AwsGlueDataBrewDataResourcePolicy - Amazon Glue DataBrew
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

AwsGlueDataBrewDataResourcePolicy

The AwsGlueDataBrewDataResourcePolicy policy grants the permissions needed to connect to data and to configure DataBrew.

The following table describes the permissions granted by this policy.

Action Resource Description

"s3:GetObject"

"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"

Allows you to preview your files.

"s3:PutObject"

"s3:PutBucketCORS"

"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"

Allows sending output files to S3.

"s3:DeleteObject"

"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"

Allows deleting an object created by DataBrew.

"s3:ListBucket"

"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"

Allows listing of Amazon S3 buckets from projects, datasets, and jobs.
"kms:Decrypt"

"arn:aws:kms:::key/key_ids"

Allows decrypting for encrypted datasets.

"kms:GenerateDataKey"

"arn:aws:kms:::key/key_ids"

Allows encrypting of job output.

"ec2:DescribeVpcEndpoints"

"ec2:DescribeRouteTables"

"ec2:DeleteNetworkInterface"

"ec2:DescribeNetworkInterfaces"

"ec2:DescribeSecurityGroups"

"ec2:DescribeSubnets"

"ec2:DescribeVpcAttribute"

"ec2:CreateNetworkInterface"

"*"

Allows the setup of Amazon EC2 network items, such as virtual private clouds (VPCs), when running jobs and projects.

"ec2:DeleteNetworkInterface"

"*" Allows deleting a network interface in a VPC.

"ec2:CreateTags"

"ec2:DeleteTags"

"arn:aws:ec2:::network-interface/*", "arn:aws:ec2:::security-group/*"

Allows creating and deleting tags.

You need these permissions if you use an Amazon Glue Data Catalog with a VPC enabled. DataBrew passes data to Amazon Glue to run your jobs and projects. These permissions allow tagging of Amazon EC2 resources created for development endpoints. Amazon Glue tags Amazon EC2 network interfaces, security groups, and instances with aws-glue-service-resource.

"logs:CreateLogGroup"

"logs:CreateLogStream"

"logs:PutLogEvents"

"arn:aws:logs:::log-group:/aws-glue-databrew/*"

Allows writing logs to Amazon CloudWatch Logs

DataBrew writes logs to log groups whose names begin with aws-glue-databrew.

"lakeformation:GetDataAccess"

"*"

Allows access to Amazon Lake Formation, provided "Glue":"GetTable" is also allowed

Using Lake Formation requires further configuration in the Lake Formation console.