# AwsGlueDataBrewCustomUserPolicy
<a name="iam-policy-to-use-databrew-console"></a>

The `AwsGlueDataBrewCustomUserPolicy` policy grants most of the permissions required to use the DataBrew console. Some of the resources that are specified in this policy refer to services that are used by DataBrew. These include names for Amazon Glue Data Catalog, Amazon S3 buckets, Amazon CloudWatch Logs, and Amazon KMS resources. It is similar to the Amazon-managed policy named `AwsGlueDataBrewFullAccessPolicy`.

The following table describes the permissions granted by this policy.


|  **Action**  |  **Resource**  |  **Description**  | 
| --- | --- | --- | 
|  `"databrew:*"`  |  `"*"`  | Grants permission to run all DataBrew API operations. | 
|  `"glue:GetDatabases"` <br /> `"glue:GetPartitions"` <br /> `"glue:GetTable"` <br />`"glue:GetTables"`<br /> `"glue:GetDataCatalogEncryptionSettings"`  |  "\*"  | Allows listing of Amazon Glue databases and tables. | 
|  `"dataexchange:ListDataSets"` <br /> `"dataexchange:ListDataSetRevisions"` <br /> `"dataexchange:ListRevisionAssets"` <br />`"dataexchange:CreateJob"` <br /> `"dataexchange:StartJob"` <br /> `"dataexchange:GetJob"`  |  `"*"`  | Allows listing of Amazon Data Exchange resources in datasets. | 
|  `"kms:DescribeKey"` <br /> `"kms:ListKeys"` <br /> `"kms:ListAliases"`  |  `"*"`  | Allows listing of Amazon KMS keys to use for encryption of job output. | 
|  `"kms:GenerateDataKey"`  |  `"arn:aws:kms:::key/key_ids"`  | Allows encrypting of job output. | 
|  `"s3:ListAllMyBuckets"` <br /> `"s3:GetBucketCORS"` <br /> `"s3:GetBucketLocation"` <br /> `"s3:GetEncryptionConfiguration"`  |  `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"`  | Allows listing of Amazon S3 buckets for projects, datasets, and jobs. Allows sending output files to S3. | 
|  `"sts:GetCallerIdentity"`  |  `"*"`  | Get information about the current caller. | 
|  `"cloudtrail:LookupEvents",`  |  `"*"`  | Allow listing Amazon CloudTrail events for datasets (data lineage). | 
|  `"iam:ListRoles"` <br /> `"iam:GetRole"`  |  `"*"`  | Allows listing IAM roles to use for projects and jobs. |