Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Use the Amazon Glue Data Catalog as the metastore for Spark SQL

Using Amazon EMR release 5.8.0 or later, you can configure Spark SQL to use the Amazon Glue Data Catalog as its metastore. We recommend this configuration when you require a persistent metastore or a metastore shared by different clusters, services, applications, or Amazon accounts.

Amazon Glue is a fully managed extract, transform, and load (ETL) service that makes it simple and cost-effective to categorize your data, clean it, enrich it, and move it reliably between various data stores. The Amazon Glue Data Catalog provides a unified metadata repository across a variety of data sources and data formats, integrating with Amazon EMR as well as Amazon RDS, Amazon Redshift, Redshift Spectrum, Athena, and any application compatible with the Apache Hive metastore. Amazon Glue crawlers can automatically infer schema from source data in Amazon S3 and store the associated metadata in the Data Catalog. For more information about the Data Catalog, see Populating the Amazon Glue Data Catalog in the Amazon Glue Developer Guide.

Separate charges apply for Amazon Glue. There is a monthly rate for storing and accessing the metadata in the Data Catalog, an hourly rate billed per minute for Amazon Glue ETL jobs and crawler runtime, and an hourly rate billed per minute for each provisioned development endpoint. The Data Catalog allows you to store up to a million objects at no charge. If you store more than a million objects, you are charged USD$1 for each 100,000 objects over a million. An object in the Data Catalog is a table, partition, or database. For more information, see Glue Pricing.

Specifying Amazon Glue Data Catalog as the metastore

You can specify the Amazon Glue Data Catalog as the metastore using the Amazon Web Services Management Console, Amazon CLI, or Amazon EMR API. When you use the CLI or API, you use the configuration classification for Spark to specify the Data Catalog. In addition, with Amazon EMR 5.16.0 and later, you can use the configuration classification to specify a Data Catalog in a different Amazon Web Services account. When you use the console, you can specify the Data Catalog using Advanced Options or Quick Options.

New console

To specify Amazon Glue Data Catalog as the Spark metastore with the new console

1. Sign in to the Amazon Web Services Management Console, and open the Amazon EMR console at https://console.amazonaws.cn/emr.

2. Under Amazon EMR on EC2 in the left navigation pane, choose Clusters, and then choose Create cluster.

3. Under Application bundle, choose Spark or Custom. If you customize your cluster, make sure that you select Zeppelin or Spark as one of your applications.

4. Under Amazon Glue Data Catalog settings, select the Use for Spark table metadata check box.

5. Choose any other options that apply to your cluster.

6. To launch your cluster, choose Create cluster.

Old console

To specify Amazon Glue Data Catalog as the Spark metastore with the old console

1. Navigate to the new Amazon EMR console and select Switch to the old console from the side navigation. For more information on what to expect when you switch to the old console, see Using the old console.

2. Choose Create cluster, Go to advanced options.

3. For Release, choose emr-5.8.0 or later.

4. Under Release, select Spark or Zeppelin.

5. Under Amazon Glue Data Catalog settings, select Use for Spark table metadata.

6. Choose other options for your cluster as appropriate, choose Next, and then configure other cluster options as appropriate for your application.

Amazon CLI

To specify the Amazon Glue Data Catalog as the Spark metastore with the Amazon CLI

For more information about specifying a configuration classification using the Amazon CLI and Amazon EMR API, see Configure applications.

• Specify the value for hive.metastore.client.factory.class using the spark-hive-site classification as shown in the following example:

  [
    {
      "Classification": "spark-hive-site",
      "Properties": {
        "hive.metastore.client.factory.class": "com.amazonaws.glue.catalog.metastore.AWSGlueDataCatalogHiveClientFactory"
      }
    }
  ]
  						

  To specify a Data Catalog in a different Amazon account, add the hive.metastore.glue.catalogid property as shown in the following example. Replace acct-id with the Amazon account of the Data Catalog.

  [
    {
      "Classification": "spark-hive-site",
      "Properties": {
        "hive.metastore.client.factory.class": "com.amazonaws.glue.catalog.metastore.AWSGlueDataCatalogHiveClientFactory",
        "hive.metastore.glue.catalogid": "acct-id"
      }
    }
  ]
  						

IAM permissions

The EC2 instance profile for a cluster must have IAM permissions for Amazon Glue actions. In addition, if you enable encryption for Amazon Glue Data Catalog objects, the role must also be allowed to encrypt, decrypt and generate the Amazon KMS key used for encryption.

Permissions for Amazon Glue actions

If you use the default EC2 instance profile for Amazon EMR, no action is required. The AmazonElasticMapReduceforEC2Role managed policy that is attached to the EMR_EC2_DefaultRole allows all necessary Amazon Glue actions. However, if you specify a custom EC2 instance profile and permissions, you must configure the appropriate Amazon Glue actions. Use the AmazonElasticMapReduceforEC2Role managed policy as a starting point. For more information, see Service role for cluster EC2 instances (EC2 instance profile) in the Amazon EMR Management Guide.

Permissions for encrypting and decrypting Amazon Glue Data Catalog

Your instance profile needs permission to encrypt and decrypt data using your key. You do not need to configure these permissions if both of the following statements apply:

Otherwise, you must add the following statement to the permissions policy attached to your EC2 instance profile.

[
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "kms:Decrypt",
                    "kms:Encrypt",
                    "kms:GenerateDataKey"
                ],
                "Resource": "arn:aws:kms:region:acct-id:key/12345678-1234-1234-1234-123456789012"
            }
        ]
    }
]

For more information about Amazon Glue Data Catalog encryption, see Encrypting your data catalog in the Amazon Glue Developer Guide.

Resource-based permissions

If you use Amazon Glue in conjunction with Hive, Spark, or Presto in Amazon EMR, Amazon Glue supports resource-based policies to control access to Data Catalog resources. These resources include databases, tables, connections, and user-defined functions. For more information, see Amazon Glue Resource Policies in the Amazon Glue Developer Guide.

When using resource-based policies to limit access to Amazon Glue from within Amazon EMR, the principal that you specify in the permissions policy must be the role ARN associated with the EC2 instance profile that is specified when a cluster is created. For example, for a resource-based policy attached to a catalog, you can specify the role ARN for the default service role for cluster EC2 instances, EMR_EC2_DefaultRole as the Principal, using the format shown in the following example:

arn:aws:iam::acct-id:role/EMR_EC2_DefaultRole

The acct-id can be different from the Amazon Glue account ID. This enables access from EMR clusters in different accounts. You can specify multiple principals, each from a different account.

Considerations when using Amazon Glue Data Catalog

Consider the following items when using Amazon Glue Data Catalog as a metastore with Spark: