Prerequisites Create Federated Catalog Considerations when integrating with Workday Data Connect Information to collect from your Workday administrator

Federate to Workday Data Connect

AWS Glue Data Catalog federates to Workday Data Connect using the OAuth2 credentials of a Workday Integration System User (ISU). Workday Data Connect is the zero-copy connector for Workday Data Lake. Workday Data Lake stores Workday data as Apache Iceberg tables and exposes them through an Iceberg REST catalog. With this authentication mechanism, AWS Glue Data Catalog can access the metadata of various objects (such as catalogs, databases, and tables) in your Workday Data Lake. This access is based on the Data Lake access roles assigned to the ISU. To ensure access to the right objects, assign the ISU a Data Lake access role in Workday that includes the tables you want to query.

Workday Data Lake tables are stored in Amazon S3 locations that Workday manages. When you query a federated Workday table, the Workday catalog vends short-lived, table-scoped credentials for the table's data. AWS analytics engines use those credentials to read the Iceberg data files directly. You don't need to grant Lake Formation access to the Amazon S3 locations that Workday manages. Lake Formation governs which databases, tables, and columns each principal in your account can access.

Follow the Workday documentation to set up Workday Data Lake, the ISU, and the API client in your Workday tenant. For more information, see Get Started with Workday Data Lake in the Workday documentation.

Prerequisites

Before you create a federated catalog in AWS Glue Data Catalog that is governed by Lake Formation, ensure you have the following permissions and information:

Your IAM principal (user or role) must have the following permissions:

Lake Formation permissions – lakeformation:RegisterResource, lakeformation:DescribeResource
AWS Glue permissions – glue:CreateConnection, glue:CreateCatalog, glue:GetConnection, glue:PassConnection
Secrets Manager permissions – secretsmanager:CreateSecret, secretsmanager:GetSecretValue
IAM permissions – iam:CreateRole, iam:AttachRolePolicy, iam:PassRole

You must be a Lake Formation data lake administrator or have CREATE_CATALOG permission on the Data Catalog.

You also need the following information from your Workday administrator:

Catalog URL – The Iceberg REST catalog endpoint of your Workday Data Lake, for example https://catalog.data-center-code.myworkday.com, where data-center-code is your Workday environment prefix, such as wd00.
Token URL – The OAuth 2.0 token endpoint of the Workday catalog, for example https://host/ccx/oauth2/tenant/token.
Tenant ID – The identifier of your Workday tenant.
Client ID – The client ID of the API client registered for Data Lake. For more information, see Register API Client for Data Lake (JWT Bearer Grant) or Register API Client for Data Lake (Refresh Token Grant) in the Workday documentation.
ISU user name and private key – The ISU user name and the RSA private key, in PEM format, matching the x509 certificate registered for the API client. For more information, see Set Up Integration System Users for Data Lake in the Workday documentation.

Create Federated Catalog

Create an AWS Secrets Manager secret

The AWS Glue connector supports OAuth2 with two grant types: JWT bearer and refresh token. For JWT bearer, store the ISU user name and private key. AWS Glue signs a JWT with the private key and exchanges it for an access token at the Workday token URL. For refresh token, store the client secret and refresh token.

In the following example, replace <workday-secret>, <isu-user-name>, <private-key>, and <region> with your own information.
```
aws secretsmanager create-secret \
--name <workday-secret> \
--description "Workday Data Connect secret" \
--secret-string '{
"USERNAME": "<isu-user-name>",
"PRIVATE_KEY_PEM": "-----BEGIN PRIVATE KEY-----\n<private-key>\n-----END PRIVATE KEY-----"
}' \
--region <region>
```
Note
USERNAME and PRIVATE_KEY_PEM are reserved keywords that AWS Glue uses to refer to the ISU user name and private key. For refresh token, use USER_MANAGED_CLIENT_APPLICATION_CLIENT_SECRET and REFRESH_TOKEN instead. Store the private key as a single JSON string, using \n escape sequences for the PEM line breaks. After it first connects, AWS Glue adds an ACCESS_TOKEN key to the secret.

Create an IAM role that gives the AWS Glue connection object access to the secret created in the previous step

The AWS Glue connection object requires access to the AWS Secrets Manager secret. The AWS Glue connection object also requires access to create, describe, and use the Amazon VPC network interfaces when you use a Amazon VPC endpoint to restrict connectivity to your Workday tenant.

Create an IAM policy and attach it to an IAM role. Add the AWS Glue service principal to the trust policy.

In the following example, replace <your-secrets-manager-ARN>, <your-vpc-id>, <your-subnet-id1>, and <account-id> with your own information.

Example IAM Policy


{
    "Version": "2012-10-17",
    "Statement": [{
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:PutSecretValue"
            ],
            "Resource": [
                "<your-secrets-manager-ARN>"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeNetworkInterfaces"
            ],
            "Resource": "*",
            "Condition": {
                "ArnEquals": {
                    "ec2:Vpc": "arn:aws:ec2:region:account-id:vpc/<your-vpc-id>",
                    "ec2:Subnet": ["arn:aws:ec2:region:account-id:subnet/<your-subnet-id1>"]
                }
            }
        }
    ]
}

Example Trust Policy


{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Principal": {
            "Service": "glue.amazonaws.com"
        },
        "Action": "sts:AssumeRole",
        "Condition": {
            "StringEquals": {
                "aws:SourceAccount": "<account-id>"
            }
        }
    }]
}

Create an IAM role that Lake Formation uses to access the Workday catalog

Lake Formation uses this IAM role to retrieve the ISU credentials from AWS Secrets Manager. Unlike other remote Iceberg catalogs, this role does not need Amazon S3 or AWS KMS access, because the Workday catalog vends scoped credentials for the Amazon S3 locations of its tables at query time.

Create an IAM policy and attach it to an IAM role. Add the Lake Formation service principal to the IAM role trust policy.

In the following example, replace <your-secrets-manager-ARN> and <account-id> with your own information.

Example IAM Policy


{
    "Version": "2012-10-17",
    "Statement": [{
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:PutSecretValue"
            ],
            "Resource": [
                "<your-secrets-manager-ARN>"
            ]
        }
    ]
}

Example Trust Policy


{
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
            "Service": "lakeformation.amazonaws.com"
        },
        "Action": "sts:AssumeRole",
        "Condition": {
            "StringEquals": {
                "aws:SourceAccount": "<account-id>"
            }
        }
    }]
}

Note

When you use the Lake Formation console to create a federated catalog, the console uses a single IAM role with both policies attached to complete setup.

Considerations when integrating with Workday Data Connect

When Workday removes a table from your Data Lake, or you remove a table from the ISU's Data Lake access role, Lake Formation does not automatically revoke the permissions granted on that federated resource. To remove the access, explicitly revoke the permissions that were previously granted using Lake Formation.
The databases and tables that appear in the federated catalog depend on the tables in the ISU's Data Lake access role and the tables and columns added to your Data Lake in Workday. Workday enforces access at the table level, and only the columns added to the Data Lake are available. Lake Formation permissions can narrow this access further, but can't grant access beyond it. For more information, see Configure Data Lake Access Roles and Add Tables and Columns to Data Lake in the Workday documentation.
Workday refreshes Data Lake tables from your Workday tenant on a schedule (hourly, daily, or weekly, depending on your subscription and tenant type), so data in the federated catalog can lag behind your Workday tenant. For real-time access, use the Workday Live Data Query connector instead. For more information, see Connecting to Workday Live Data Query in the AWS Glue User Guide.
Workday Data Lake namespaces include workday_core for Workday business object tables and join_workday_core for joiner tables that flatten array relationships into two-column tables. For more information, see Query Workday Data Lake in the Workday documentation.
You can reuse the same AWS Glue connection to create multiple federated catalogs. Deleting a catalog does not delete the associated connection object. To delete a connection object, use the AWS CLI aws glue delete-connection command and ensure all associated catalogs are deleted first.
Nested namespaces are not supported. That is, catalog federation can access remote Iceberg tables that follow a 3-part notation catalog.database.table.

Information to collect from your Workday administrator

Collect the following information from your Workday administrator before you create the connection. The information that you need depends on the OAuth 2.0 grant type, either JWT bearer or refresh token.

Information to collect from your Workday administrator
Value	Description	Example
Catalog URL	The Iceberg REST catalog endpoint of your Workday Data Lake. The `data-center-code` is your Workday environment prefix, such as `wd00`.	`https://catalog.data-center-code.myworkday.com`
Token URL	The OAuth 2.0 token endpoint of the Workday catalog.	`https://host/ccx/oauth2/tenant/token`
Tenant ID	The identifier of your Workday tenant.	`aws_tenant1`
Client ID	The client ID of the API client registered for Data Lake.	`MThmMWI3YWEtZDZjMS00MzRmLTliZWBeMzg4ZjI2NmI1MjFl4`
ISU user name	The user name of the ISU. Required for the JWT bearer grant type (stored in the secret as `USERNAME`).	`demo-isu`
Private key	The RSA private key, in PEM format, that matches the x509 certificate registered for the API client. Required for the JWT bearer grant type (stored in the secret as `PRIVATE_KEY_PEM`).	`-----BEGIN PRIVATE KEY----- … -----END PRIVATE KEY-----`
Client secret	The client secret of the API client registered for Data Lake. Required for the refresh token grant type (stored in the secret as `USER_MANAGED_CLIENT_APPLICATION_CLIENT_SECRET`).	`yego9m0c...hniqtw`
Refresh token	The refresh token of the API client registered for Data Lake. Required for the refresh token grant type (stored in the secret as `REFRESH_TOKEN`).	`nmdjc98r2j...4e6fqz9swlc`

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Federate to Databricks

Bringing Amazon Redshift data into the Data Catalog