authorized, the call fails and no partitions are deleted.

BatchDeleteTable (batch_delete_table) glue:BatchDeleteTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog

Note

All the table deletions to be performed by the call must be authorized by IAM. If any of these deletions is not authorized, the call fails and no tables are deleted.

BatchDeleteTableVersion (batch_delete_table_version) glue:BatchDeleteTableVersion
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
BatchGetCrawlers (batch_get_crawlers) glue:BatchGetCrawlers arn:aws:glue:region:account-id:crawler/crawler-name glue:resourceTag
BatchGetDevEndpoints (batch_get_dev_endpoints) glue:BatchGetDevEndpoints arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name glue:resourceTag
BatchGetJobs (batch_get_jobs) glue:BatchGetJobs arn:aws:glue:region:account-id:job/job-name glue:resourceTag
BatchGetPartition (batch_get_partition) glue:BatchGetPartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
BatchGetTriggers (batch_get_triggers) glue:BatchGetTriggers arn:aws:glue:region:account-id:trigger/trigger-name glue:resourceTag
BatchStopJobRun (batch_stop_job_run) glue:BatchStopJobRun *
CreateClassifier (create_classifier) glue:CreateClassifier *
CreateConnection (create_connection) glue:CreateConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
CreateCrawler (create_crawler) glue:CreateCrawler arn:aws:glue:region:account-id:crawler/crawler-name

or

arn:aws:glue:region:account-id:crawler/*
aws:RequestTag
CreateDatabase (create_database) glue:CreateDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
CreateDevEndpoint (create_dev_endpoint) glue:CreateDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

or

arn:aws:glue:region:account-id:devEndpoint/*
aws:RequestTag
CreateJob (create_job) glue:CreateJob arn:aws:glue:region:account-id:job/job-name

or

arn:aws:glue:region:account-id:job/*
aws:RequestTag
CreatePartition (create_partition) glue:CreatePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
CreateScript (create_script) glue:CreateScript *
CreateSecurityConfiguration (create_security_configuration) glue:CreateSecurityConfiguration *
CreateTable (create_table) glue:CreateTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
CreateTrigger (create_trigger) glue:CreateTrigger arn:aws:glue:region:account-id:trigger/trigger-name

or

arn:aws:glue:region:account-id:trigger/*
aws:RequestTag
CreateUserDefinedFunction (create_user_defined_function) glue:CreateUserDefinedFunction >
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteClassifier (delete_classifier) glue:DeleteClassifier *
DeleteConnection (delete_connection) glue:DeleteConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
DeleteCrawler (delete_crawler) glue:DeleteCrawler arn:aws:glue:region:account-id:crawler/crawler-name

or

arn:aws:glue:region:account-id:crawler/*
glue:resourceTag
DeleteDatabase (delete_database) glue:DeleteDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:userDefinedFunction/database-name/* arn:aws:glue:region:account-id:table/database-name/* arn:aws:glue:region:account-id:catalog
DeleteDevEndpoint (delete_dev_endpoint) glue:DeleteDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

or

arn:aws:glue:region:account-id:devEndpoint/*
glue:resourceTag
DeleteJob (delete_job) glue:DeleteJob arn:aws:glue:region:account-id:job/job-name

or

arn:aws:glue:region:account-id:job/*
glue:resourceTag
DeletePartition (delete_partition) glue:DeletePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteResourcePolicy (delete_resource_policy) glue:DeleteResourcePolicy *
DeleteSecurityConfiguration (delete_security_configuration) glue:DeleteSecurityConfiguration *
DeleteTable (delete_table) glue:DeleteTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteTableVersion (delete_table_version) glue:DeleteTableVersion
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteTrigger (delete_trigger) glue:DeleteTrigger arn:aws:glue:region:account-id:trigger/trigger-name

or

arn:aws:glue:region:account-id:trigger/*
glue:resourceTag
DeleteUserDefinedFunction (delete_user_defined_function) glue:DeleteUserDefinedFunction
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetCatalogImportStatus (get_catalog_import_status) glue:GetCatalogImportStatus
arn:aws:glue:region:account-id:catalog
GetClassifier (get_classifier) glue:GetClassifier *
GetClassifiers (get_classifiers) glue:GetClassifiers *
GetConnection (get_connection) glue:GetConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
GetConnections (get_connections) glue:GetConnections
arn:aws:glue:region:account-id:connection/connection-names arn:aws:glue:region:account-id:catalog
GetCrawler (get_crawler) glue:GetCrawler arn:aws:glue:region:account-id:crawler/crawler-name

or

arn:aws:glue:region:account-id:crawler/*
glue:resourceTag
GetCrawlerMetrics (get_crawler_metrics) glue:GetCrawlerMetrics *
GetCrawlers (get_crawlers) glue:GetCrawlers *
GetDatabase (get_database) glue:GetDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetDatabases (get_databases) glue:GetDatabases
arn:aws:glue:region:account-id:database/database-names arn:aws:glue:region:account-id:catalog
GetDataCatalogEncryptionSettings (get_data_catalog_encryption_settings) glue:GetDataCatalogEncryptionSettings *
GetDataflowGraph (get_dataflow_graph) glue:GetDataflowGraph *
GetDevEndpoint (get_dev_endpoint) glue:GetDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

or

arn:aws:glue:region:account-id:devEndpoint/*
glue:resourceTag
GetDevEndpoints (get_dev_endpoints) glue:GetDevEndpoints *
GetJob (get_job) glue:GetJob arn:aws:glue:region:account-id:job/job-name

or

arn:aws:glue:region:account-id:job/*
glue:resourceTag
GetJobRun (get_job_run) glue:GetJobRun *
GetJobRuns (get_job_runs) glue:GetJobRuns *
GetJobs (get_jobs) glue:GetJobs *
GetMapping (get_mapping) glue:GetMapping *
GetPartition (get_partition) glue:GetPartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetPartitions (get_partitions) glue:GetPartitions
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetPlan (get_plan) glue:GetPlan *
GetResourcePolicy (get_resource_policy) glue:GetResourcePolicy *
GetSecurityConfiguration (get_security_configuration) glue:GetSecurityConfiguration *
GetSecurityConfigurations (get_security_configurations) glue:GetSecurityConfigurations *
GetTable (get_table) glue:GetTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTables (get_tables) glue:GetTables
arn:aws:glue:region:account-id:table/database-name/table-names arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTableVersion (get_table_version) glue:GetTableVersion
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTableVersions (get_table_versions) glue:GetTableVersions
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTags (get_tags) glue:GetTags *
GetTrigger (get_trigger) glue:GetTrigger arn:aws:glue:region:account-id:trigger/trigger-name

or

arn:aws:glue:region:account-id:trigger/*
glue:resourceTag
GetTriggers (get_triggers) glue:GetTriggers *
GetUserDefinedFunction (get_user_defined_function) glue:GetUserDefinedFunction
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetUserDefinedFunctions (get_user_defined_functions) glue:GetUserDefinedFunctions
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-names arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
ImportCatalogToGlue (import_catalog_to_glue) glue:ImportCatalogToGlue
arn:aws:glue:region:account-id:catalog
ListCrawlers (list_crawlers) glue:ListCrawlers *
ListDevEndpoints (list_dev_endpoints) glue:ListDevEndpoints *
ListJobs (list_jobs) glue:ListJobs *
ListTriggers (list_triggers) glue:ListTriggers *
PutResourcePolicy (put_resource_policy) glue:PutResourcePolicy *
PutDataCatalogEncryptionSettings (put_data_catalog_encryption_settings) glue:PutDataCatalogEncryptionSettings *
ResetJobBookmark (reset_job_bookmark) glue:ResetJobBookmark *
StartCrawler (start_crawler) glue:StartCrawler arn:aws:glue:region:account-id:crawler/crawler-name

or

arn:aws:glue:region:account-id:crawler/*
glue:resourceTag
StartCrawlerSchedule (start_crawler_schedule) glue:StartCrawlerSchedule *
StartJobRun (start_job_run) glue:StartJobRun *
StartTrigger (start_trigger) glue:StartTrigger arn:aws:glue:region:account-id:trigger/trigger-name

or

arn:aws:glue:region:account-id:trigger/*
glue:resourceTag
StopCrawler (stop_crawler) glue:StopCrawler arn:aws:glue:region:account-id:crawler/crawler-name

or

arn:aws:glue:region:account-id:crawler/*
glue:resourceTag
StopCrawlerSchedule (stop_crawler_schedule) glue:StopCrawlerSchedule *
StopTrigger (stop_trigger) glue:StopTrigger arn:aws:glue:region:account-id:trigger/trigger-name

or

arn:aws:glue:region:account-id:trigger/*
glue:resourceTag
TagResource (tag_resource) glue:TagResource * aws:RequestTag
UntagResource (untag_resource) glue:UntagResource * aws:TagKeys
UpdateClassifier (update_classifier) glue:UpdateClassifier *
UpdateConnection (update_connection) glue:UpdateConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
UpdateCrawler (update_crawler) glue:UpdateCrawler arn:aws:glue:region:account-id:crawler/crawler-name

or

arn:aws:glue:region:account-id:crawler/*
glue:resourceTag
UpdateCrawlerSchedule (update_crawler_schedule) glue:UpdateCrawlerSchedule *
UpdateDatabase (update_database) glue:UpdateDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
UpdateDevEndpoint (update_dev_endpoint) glue:UpdateDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

or

arn:aws:glue:region:account-id:devEndpoint/*
glue:resourceTag
UpdateJob (update_job) glue:UpdateJob arn:aws:glue:region:account-id:job/job-name

or

arn:aws:glue:region:account-id:job/*
glue:resourceTag
UpdatePartition (update_partition) glue:UpdatePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
UpdateTable (update_table) glue:UpdateTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
UpdateTrigger (update_trigger) glue:UpdateTrigger arn:aws:glue:region:account-id:trigger/trigger-name

or

arn:aws:glue:region:account-id:trigger/*
glue:resourceTag
UpdateUserDefinedFunction (update_user_defined_function) glue:UpdateUserDefinedFunction
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog

On this page: