Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Getting started with trusted identity propagation in Amazon Glue ETL

This section helps you configure Amazon Glue application with interactive sessions to integrate with IAM Identity Center and enable Trusted identity propagation.

Prerequisites

Permissions needed to connect Amazon Glue ETL with IAM Identity Center

Create an IAM role

The role that creates IAM Identity Center connection requires permissions to create and modify application configuration in Amazon Glue and IAM Identity Center as in the following inline policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glue:CreateGlueIdentityCenterConfiguration",
                "sso:CreateApplication",
                "sso:PutApplicationAssignmentConfiguration",
                "sso:PutApplicationAuthenticationMethod",
                "sso:PutApplicationGrant",
                "sso:PutApplicationAccessScope",
                "sso:ListInstances"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

The following inline policies contain specific permissions required to view, update, and delete properties of Amazon Glue integration with IAM Identity Center.

Use the following inline policy to allow an IAM role to view a Amazon Glue integration with IAM Identity Center.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glue:GetGlueIdentityCenterConfiguration"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Use the following inline policy to allow an IAM role to update Amazon Glue integration with IAM Identity Center.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glue:UpdateGlueIdentityCenterConfiguration",
                "sso:PutApplicationAccessScope",
                "sso:DeleteApplicationAccessScope"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Use the following inline policy to allow an IAM role to delete a Amazon Glue integration with IAM Identity Center.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glue:DeleteGlueIdentityCenterConfiguration",
                "sso:DeleteApplication"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Permissions description

Connecting Amazon Glue with IAM Identity Center

When Amazon Glue is connected to IAM Identity Center, it creates a singleton managed IdC application per account. The following example shows how you can connect Amazon Glue with IAM Identity Center:

aws glue create-glue-identity-center-configuration \
--instance-arn arn:aws:sso:::instance/ssoins-123456789 \
--scopes '["s3:access_grants:read_write", "redshift:connect","lakeformation:query"]'

To update the scopes of the managed application (usually done to propagate to more downstream services), you can use:

aws glue update-glue-identity-center-configuration \
--scopes '["s3:access_grants:read_write", "redshift:connect","lakeformation:query"]'

Scopes parameter is optional and all scopes will be added if not provided. The supported values are s3:access_grants:read_write, redshift:connect and lakeformation:query.

To get the details of the configuration, you can use:

aws glue get-glue-identity-center-configuration

You can delete the connection between Amazon Glue and IAM Identity Center by using the following command:

aws glue delete-glue-identity-center-configuration

Creating a Amazon Glue Interactive Session with Trusted Identity Propagation Enabled

After you connect Amazon Glue with IAM Identity Center, you can use identity-enhanced role credentials to create a Amazon Glue interactive session. You need not pass additional parameters when creating a 5.0 Amazon Glue session. Since Amazon Glue is connected with IAM identity center, if Amazon Glue detects identity-enhanced-role-credentials, it will automatically propagate the identity information to downstream services which are called as part of your statements. However, the runtime role for the session needs to have the sts:SetContext permission as depicted below.

Runtime Role permissions to propagate identity

As Amazon Glue sessions leverage Identity-enhanced credentials to propagate identity to downstream Amazon services, its runtime role's trust-policy need to have addition permission sts:SetContext to allow identity propagation to downstream services (Amazon S3 access-grant, Lake Formation, Amazon Redshift). To learn more about how to create a runtime role, see Setting up a runtime role.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "glue.amazonaws.com"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:SetContext"
      ]
    }
  ]
}

Additionally, Runtime role would need permissions for downstream Amazon services which job-run would invoke to fetch data using user identity. Please refer to the following links to configure Amazon S3 Access Grants and Lake Formation: