Configuring Zendesk connections - Amazon Glue
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Configuring Zendesk connections

The Zendesk connector supports the Authorization Code grant type.

  • This grant type is considered "three-legged" OAuth as it relies on redirecting users to a third-party authorization server to authenticate the user. It is used when creating connections via the Amazon Glue console. The user creating a connection may by default rely on an Amazon Glue-owned connected app (Amazon Glue-managed client application) where they do not need to provide any OAuth related information except for their Zendesk instance URL. The Amazon Glue console will redirect the user to Zendesk where the user must login and allow Amazon Glue the requested permissions to access their Zendesk instance.

  • You may still opt to create your own connected app in Zendesk and provide your own client ID and client secret when creating connections through the Amazon Glue console. In this scenario, you will still be redirected to Zendesk to login and authorize Amazon Glue to access your resources.

  • This grant type results in an access token. The access token never expires.

For public Zendesk documentation on creating a connected app for the Authorization Code OAuth flow, see OAuth Tokens for Grant Types.

To configure a Zendesk connection:

  1. In Amazon Secrets Manager, create a secret with the following details:

    1. For the AuthorizationCode grant type: for a customer managed connected app the secret should contain the connected app Consumer Secret with USER_MANAGED_CLIENT_APPLICATION_CLIENT_SECRET as key.

    2. Note: You must create a secret per connection in Amazon Glue.

  2. In the Amazon Glue Data Catalog, create a connection by following the steps below:

    1. When selecting a Connection type, select Zendesk.

    2. Provide the INSTANCE_URL of the Zendesk you want to connect to.

    3. Provide the Zendesk environment.

    4. Select the Amazon IAM role which Amazon Glue can assume and has permissions for following actions:

      {
"Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:DescribeSecret",
                "secretsmanager:GetSecretValue",
                "secretsmanager:PutSecretValue",
                "ec2:CreateNetworkInterface",
                "ec2:DescribeNetworkInterface",
                "ec2:DeleteNetworkInterface",
            ],
            "Resource": "*"
        }
    ]
}

    5. Select the secretName which you want to use for this connection in Amazon Glue to put the tokens.

    6. Select the network options if you want to use your network.

  3. Grant the IAM role associated with your Amazon Glue job permission to read secretName.

  4. In your Amazon Glue job configuration, provide connectionName as an Additional network connection.