Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Glue

Amazon Glue (service prefix: glue) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon Glue

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchDeleteConnection	glue:BatchDeleteConnection			Write
BatchDeleteConnection	glue:DeleteConnection			Write
BatchDeleteTableVersion	glue:BatchDeleteTableVersion			Write
BatchDeleteTableVersion	glue:DeleteTableVersion			Write
BatchGetBlueprints	glue:BatchGetBlueprints			Read
BatchGetBlueprints	glue:GetBlueprint			Read
BatchGetCrawlers	glue:BatchGetCrawlers			Read
BatchGetCustomEntityTypes	glue:BatchGetCustomEntityTypes			Read
BatchGetCustomEntityTypes	glue:GetCustomEntityType			Read
BatchGetDataQualityResult	glue:GetDataQualityResult			Read
BatchGetDevEndpoints	glue:BatchGetDevEndpoints			Read
BatchGetDevEndpoints	glue:GetDevEndpoint			Read
BatchGetJobs	glue:BatchGetJobs			Read
BatchGetJobs	glue:GetJob			Read
BatchGetTableOptimizer	glue:BatchGetTableOptimizer			Read
BatchGetTriggers	glue:BatchGetTriggers			Read
BatchGetTriggers	glue:GetTrigger			Read
BatchGetWorkflows	glue:BatchGetWorkflows			Read
BatchGetWorkflows	glue:GetWorkflow			Read
BatchPutDataQualityStatisticAnnotation	glue:PutDataQualityStatisticAnnotation			Write
BatchStopJobRun	glue:BatchStopJobRun			Write
CancelDataQualityRuleRecommendationRun	glue:CancelDataQualityRuleRecommendationRun			Write
CancelDataQualityRulesetEvaluationRun	glue:CancelDataQualityRulesetEvaluationRun			Write
CancelMLTaskRun	glue:CancelMLTaskRun			Write
CancelStatement	glue:CancelStatement			Write
CheckSchemaVersionValidity	glue:CheckSchemaVersionValidity			Read
CreateBlueprint	glue:CreateBlueprint			Write
CreateBlueprint	glue:TagResource			Tagging, Write
CreateCatalog	glue:CreateCatalog			Write
	glue:PassConnection			Write
	glue:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreateClassifier	glue:CreateClassifier			Write
CreateColumnStatisticsTaskSettings	glue:CreateColumnStatisticsTaskSettings			Write
CreateColumnStatisticsTaskSettings	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreateConnection	glue:CreateConnection			Write
	glue:DescribeConnectionType			Permissions management, Write
	glue:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreateCrawler	glue:CreateCrawler			Write
	glue:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreateCustomEntityType	glue:CreateCustomEntityType			Write
CreateCustomEntityType	glue:TagResource			Tagging, Write
CreateDataQualityRuleset	glue:CreateDataQualityRuleset			Write
CreateDataQualityRuleset	glue:TagResource			Tagging, Write
CreateDatabase	glue:CreateDatabase			Write
	glue:PassConnection			Write
	glue:TagResource			Tagging, Write
CreateDevEndpoint	glue:CreateDevEndpoint			Write
	glue:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreateGlueIdentityCenterConfiguration	glue:CreateGlueIdentityCenterConfiguration			Write
CreateIntegration	glue:CreateIntegration			Write
CreateIntegration	glue:TagResource			Tagging, Write
CreateIntegrationResourceProperty	glue:CreateIntegrationResourceProperty			Write
	glue:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreateIntegrationTableProperties	glue:CreateIntegrationTableProperties			Write
CreateJob	glue:CreateJob			Write
	glue:GetUsageProfile			Read
	glue:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreateMLTransform	glue:CreateMLTransform			Write
	glue:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreatePartition	glue:CreatePartition			Write
CreatePartitionIndex	glue:UpdateTable			Write
CreateRegistry	glue:CreateRegistry			Write
CreateRegistry	glue:TagResource			Tagging, Write
CreateSchema	glue:CreateSchema			Write
CreateSchema	glue:TagResource			Tagging, Write
CreateScript	glue:CreateScript			Write
CreateSecurityConfiguration	glue:CreateSecurityConfiguration			Write
CreateSession	glue:CreateSession			Write
	glue:GetUsageProfile			Read
	glue:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreateTable	glue:CreateTable			Write
	glue:PassConnection			Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreateTableOptimizer	glue:CreateTableOptimizer			Write
	glue:PassConnection			Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
CreateTrigger	glue:CreateTrigger			Write
CreateTrigger	glue:TagResource			Tagging, Write
CreateUsageProfile	glue:CreateUsageProfile			Write
CreateUsageProfile	glue:TagResource			Tagging, Write
CreateUserDefinedFunction	glue:CreateUserDefinedFunction			Write
CreateWorkflow	glue:CreateWorkflow			Write
CreateWorkflow	glue:TagResource			Tagging, Write
DeleteBlueprint	glue:DeleteBlueprint			Write
DeleteCatalog	glue:DeleteCatalog			Write
DeleteClassifier	glue:DeleteClassifier			Write
DeleteColumnStatisticsForPartition	glue:UpdatePartition			Write
DeleteColumnStatisticsForTable	glue:UpdateTable			Write
DeleteColumnStatisticsTaskSettings	glue:DeleteColumnStatisticsTaskSettings			Write
DeleteConnection	glue:DeleteConnection			Write
DeleteConnectionType	glue:DeleteConnectionType			Write
DeleteCrawler	glue:DeleteCrawler			Write
DeleteCustomEntityType	glue:DeleteCustomEntityType			Write
DeleteDataQualityRuleset	glue:DeleteDataQualityRuleset			Write
DeleteDatabase	glue:DeleteDatabase			Write
DeleteDevEndpoint	glue:DeleteDevEndpoint			Write
DeleteGlueIdentityCenterConfiguration	glue:DeleteGlueIdentityCenterConfiguration			Write
DeleteIntegration	glue:DeleteIntegration			Write
DeleteIntegrationResourceProperty	glue:DeleteIntegrationResourceProperty			Write
DeleteIntegrationTableProperties	glue:DeleteIntegrationTableProperties			Write
DeleteJob	glue:DeleteJob			Write
DeleteMLTransform	glue:DeleteMLTransform			Write
DeletePartition	glue:DeletePartition			Write
DeletePartitionIndex	glue:UpdateTable			Write
DeleteRegistry	glue:DeleteRegistry			Write
DeleteSchema	glue:DeleteSchema			Write
DeleteSchemaVersions	glue:DeleteSchemaVersions			Write
DeleteSecurityConfiguration	glue:DeleteSecurityConfiguration			Write
DeleteSession	glue:DeleteSession			Write
DeleteTable	glue:DeleteTable			Write
DeleteTableOptimizer	glue:DeleteTableOptimizer			Write
DeleteTableVersion	glue:DeleteTableVersion			Write
DeleteTrigger	glue:DeleteTrigger			Write
DeleteUsageProfile	glue:DeleteUsageProfile			Write
DeleteUserDefinedFunction	glue:DeleteUserDefinedFunction			Write
DeleteWorkflow	glue:DeleteWorkflow			Write
DescribeConnectionType	glue:DescribeConnectionType			Permissions management, Write
DescribeEntity	glue:DescribeEntity			Permissions management, Write
DescribeInboundIntegrations	glue:DescribeInboundIntegrations			List
DescribeIntegrations	glue:DescribeIntegrations			List
GetBlueprint	glue:GetBlueprint			Read
GetBlueprintRun	glue:GetBlueprintRun			Read
GetBlueprintRuns	glue:GetBlueprintRuns			Read
GetCatalog	glue:GetCatalog			Read
GetCatalogImportStatus	glue:GetCatalogImportStatus			Read
GetCatalogs	glue:GetCatalogs			Read
GetCatalogs	athena:GetCatalogs			Read
GetClassifier	glue:GetClassifier			Read
GetClassifiers	glue:GetClassifiers			Read
GetColumnStatisticsForPartition	glue:GetPartition			Read
GetColumnStatisticsForTable	glue:GetTable			Read
GetColumnStatisticsTaskRun	glue:GetColumnStatisticsTaskRun			Read
GetColumnStatisticsTaskRuns	glue:GetColumnStatisticsTaskRuns			Read
GetColumnStatisticsTaskSettings	glue:GetColumnStatisticsTaskSettings			Read
GetConnection	glue:GetConnection			Read
GetConnections	glue:GetConnections			Read
GetCrawler	glue:GetCrawler			Read
GetCrawlerMetrics	glue:GetCrawlerMetrics			Read
GetCrawlers	glue:GetCrawlers			Read
GetCustomEntityType	glue:GetCustomEntityType			Read
GetDashboardUrl	glue:GetDashboardUrl			Read
GetDataCatalogEncryptionSettings	glue:GetDataCatalogEncryptionSettings			Read
GetDataQualityModel	glue:GetDataQualityModel			Read
GetDataQualityModelResult	glue:GetDataQualityModelResult			Read
GetDataQualityResult	glue:GetDataQualityResult			Read
GetDataQualityRuleRecommendationRun	glue:GetDataQualityRuleRecommendationRun			Read
GetDataQualityRuleset	glue:GetDataQualityRuleset			Read
GetDataQualityRulesetEvaluationRun	glue:GetDataQualityRulesetEvaluationRun			Read
GetDatabase	glue:GetDatabase			Read
GetDatabases	glue:GetDatabases			Read
GetDataflowGraph	glue:GetDataflowGraph			Read
GetDevEndpoint	glue:GetDevEndpoint			Read
GetDevEndpoints	glue:GetDevEndpoints			Read
GetEntityRecords	glue:GetEntityRecords			Read
GetGlueIdentityCenterConfiguration	glue:GetGlueIdentityCenterConfiguration			Read
GetIntegrationResourceProperty	glue:GetIntegrationResourceProperty			Read
GetIntegrationTableProperties	glue:GetIntegrationTableProperties			Read
GetJob	glue:GetJob			Read
GetJob	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
GetJobBookmark	glue:GetJobBookmark			Read
GetJobRun	glue:GetJobRun			Read
GetJobRuns	glue:GetJobRuns			Read
GetJobs	glue:GetJobs			Read
GetJobs	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
GetMLTaskRun	glue:GetMLTaskRun			Read
GetMLTaskRuns	glue:GetMLTaskRuns			List
GetMLTransform	glue:GetMLTransform			Read
GetMLTransforms	glue:GetMLTransforms			List
GetMapping	glue:GetMapping			Read
GetPartition	glue:GetPartition			Read
GetPartitions	glue:GetPartitions			Read
GetPlan	glue:GetPlan			Read
GetRegistry	glue:GetRegistry			Read
GetSchema	glue:GetSchema			Read
GetSchemaByDefinition	glue:GetSchemaByDefinition			Read
GetSchemaVersion	glue:GetSchemaVersion			Read
GetSchemaVersionsDiff	glue:GetSchemaVersionsDiff			Read
GetSecurityConfiguration	glue:GetSecurityConfiguration			Read
GetSecurityConfigurations	glue:GetSecurityConfigurations			Read
GetSession	glue:GetSession			Read
GetSessionEndpoint	glue:GetSessionEndpoint			Read
GetStatement	glue:GetStatement			Read
GetTable	glue:GetTable			Read
GetTable	athena:GetTable			Read
GetTableOptimizer	glue:GetTableOptimizer			Read
GetTableVersion	glue:GetTableVersion			Read
GetTableVersions	glue:GetTableVersions			Read
GetTables	glue:GetTables			Read
GetTables	athena:GetTables			Read
GetTags	glue:GetTags			Read
GetTrigger	glue:GetTrigger			Read
GetTriggers	glue:GetTriggers			Read
GetUsageProfile	glue:GetUsageProfile			Read
GetUserDefinedFunction	glue:GetUserDefinedFunction			Read
GetUserDefinedFunctions	glue:GetUserDefinedFunctions			Read
GetWorkflow	glue:GetWorkflow			Read
GetWorkflowRun	glue:GetWorkflowRun			Read
GetWorkflowRunProperties	glue:GetWorkflowRunProperties			Read
GetWorkflowRuns	glue:GetWorkflowRuns			Read
ImportCatalogToGlue	glue:ImportCatalogToGlue			Write
ListBlueprints	glue:ListBlueprints			List
ListColumnStatisticsTaskRuns	glue:ListColumnStatisticsTaskRuns			Read
ListConnectionTypes	glue:ListConnectionTypes			Permissions management, Write
ListCrawlers	glue:ListCrawlers			List
ListCrawls	glue:ListCrawls			List
ListCustomEntityTypes	glue:ListCustomEntityTypes			List
ListDataQualityResults	glue:ListDataQualityResults			List
ListDataQualityRuleRecommendationRuns	glue:ListDataQualityRuleRecommendationRuns			List
ListDataQualityRulesetEvaluationRuns	glue:ListDataQualityRulesetEvaluationRuns			List
ListDataQualityRulesets	glue:ListDataQualityRulesets			List
ListDataQualityStatisticAnnotations	glue:GetDataQualityResult			Read
ListDataQualityStatistics	glue:GetDataQualityResult			Read
ListDevEndpoints	glue:ListDevEndpoints			List
ListEntities	glue:ListEntities			Permissions management, Write
ListIntegrationResourceProperties	glue:ListIntegrationResourceProperties			List
ListJobs	glue:ListJobs			List
ListMLTransforms	glue:ListMLTransforms			List
ListRegistries	glue:ListRegistries			List
ListSchemaVersions	glue:ListSchemaVersions			List
ListSchemas	glue:ListSchemas			List
ListSessions	glue:ListSessions			List
ListStatements	glue:ListStatements			List
ListTableOptimizerRuns	glue:ListTableOptimizerRuns			List
ListTriggers	glue:ListTriggers			List
ListUsageProfiles	glue:ListUsageProfiles			List
ListWorkflows	glue:ListWorkflows			List
ModifyIntegration	glue:ModifyIntegration			Write
PutDataCatalogEncryptionSettings	glue:PutDataCatalogEncryptionSettings			Write
PutDataCatalogEncryptionSettings	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
PutDataQualityProfileAnnotation	glue:PutDataQualityProfileAnnotation			Write
PutSchemaVersionMetadata	glue:PutSchemaVersionMetadata			Write
PutWorkflowRunProperties	glue:PutWorkflowRunProperties			Write
QuerySchemaVersionMetadata	glue:QuerySchemaVersionMetadata			List
RegisterConnectionType	glue:RegisterConnectionType			Write
RegisterConnectionType	glue:TagResource			Tagging, Write
RegisterSchemaVersion	glue:RegisterSchemaVersion			Write
RemoveSchemaVersionMetadata	glue:RemoveSchemaVersionMetadata			Write
ResetJobBookmark	glue:ResetJobBookmark			Write
ResumeWorkflowRun	glue:ResumeWorkflowRun			Write
RunStatement	glue:RunStatement			Write
SearchTables	glue:SearchTables			Read
StartBlueprintRun	glue:StartBlueprintRun			Write
StartBlueprintRun	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
StartColumnStatisticsTaskRun	glue:StartColumnStatisticsTaskRun			Write
StartColumnStatisticsTaskRun	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
StartColumnStatisticsTaskRunSchedule	glue:StartColumnStatisticsTaskRunSchedule			Write
StartCrawler	glue:StartCrawler			Write
StartCrawlerSchedule	glue:StartCrawlerSchedule			Write
StartDataQualityRuleRecommendationRun	glue:StartDataQualityRuleRecommendationRun			Write
StartDataQualityRuleRecommendationRun	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
StartDataQualityRulesetEvaluationRun	glue:StartDataQualityRulesetEvaluationRun			Write
StartDataQualityRulesetEvaluationRun	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
StartExportLabelsTaskRun	glue:StartExportLabelsTaskRun			Write
StartImportLabelsTaskRun	glue:StartImportLabelsTaskRun			Write
StartJobRun	glue:GetUsageProfile			Read
StartJobRun	glue:StartJobRun			Write
StartMLEvaluationTaskRun	glue:StartMLEvaluationTaskRun			Write
StartMLLabelingSetGenerationTaskRun	glue:StartMLLabelingSetGenerationTaskRun			Write
StartTrigger	glue:StartTrigger			Write
StartWorkflowRun	glue:StartWorkflowRun			Write
StopColumnStatisticsTaskRun	glue:StopColumnStatisticsTaskRun			Write
StopColumnStatisticsTaskRunSchedule	glue:StopColumnStatisticsTaskRunSchedule			Write
StopCrawler	glue:StopCrawler			Write
StopCrawlerSchedule	glue:StopCrawlerSchedule			Write
StopSession	glue:StopSession			Write
StopTrigger	glue:StopTrigger			Write
StopWorkflowRun	glue:StopWorkflowRun			Write
TagResource	glue:TagResource			Tagging, Write
TestConnection	glue:TestConnection			Permissions management, Write
TestConnection	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
UntagResource	glue:UntagResource			Tagging, Write
UpdateBlueprint	glue:UpdateBlueprint			Write
UpdateCatalog	glue:UpdateCatalog			Write
UpdateCatalog	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
UpdateClassifier	glue:UpdateClassifier			Write
UpdateColumnStatisticsForPartition	glue:UpdatePartition			Write
UpdateColumnStatisticsForTable	glue:UpdateTable			Write
UpdateColumnStatisticsTaskSettings	glue:UpdateColumnStatisticsTaskSettings			Write
UpdateColumnStatisticsTaskSettings	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
UpdateConnection	glue:UpdateConnection			Write
UpdateConnection	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
UpdateCrawler	glue:UpdateCrawler			Write
UpdateCrawler	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
UpdateCrawlerSchedule	glue:UpdateCrawlerSchedule			Write
UpdateDataQualityRuleset	glue:UpdateDataQualityRuleset			Write
UpdateDatabase	glue:UpdateDatabase			Write
UpdateDevEndpoint	glue:UpdateDevEndpoint			Write
UpdateGlueIdentityCenterConfiguration	glue:UpdateGlueIdentityCenterConfiguration			Write
UpdateIntegrationResourceProperty	glue:UpdateIntegrationResourceProperty			Write
UpdateIntegrationResourceProperty	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
UpdateIntegrationTableProperties	glue:UpdateIntegrationTableProperties			Write
UpdateJob	glue:GetUsageProfile			Read
	glue:UpdateJob			Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
UpdateJobFromSourceControl	glue:UpdateJobFromSourceControl			Write
UpdateMLTransform	glue:UpdateMLTransform			Write
UpdateMLTransform	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
UpdatePartition	glue:UpdatePartition			Write
UpdateRegistry	glue:UpdateRegistry			Write
UpdateSchema	glue:UpdateSchema			Write
UpdateSourceControlFromJob	glue:UpdateSourceControlFromJob			Write
UpdateTable	glue:PassConnection			Write
	glue:UpdateTable			Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
UpdateTableOptimizer	glue:PassConnection			Write
	glue:UpdateTableOptimizer			Write
	iam:PassRole	iam:PassedToService	glue.amazonaws.com	Write
UpdateTrigger	glue:UpdateTrigger			Write
UpdateUsageProfile	glue:UpdateUsageProfile			Write
UpdateUserDefinedFunction	glue:UpdateUserDefinedFunction			Write
UpdateWorkflow	glue:UpdateWorkflow			Write

Actions defined by Amazon Glue

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchCreatePartition	Grants permission to create one or more partitions	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
BatchDeleteConnection	Grants permission to delete one or more connections	connection*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
BatchDeleteConnection	Grants permission to delete one or more connections	rootcatalog*	glue:LakeFormationPermissions	Write
BatchDeletePartition	Grants permission to delete one or more partitions	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
BatchDeleteTable	Grants permission to delete one or more tables	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
BatchDeleteTableVersion	Grants permission to delete one or more versions of a table	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
BatchGetBlueprints	Grants permission to retrieve one or more blueprints	blueprint*	aws:ResourceTag/${TagKey}	Read
BatchGetCrawlers	Grants permission to retrieve one or more crawlers	crawler*	aws:ResourceTag/${TagKey}	Read
BatchGetCustomEntityTypes	Grants permission to retrieve one or more Custom Entity Types			Read
BatchGetDevEndpoints	Grants permission to retrieve one or more development endpoints	devendpoint*	aws:ResourceTag/${TagKey}	Read
BatchGetJobs	Grants permission to retrieve one or more jobs	job*	aws:ResourceTag/${TagKey}	Read
BatchGetPartition	Grants permission to retrieve one or more partitions	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
BatchGetStageFiles	Grants permission to batch get stage files for SparkUI			Permissions management, Write
BatchGetTableOptimizer	Grants permission to return the configuration for the specified table optimizers	database*	aws:ResourceTag/${TagKey}	Read
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
BatchGetTriggers	Grants permission to retrieve one or more triggers	trigger*	aws:ResourceTag/${TagKey}	Read
BatchGetWorkflows	Grants permission to retrieve one or more workflows	workflow*	aws:ResourceTag/${TagKey}	Read
BatchStopJobRun	Grants permission to stop one or more job runs for a job	job*	aws:ResourceTag/${TagKey}	Write
BatchUpdatePartition	Grants permission to update one or more partitions	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
CancelDataQualityRuleRecommendationRun	Grants permission to stop a running Data Quality rule recommendation run	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Write
CancelDataQualityRulesetEvaluationRun	Grants permission to stop a running Data Quality ruleset evaluation run	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Write
CancelMLTaskRun	Grants permission to stop a running ML Task Run	mlTransform*	aws:ResourceTag/${TagKey}	Write
CancelStatement	Grants permission to cancel a statement in an interactive session	session*	aws:ResourceTag/${TagKey}	Write
CheckSchemaVersionValidity	Grants permission to retrieve a check the validity of schema version			Read
CreateBlueprint	Grants permission to create a blueprint	blueprint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCatalog	Grants permission to create a catalog	catalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
CreateCatalog	Grants permission to create a catalog	rootcatalog*	aws:RequestTag/${TagKey} aws:TagKeys glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
CreateClassifier	Grants permission to create a classifier			Write
CreateColumnStatisticsTaskSettings	Grants permission to create settings for a column statistics task	database*	aws:ResourceTag/${TagKey}	Write
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
CreateConnection	Grants permission to create a connection	connectionType	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions	Write
CreateConnection	Grants permission to create a connection	rootcatalog*	aws:RequestTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions	Write
CreateCrawler	Grants permission to create a crawler		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCustomEntityType	Grants permission to create a Custom Entity Type		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDataQualityRuleset	Grants permission to create a Data Quality ruleset		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDatabase	Grants permission to create a database	catalog	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
		database*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	aws:RequestTag/${TagKey} aws:TagKeys glue:FederatedAuthorizationSource glue:LakeFormationPermissions
CreateDevEndpoint	Grants permission to create a development endpoint		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateGlueIdentityCenterConfiguration	Grants permission to connect Glue with Identity Center			Write
CreateIntegration	Grants permission to create an integration	catalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		connection*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		database*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		integration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateIntegrationResourceProperty	Grants permission to create integration resource property	catalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		connection*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		database*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		integrationResourceProperty*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateIntegrationTableProperties	Grants permission to create integration table properties	catalog*	aws:ResourceTag/${TagKey}	Write
		connection*	aws:ResourceTag/${TagKey}
		database*	aws:ResourceTag/${TagKey}
CreateJob	Grants permission to create a job	job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:SecurityGroupIds glue:SubnetIds glue:VpcIds	Write
CreateMLTransform	Grants permission to create an ML Transform		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreatePartition	Grants permission to create a partition	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
CreatePartitionIndex	Grants permission to create a specified partition index in an existing table	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
CreateRegistry	Grants permission to create a new schema registry	registry*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSchema	Grants permission to create a new schema container	registry*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSchema	Grants permission to create a new schema container	schema*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateScript	Grants permission to create a script			Write
CreateSecurityConfiguration	Grants permission to create a security configuration			Write
CreateSession	Grants permission to create an interactive session	session*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:SecurityGroupIds glue:SubnetIds glue:VpcIds	Write
CreateTable	Grants permission to create a table	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
CreateTableOptimizer	Grants permission to create a new table optimizer for a specific function. Compaction is the only currently supported optimizer type	database*	aws:ResourceTag/${TagKey}	Write
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
CreateTrigger	Grants permission to create a trigger	trigger*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateUsageProfile	Grants permission to create a usage profile	usageProfile*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateUserDefinedFunction	Grants permission to create a function definition	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
CreateWorkflow	Grants permission to create a workflow	workflow*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteBlueprint	Grants permission to delete a blueprint	blueprint*	aws:ResourceTag/${TagKey}	Write
DeleteCatalog	Grants permission to delete a catalog	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
DeleteCatalog	Grants permission to delete a catalog	rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
DeleteClassifier	Grants permission to delete a classifier			Write
DeleteColumnStatisticsForPartition	Grants permission to delete the partition column statistics of a column	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
DeleteColumnStatisticsForTable	Grants permission to delete the table statistics of columns	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
DeleteColumnStatisticsTaskSettings	Grants permission to delete settings for a column statistics task	database*	aws:ResourceTag/${TagKey}	Write
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
DeleteConnection	Grants permission to delete a connection	connection*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
DeleteConnection	Grants permission to delete a connection	rootcatalog*	glue:LakeFormationPermissions	Write
DeleteConnectionType	Grants permission to delete connection type	connectionType*	aws:ResourceTag/${TagKey}	Write
DeleteCrawler	Grants permission to delete a crawler	crawler*	aws:ResourceTag/${TagKey}	Write
DeleteCustomEntityType	Grants permission to delete a Custom Entity Type			Write
DeleteDataQualityRuleset	Grants permission to delete a Data Quality ruleset	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Write
DeleteDatabase	Grants permission to delete a database	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		userdefinedfunction*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
DeleteDevEndpoint	Grants permission to delete a development endpoint	devendpoint*	aws:ResourceTag/${TagKey}	Write
DeleteGlueIdentityCenterConfiguration	Grants permission to disconnect Glue with Identity Center			Write
DeleteIntegration	Grants permission to delete an integration	integration*	aws:ResourceTag/${TagKey}	Write
DeleteIntegrationResourceProperty	Grants permission to delete the integration resource property	catalog*	aws:ResourceTag/${TagKey}	Write
		connection*	aws:ResourceTag/${TagKey}
		database*	aws:ResourceTag/${TagKey}
		integrationResourceProperty*	aws:ResourceTag/${TagKey}
DeleteIntegrationTableProperties	Grants permission to delete integration table properties	catalog*	aws:ResourceTag/${TagKey}	Write
		connection*	aws:ResourceTag/${TagKey}
		database*	aws:ResourceTag/${TagKey}
DeleteJob	Grants permission to delete a job	job*	aws:ResourceTag/${TagKey}	Write
DeleteMLTransform	Grants permission to delete an ML Transform	mlTransform*	aws:ResourceTag/${TagKey}	Write
DeletePartition	Grants permission to delete a partition	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
DeletePartitionIndex	Grants permission to delete a specified partition index from an existing table	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
DeleteRegistry	Grants permission to delete a schema registry	registry*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete a resource policy	catalog	aws:ResourceTag/${TagKey}	Permissions management, Write
		database	aws:ResourceTag/${TagKey}
		rootcatalog*
		table	aws:ResourceTag/${TagKey}
DeleteSchema	Grants permission to delete a schema container	registry*	aws:ResourceTag/${TagKey}	Write
DeleteSchema	Grants permission to delete a schema container	schema*	aws:ResourceTag/${TagKey}	Write
DeleteSchemaVersions	Grants permission to delete a range of schema versions	registry*	aws:ResourceTag/${TagKey}	Write
DeleteSchemaVersions	Grants permission to delete a range of schema versions	schema*	aws:ResourceTag/${TagKey}	Write
DeleteSecurityConfiguration	Grants permission to delete a security configuration			Write
DeleteSession	Grants permission to delete an interactive session after stopping the session if not already stopped	session*	aws:ResourceTag/${TagKey}	Write
DeleteTable	Grants permission to delete a table	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
DeleteTableOptimizer	Grants permission to delete an optimizer and all associated metadata for a table. The optimization will no longer be performed on the table	database*	aws:ResourceTag/${TagKey}	Write
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
DeleteTableVersion	Grants permission to delete a version of a table	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
DeleteTrigger	Grants permission to delete a trigger	trigger*	aws:ResourceTag/${TagKey}	Write
DeleteUsageProfile	Grants permission to delete a usage profile	usageProfile*	aws:ResourceTag/${TagKey}	Write
DeleteUserDefinedFunction	Grants permission to delete a function definition	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		userdefinedfunction*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
DeleteWorkflow	Grants permission to delete a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
DeregisterDataPreview	Grants permission to terminate Glue Studio Notebook session			Permissions management, Write
DescribeConnectionType	Grants permission to describe connection type in glue	connectionType	aws:ResourceTag/${TagKey}	Permissions management, Write
DescribeEntity	Grants permission to describe entity in glue studio	connection*	aws:ResourceTag/${TagKey}	Permissions management, Write
		connectionType	aws:ResourceTag/${TagKey}
		rootcatalog*
DescribeInboundIntegrations	Grants permission to list the inbound integrations			List
DescribeIntegrations	Grants permission to describe zero-ETL integrations	integration*	aws:ResourceTag/${TagKey}	List
FederateAuthorization	Grants permission to read and write redshift federated resources	catalog	aws:ResourceTag/${TagKey} glue:EnabledForRedshiftAutoDiscovery glue:FederatedAuthorizationSource	Write
FederateAuthorization		rootcatalog*	glue:EnabledForRedshiftAutoDiscovery glue:FederatedAuthorizationSource	Write
GetBlueprint	Grants permission to retrieve a blueprint	blueprint*	aws:ResourceTag/${TagKey}	Read
GetBlueprintRun	Grants permission to retrieve a blueprint run	blueprint*	aws:ResourceTag/${TagKey}	Read
GetBlueprintRuns	Grants permission to retrieve all runs of a blueprint	blueprint*	aws:ResourceTag/${TagKey}	Read
GetCatalog	Grants permission to retrieve a catalog	catalog	aws:ResourceTag/${TagKey} glue:EnabledForRedshiftAutoDiscovery glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Read
GetCatalog	Grants permission to retrieve a catalog	rootcatalog*	glue:EnabledForRedshiftAutoDiscovery glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Read
GetCatalogImportStatus	Grants permission to retrieve the catalog import status	rootcatalog*	glue:LakeFormationPermissions	Read
GetCatalogs	Grants permission to retrieve all catalogs	catalog	aws:ResourceTag/${TagKey} glue:EnabledForRedshiftAutoDiscovery glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Read
GetCatalogs	Grants permission to retrieve all catalogs	rootcatalog*	glue:EnabledForRedshiftAutoDiscovery glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Read
GetClassifier	Grants permission to retrieve a classifier			Read
GetClassifiers	Grants permission to list all classifiers			Read
GetColumnStatisticsForPartition	Grants permission to retrieve partition statistics of columns	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
GetColumnStatisticsForTable	Grants permission to retrieve table statistics of columns	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
GetColumnStatisticsTaskRun	Grants permission to retrieve Column Statistics run information for the table based on run-id			Read
GetColumnStatisticsTaskRuns	Grants permission to retrieve Column Statistics run information for the table based on run-ids			Read
GetColumnStatisticsTaskSettings	Grants permission to retrieve settings for a column statistics task			Read
GetCompletion	Grants permission to get generated response for a completion request in Glue from Amazon Q	completion*		Read
GetConnection	Grants permission to retrieve a connection	connection*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
GetConnection	Grants permission to retrieve a connection	rootcatalog*	glue:LakeFormationPermissions	Read
GetConnections	Grants permission to retrieve a list of connections	connection*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
GetConnections	Grants permission to retrieve a list of connections	rootcatalog*	glue:LakeFormationPermissions	Read
GetCrawler	Grants permission to retrieve a crawler	crawler*	aws:ResourceTag/${TagKey}	Read
GetCrawlerMetrics	Grants permission to retrieve metrics about crawlers			Read
GetCrawlers	Grants permission to retrieve all crawlers			Read
GetCustomEntityType	Grants permission to read a Custom Entity Type			Read
GetDashboardUrl	Grants permission to generate presigned url for accessing spark live UI	session*	aws:ResourceTag/${TagKey}	Read
GetDataCatalogEncryptionSettings	Grants permission to retrieve catalog encryption settings	rootcatalog*		Read
GetDataPreviewStatement	Grants permission to get Data Preview Statement			Permissions management, Write
GetDataQualityModel	Grants permission to retrieve the training status of the prediction model for a statistic	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Read
GetDataQualityModel		job*	aws:ResourceTag/${TagKey}	Read
GetDataQualityModelResult	Grants permission to retrieve the predictions for a statistic from the latest model	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Read
GetDataQualityModelResult		job*	aws:ResourceTag/${TagKey}	Read
GetDataQualityResult	Grants permission to retrieve a Data Quality result	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Read
GetDataQualityRuleRecommendationRun	Grants permission to retrieve a Data Quality rule recommendation run	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Read
GetDataQualityRuleset	Grants permission to retrieve a Data Quality ruleset	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Read
GetDataQualityRulesetEvaluationRun	Grants permission to retrieve a Data Quality rule recommendation run	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Read
GetDatabase	Grants permission to retrieve a database	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
GetDatabases	Grants permission to retrieve all databases	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
GetDataflowGraph	Grants permission to transform a script into a directed acyclic graph (DAG)			Read
GetDevEndpoint	Grants permission to retrieve a development endpoint	devendpoint*	aws:ResourceTag/${TagKey}	Read
GetDevEndpoints	Grants permission to retrieve all development endpoints			Read
GetEntityRecords	Grants permission to preview entity records in glue	catalog*	aws:ResourceTag/${TagKey}	Read
		connection	aws:ResourceTag/${TagKey}
		connectionType	aws:ResourceTag/${TagKey}
GetEnvironment	Grants permission to get environment details for SparkUI			Permissions management, Write
GetExecutors	Grants permission to get executors for SparkUI			Permissions management, Write
GetExecutorsThreads	Grants permission to get executor threads for SparkUI			Permissions management, Write
GetGeneratedCode	Transforms a directed acyclic graph (DAG) into code			Read
GetGlueIdentityCenterConfiguration	Grants permission to retrieve the managed Idc application			Read
GetIntegrationResourceProperty	Grants permission to retrieve the integration resource property	catalog*	aws:ResourceTag/${TagKey}	Read
		connection*	aws:ResourceTag/${TagKey}
		database*	aws:ResourceTag/${TagKey}
		integrationResourceProperty*	aws:ResourceTag/${TagKey}
GetIntegrationTableProperties	Grants permission to retrieve the integration table properties	catalog*	aws:ResourceTag/${TagKey}	Read
		connection*	aws:ResourceTag/${TagKey}
		database*	aws:ResourceTag/${TagKey}
GetJob	Grants permission to retrieve a job	job*	aws:ResourceTag/${TagKey}	Read
GetJobBookmark	Grants permission to retrieve a job bookmark			Read
GetJobRun	Grants permission to retrieve a job run	job*	aws:ResourceTag/${TagKey}	Read
GetJobRuns	Grants permission to retrieve all job runs of a job	job*	aws:ResourceTag/${TagKey}	Read
GetJobUpgradeAnalysis	Grants permission to retrieve an upgrade analysis for a job	job*	aws:ResourceTag/${TagKey}	Read
GetJobs	Grants permission to retrieve all current jobs			Read
GetLogParsingStatus	Grants permission to get log parsing status for SparkUI			Permissions management, Write
GetMLTaskRun	Grants permission to retrieve an ML Task Run	mlTransform*	aws:ResourceTag/${TagKey}	Read
GetMLTaskRuns	Grants permission to retrieve all ML Task Runs	mlTransform*	aws:ResourceTag/${TagKey}	List
GetMLTransform	Grants permission to retrieve an ML Transform	mlTransform*	aws:ResourceTag/${TagKey}	Read
GetMLTransforms	Grants permission to retrieve all ML Transforms	mlTransform*	aws:ResourceTag/${TagKey}	List
GetMapping	Grants permission to create a mapping			Read
GetNotebookInstanceStatus	Grants permission to retrieve Glue Studio Notebooks session status			Permissions management, Write
GetPartition	Grants permission to retrieve a partition	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
GetPartitionIndexes	Grants permission to retrieve partition indexes for a table	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
GetPartitions	Grants permission to retrieve the partitions of a table	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
GetPlan	Grants permission to retrieve a mapping for a script			Read
GetQueries	Grants permission to get queries for SparkUI			Permissions management, Write
GetQuery	Grants permission to get a specific query for SparkUI			Permissions management, Write
GetRecipeAction	Grants permission to get the result of a Data Preparation Recipe statement			Permissions management, Write
GetRegistry	Grants permission to retrieve a schema registry	registry*	aws:ResourceTag/${TagKey}	Read
GetResourcePolicies	Grants permission to retrieve resource policies	rootcatalog*		Read
GetResourcePolicy	Grants permission to retrieve a resource policy	catalog	aws:ResourceTag/${TagKey}	Read
		database	aws:ResourceTag/${TagKey}
		rootcatalog*
		table	aws:ResourceTag/${TagKey}
GetSchema	Grants permission to retrieve a schema container	registry*	aws:ResourceTag/${TagKey}	Read
GetSchema	Grants permission to retrieve a schema container	schema*	aws:ResourceTag/${TagKey}	Read
GetSchemaByDefinition	Grants permission to retrieve a schema version based on schema definition	registry*	aws:ResourceTag/${TagKey}	Read
GetSchemaByDefinition		schema*	aws:ResourceTag/${TagKey}	Read
GetSchemaVersion	Grants permission to retrieve a schema version	registry	aws:ResourceTag/${TagKey}	Read
GetSchemaVersion	Grants permission to retrieve a schema version	schema	aws:ResourceTag/${TagKey}	Read
GetSchemaVersionsDiff	Grants permission to compare two schema versions in schema registry	registry*	aws:ResourceTag/${TagKey}	Read
GetSchemaVersionsDiff		schema*	aws:ResourceTag/${TagKey}	Read
GetSecurityConfiguration	Grants permission to retrieve a security configuration			Read
GetSecurityConfigurations	Grants permission to retrieve one or more security configurations			Read
GetSession	Grants permission to retrieve an interactive session	session*	aws:ResourceTag/${TagKey}	Read
GetSessionEndpoint	Grants permission to retrieve an interactive session endpoint	session*	aws:ResourceTag/${TagKey}	Read
GetStage	Grants permission to get a stage for SparkUI			Permissions management, Write
GetStageAttempt	Grants permission to get a stage attempt for SparkUI			Permissions management, Write
GetStageAttemptTaskList	Grants permission to get the task list for a stage attempt for SparkUI			Permissions management, Write
GetStageAttemptTaskSummary	Grants permission to get the task summary for a stage attempt for SparkUI			Permissions management, Write
GetStageFiles	Grants permission to get stage files for SparkUI			Permissions management, Write
GetStages	Grants permission to get stages for SparkUI			Permissions management, Write
GetStatement	Grants permission to retrieve result and information about a statement in an interactive session	session*	aws:ResourceTag/${TagKey}	Read
GetStorage	Grants permission to get storage details for SparkUI			Permissions management, Write
GetStorageUnit	Grants permission to get storage unit details for SparkUI			Permissions management, Write
GetTable	Grants permission to retrieve a table	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
GetTableOptimizer	Grants permission to return the configuration of all optimizers associated with a specified table	database*	aws:ResourceTag/${TagKey}	Read
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
GetTableVersion	Grants permission to retrieve a version of a table	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
GetTableVersions	Grants permission to retrieve a list of versions of a table	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
GetTables	Grants permission to retrieve the tables in a database	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
GetTags	Grants permission to retrieve all tags associated with a resource	blueprint	aws:ResourceTag/${TagKey}	Read
		catalog	aws:ResourceTag/${TagKey}
		connection	aws:ResourceTag/${TagKey}
		connectionType	aws:ResourceTag/${TagKey}
		crawler	aws:ResourceTag/${TagKey}
		customEntityType	aws:ResourceTag/${TagKey}
		database	aws:ResourceTag/${TagKey}
		devendpoint	aws:ResourceTag/${TagKey}
		job	aws:ResourceTag/${TagKey}
		trigger	aws:ResourceTag/${TagKey}
		usageProfile	aws:ResourceTag/${TagKey}
		workflow	aws:ResourceTag/${TagKey}
GetTrigger	Grants permission to retrieve a trigger	trigger*	aws:ResourceTag/${TagKey}	Read
GetTriggers	Grants permission to retrieve the triggers associated with a job			Read
GetUsageProfile	Grants permission to retrieve a usage profile	usageProfile*	aws:ResourceTag/${TagKey}	Read
GetUserDefinedFunction	Grants permission to retrieve a function definition	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		userdefinedfunction*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
GetUserDefinedFunctions	Grants permission to retrieve multiple function definitions	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		userdefinedfunction*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
GetWorkflow	Grants permission to retrieve a workflow	workflow*	aws:ResourceTag/${TagKey}	Read
GetWorkflowRun	Grants permission to retrieve a workflow run	workflow*	aws:ResourceTag/${TagKey}	Read
GetWorkflowRunProperties	Grants permission to retrieve workflow run properties	workflow*	aws:ResourceTag/${TagKey}	Read
GetWorkflowRuns	Grants permission to retrieve all runs of a workflow	workflow*	aws:ResourceTag/${TagKey}	Read
GlueNotebookAuthorize	Grants permission to access Glue Studio Notebooks			Permissions management, Write
GlueNotebookRefreshCredentials	Grants permission to refresh Glue Studio Notebooks credentials			Permissions management, Write
ImportCatalogToGlue	Grants permission to import an Athena data catalog into Amazon Glue	rootcatalog*	glue:LakeFormationPermissions	Write
ListBlueprints	Grants permission to retrieve all blueprints			List
ListColumnStatisticsTaskRuns	Grants permission to list all Column Statistics run-ids that have been executed for the account			Read
ListConnectionTypes	Grants permission to list connection types in glue			Permissions management, Write
ListCrawlers	Grants permission to retrieve all crawlers			List
ListCrawls	Grants permission to retrieve crawl run history for a crawler	crawler*	aws:ResourceTag/${TagKey}	List
ListCustomEntityTypes	Grants permission to retrieve all Custom Entity Types			List
ListDataQualityResults	Grants permission to retrieve all Data Quality results	dataQualityRuleset*	aws:ResourceTag/${TagKey}	List
ListDataQualityRuleRecommendationRuns	Grants permission to retrieve all Data Quality rule recommendation runs	dataQualityRuleset*	aws:ResourceTag/${TagKey}	List
ListDataQualityRulesetEvaluationRuns	Grants permission to retrieve all Data Quality rule recommendation runs	dataQualityRuleset*	aws:ResourceTag/${TagKey}	List
ListDataQualityRulesets	Grants permission to retrieve a list of Data Quality rulesets	dataQualityRuleset*	aws:ResourceTag/${TagKey}	List
ListDevEndpoints	Grants permission to retrieve all development endpoints			List
ListEntities	Grants permission to list entities in glue studio	connection*	aws:ResourceTag/${TagKey}	Permissions management, Write
		connectionType	aws:ResourceTag/${TagKey}
		rootcatalog*
ListIntegrationResourceProperties	Grants permission to list zero-ETL integration resource properties	catalog*	aws:ResourceTag/${TagKey}	List
		connection*	aws:ResourceTag/${TagKey}
		database*	aws:ResourceTag/${TagKey}
		integrationResourceProperty*	aws:ResourceTag/${TagKey}
ListJobUpgradeAnalyses	Grants permission to list upgrade analyses for a job	job*	aws:ResourceTag/${TagKey}	List
ListJobs	Grants permission to retrieve all current jobs			List
ListMLTransforms	Grants permission to retrieve all ML Transforms	mlTransform*	aws:ResourceTag/${TagKey}	List
ListRegistries	Grants permission to retrieve a list of schema registries			List
ListSchemaVersions	Grants permission to retrieve a list of schema versions	registry*	aws:ResourceTag/${TagKey}	List
ListSchemaVersions	Grants permission to retrieve a list of schema versions	schema*	aws:ResourceTag/${TagKey}	List
ListSchemas	Grants permission to retrieve a list of schema containers	registry	aws:ResourceTag/${TagKey}	List
ListSessions	Grants permission to retrieve a list of interactive session			List
ListStatements	Grants permission to retrieve a list of statements in an interactive session	session*	aws:ResourceTag/${TagKey}	List
ListTableOptimizerRuns	Grants permission to list the history of previous optimizer runs for a specific table	database*	aws:ResourceTag/${TagKey}	List
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
ListTriggers	Grants permission to retrieve all triggers			List
ListUsageProfiles	Grants permission to retrieve a list of usage profiles			List
ListWorkflows	Grants permission to retrieve all workflows			List
ManagedConnector	Grants permission to use Glue managed connectors to query data			Permissions management, Write
ModifyIntegration	Grants permission to modify a zero-ETL integration	integration*	aws:ResourceTag/${TagKey}	Write
NotifyEvent	Grants permission to notify an event to the event-driven workflow	workflow*	aws:ResourceTag/${TagKey}	Write
PutDataCatalogEncryptionSettings	Grants permission to update catalog encryption settings	rootcatalog*		Write
PutDataQualityProfileAnnotation	Grants permission to annotate all datapoints for a profile	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Write
PutDataQualityProfileAnnotation	Grants permission to annotate all datapoints for a profile	job*	aws:ResourceTag/${TagKey}	Write
PutDataQualityStatisticAnnotation	Grants permission to annotate datapoints over time for a specific data quality statistic	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Write
PutDataQualityStatisticAnnotation		job*	aws:ResourceTag/${TagKey}	Write
PutResourcePolicy	Grants permission to update a resource policy	catalog	aws:ResourceTag/${TagKey}	Permissions management, Write
		database	aws:ResourceTag/${TagKey}
		rootcatalog*
		table	aws:ResourceTag/${TagKey}
PutSchemaVersionMetadata	Grants permission to add metadata to schema version	registry	aws:ResourceTag/${TagKey}	Write
PutSchemaVersionMetadata	Grants permission to add metadata to schema version	schema	aws:ResourceTag/${TagKey}	Write
PutWorkflowRunProperties	Grants permission to update workflow run properties	workflow*	aws:ResourceTag/${TagKey}	Write
QuerySchemaVersionMetadata	Grants permission to fetch metadata for a schema version	registry	aws:ResourceTag/${TagKey}	List
QuerySchemaVersionMetadata	Grants permission to fetch metadata for a schema version	schema	aws:ResourceTag/${TagKey}	List
RefreshOAuth2Tokens	Grants permission to refresh the oauth2 tokens for connection during job execution	connection*	aws:ResourceTag/${TagKey}	Permissions management, Write
		connectionType	aws:ResourceTag/${TagKey}
		rootcatalog*
RegisterConnectionType	Grants permission to register connection type	connectionType*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
RegisterSchemaVersion	Grants permission to create a new schema version	registry*	aws:ResourceTag/${TagKey}	Write
RegisterSchemaVersion	Grants permission to create a new schema version	schema*	aws:ResourceTag/${TagKey}	Write
RemoveSchemaVersionMetadata	Grants permission to remove metadata from schema version	registry	aws:ResourceTag/${TagKey}	Write
RemoveSchemaVersionMetadata	Grants permission to remove metadata from schema version	schema	aws:ResourceTag/${TagKey}	Write
RenameTable	Grants permission to rename a table	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
RequestLogParsing	Grants permission to request log parsing for SparkUI			Permissions management, Write
ResetJobBookmark	Grants permission to reset a job bookmark			Write
ResumeWorkflowRun	Grants permission to resume a workflow run	workflow*	aws:ResourceTag/${TagKey}	Write
RunDataPreviewStatement	Grants permission to run Data Preview Statement			Permissions management, Write
RunStatement	Grants permission to run a code or statement in an interactive session	session*	aws:ResourceTag/${TagKey}	Write
SearchTables	Grants permission to retrieve the tables in the catalog	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Read
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
SendFeedback	Grants permission to provide feedback about a glue completion experience in Amazon Q			Write
SendRecipeAction	Grants permission to execute a Data Preparation Recipe statement in data preview			Permissions management, Write
StartBlueprintRun	Grants permission to start running a blueprint	blueprint*	aws:ResourceTag/${TagKey}	Write
StartColumnStatisticsTaskRun	Grants permission to start a run for generating Column Statistics for the table	database*	aws:ResourceTag/${TagKey}	Write
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
StartColumnStatisticsTaskRunSchedule	Grants permission to start a column statistics task run schedule	database*	aws:ResourceTag/${TagKey}	Write
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
StartCompletion	Grants permission to create a completion request in Glue for Amazon Q experience			Write
StartCrawler	Grants permission to start a crawler	crawler*	aws:ResourceTag/${TagKey}	Write
StartCrawlerSchedule	Grants permission to change the schedule state of a crawler to SCHEDULED			Write
StartDataQualityRuleRecommendationRun	Grants permission to start a Data Quality rule recommendation run	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Write
StartDataQualityRulesetEvaluationRun	Grants permission to start a Data Quality rule recommendation run	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Write
StartExportLabelsTaskRun	Grants permission to start an Export Labels ML Task Run	mlTransform*	aws:ResourceTag/${TagKey}	Write
StartImportLabelsTaskRun	Grants permission to start an Import Labels ML Task Run	mlTransform*	aws:ResourceTag/${TagKey}	Write
StartJobRun	Grants permission to start running a job	job*	aws:ResourceTag/${TagKey}	Write
StartJobUpgradeAnalysis	Grants permission to start running upgrade analysis for a job	job*	aws:ResourceTag/${TagKey}	Write
StartMLEvaluationTaskRun	Grants permission to start an Evaluation ML Task Run	mlTransform*	aws:ResourceTag/${TagKey}	Write
StartMLLabelingSetGenerationTaskRun	Grants permission to start a Labeling Set Generation ML Task Run	mlTransform*	aws:ResourceTag/${TagKey}	Write
StartNotebook	Grants permission to start Glue Studio Notebooks			Permissions management, Write
StartTrigger	Grants permission to start a trigger	trigger*	aws:ResourceTag/${TagKey}	Write
StartWorkflowRun	Grants permission to start running a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
StopColumnStatisticsTaskRun	Grants permission to stop execution for Column Statistics run	database*	aws:ResourceTag/${TagKey}	Write
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
StopColumnStatisticsTaskRunSchedule	Grants permission to stop a column statistics task run schedule	database*	aws:ResourceTag/${TagKey}	Write
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
StopCrawler	Grants permission to stop a running crawler	crawler*	aws:ResourceTag/${TagKey}	Write
StopCrawlerSchedule	Grants permission to set the schedule state of a crawler to NOT_SCHEDULED			Write
StopJobUpgradeAnalysis	Grants permission to stop an on-going upgrade analysis for a job	job*	aws:ResourceTag/${TagKey}	Write
StopSession	Grants permission to stop an interactive session	session*	aws:ResourceTag/${TagKey}	Write
StopTrigger	Grants permission to stop a trigger	trigger*	aws:ResourceTag/${TagKey}	Write
StopWorkflowRun	Grants permission to stop a workflow run	workflow*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to a resource	blueprint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions	Tagging, Write
		catalog	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		connection	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		connectionType	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		crawler	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		customEntityType	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		dataQualityRuleset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		database	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		devendpoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		integration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		integrationResourceProperty	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		mlTransform	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		registry	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		schema	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		session	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		trigger	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		usageProfile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		workflow	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
TerminateNotebook	Grants permission to terminate Glue Studio Notebooks			Permissions management, Write
TestConnection	Grants permission to test connection in Glue Studio	connection	aws:ResourceTag/${TagKey}	Permissions management, Write
TestConnection	Grants permission to test connection in Glue Studio	connectionType	aws:ResourceTag/${TagKey}	Permissions management, Write
UntagResource	Grants permission to remove tags associated with a resource	blueprint	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions	Tagging, Write
		catalog	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		connection	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		connectionType	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		crawler	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		customEntityType	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		dataQualityRuleset	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		database	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		devendpoint	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		integration	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		integrationResourceProperty	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		job	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		mlTransform	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		registry	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		schema	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		session	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		trigger	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		usageProfile	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
		workflow	aws:ResourceTag/${TagKey} aws:TagKeys glue:LakeFormationPermissions
UpdateBlueprint	Grants permission to update a blueprint	blueprint*	aws:ResourceTag/${TagKey}	Write
UpdateCatalog	Grants permission to update a catalog	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
UpdateCatalog	Grants permission to update a catalog	rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
UpdateClassifier	Grants permission to update a classifier			Write
UpdateColumnStatisticsForPartition	Grants permission to update partition statistics of columns	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
UpdateColumnStatisticsForTable	Grants permission to update table statistics of columns	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
UpdateColumnStatisticsTaskSettings	Grants permission to update settings for a column statistics task	database*	aws:ResourceTag/${TagKey}	Write
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
UpdateConnection	Grants permission to update a connection	connection*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		connectionType	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
UpdateCrawler	Grants permission to update a crawler	crawler*	aws:ResourceTag/${TagKey}	Write
UpdateCrawlerSchedule	Grants permission to update the schedule of a crawler			Write
UpdateDataQualityRuleset	Grants permission to update a Data Quality ruleset	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Write
UpdateDatabase	Grants permission to update a database	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
UpdateDevEndpoint	Grants permission to update a development endpoint	devendpoint*	aws:ResourceTag/${TagKey}	Write
UpdateGlueIdentityCenterConfiguration	Grants permission to update the managed Idc application			Write
UpdateIntegrationResourceProperty	Grants permission to update the integration resource property	catalog*	aws:ResourceTag/${TagKey}	Write
		connection*	aws:ResourceTag/${TagKey}
		database*	aws:ResourceTag/${TagKey}
		integrationResourceProperty*	aws:ResourceTag/${TagKey}
UpdateIntegrationTableProperties	Grants permission to update the integration table properties	catalog*	aws:ResourceTag/${TagKey}	Write
		connection*	aws:ResourceTag/${TagKey}
		database*	aws:ResourceTag/${TagKey}
UpdateJob	Grants permission to update a job	job*	aws:ResourceTag/${TagKey} glue:SecurityGroupIds glue:SubnetIds glue:VpcIds	Write
UpdateJobFromSourceControl	Grants permission to update a job from source control provider	job*	aws:ResourceTag/${TagKey}	Write
UpdateMLTransform	Grants permission to update an ML Transform	mlTransform*	aws:ResourceTag/${TagKey}	Write
UpdatePartition	Grants permission to update a partition	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
UpdateRegistry	Grants permission to update a schema registry	registry*	aws:ResourceTag/${TagKey}	Write
UpdateSchema	Grants permission to update a schema container	registry*	aws:ResourceTag/${TagKey}	Write
UpdateSchema	Grants permission to update a schema container	schema*	aws:ResourceTag/${TagKey}	Write
UpdateSourceControlFromJob	Grants permission to update source control provider from a job	job*	aws:ResourceTag/${TagKey}	Write
UpdateTable	Grants permission to update a table	catalog	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		rootcatalog*	glue:FederatedAuthorizationSource glue:LakeFormationPermissions
		table*	aws:ResourceTag/${TagKey} glue:FederatedAuthorizationSource glue:LakeFormationPermissions
UpdateTableOptimizer	Grants permission to update the configuration for an existing table optimizer	database*	aws:ResourceTag/${TagKey}	Write
		rootcatalog*
		table*	aws:ResourceTag/${TagKey}
UpdateTrigger	Grants permission to update a trigger	trigger*	aws:ResourceTag/${TagKey}	Write
UpdateUsageProfile	Grants permission to update a usage profile	usageProfile*	aws:ResourceTag/${TagKey}	Write
UpdateUserDefinedFunction	Grants permission to update a function definition	catalog	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions	Write
		database*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
		rootcatalog*	glue:LakeFormationPermissions
		userdefinedfunction*	aws:ResourceTag/${TagKey} glue:LakeFormationPermissions
UpdateWorkflow	Grants permission to update a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
UpgradeJob	Grants permission to upgrade a job to the latest version	job*	aws:ResourceTag/${TagKey}	Write
UseGlueStudio	Grants permission to use Glue Studio and access its internal APIs			Permissions management, Write

Permission-only actions for Amazon Glue

The following actions are defined by Amazon Glue but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AuthorizeInboundIntegration	Grants permission to Glue to continuously validate that the target Arn can receive data replicated from the source ARN	integration*	aws:ResourceTag/${TagKey}	Write
CreateInboundIntegration	Grants permission to the source principal to create an inbound integration for data to be replicated from the source into the target			Write
PassConnection	Grants permission to pass glue connection name in input for APIs that require them	connection*	aws:ResourceTag/${TagKey}	Write
PublishDataQuality	Grants permission to publish Data Quality results	dataQualityRuleset*	aws:ResourceTag/${TagKey}	Write
UseMLTransforms	Grants permission to use an ML Transform from within a Glue ETL Script	mlTransform*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Glue

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
blueprint	arn:${Partition}:glue:${Region}:${Account}:blueprint/${BlueprintName}	aws:ResourceTag/${TagKey}
catalog	arn:${Partition}:glue:${Region}:${Account}:catalog/${CatalogName}	aws:ResourceTag/${TagKey}
completion	arn:${Partition}:glue:${Region}:${Account}:completion/${CompletionId}
connection	arn:${Partition}:glue:${Region}:${Account}:connection/${ConnectionName}	aws:ResourceTag/${TagKey}
connectionType	arn:${Partition}:glue:${Region}:${Account}:connectionType:${ConnectionTypeName}	aws:ResourceTag/${TagKey}
crawler	arn:${Partition}:glue:${Region}:${Account}:crawler/${CrawlerName}	aws:ResourceTag/${TagKey}
customEntityType	arn:${Partition}:glue:${Region}:${Account}:customEntityType/${CustomEntityTypeId}	aws:ResourceTag/${TagKey}
dataQualityRuleset	arn:${Partition}:glue:${Region}:${Account}:dataQualityRuleset/${RulesetName}	aws:ResourceTag/${TagKey}
database	arn:${Partition}:glue:${Region}:${Account}:database/${DatabaseName}	aws:ResourceTag/${TagKey}
devendpoint	arn:${Partition}:glue:${Region}:${Account}:devEndpoint/${DevEndpointName}	aws:ResourceTag/${TagKey}
integration	arn:${Partition}:glue:${Region}:${Account}:integration:${IntegrationId}	aws:ResourceTag/${TagKey}
integrationResourceProperty	arn:${Partition}:glue:${Region}:${Account}:integrationresourceproperty/${ResourceType}/${ResourceName}	aws:ResourceTag/${TagKey}
job	arn:${Partition}:glue:${Region}:${Account}:job/${JobName}	aws:ResourceTag/${TagKey}
mlTransform	arn:${Partition}:glue:${Region}:${Account}:mlTransform/${TransformId}	aws:ResourceTag/${TagKey}
registry	arn:${Partition}:glue:${Region}:${Account}:registry/${RegistryName}	aws:ResourceTag/${TagKey}
rootcatalog	arn:${Partition}:glue:${Region}:${Account}:catalog
schema	arn:${Partition}:glue:${Region}:${Account}:schema/${SchemaName}	aws:ResourceTag/${TagKey}
session	arn:${Partition}:glue:${Region}:${Account}:session/${SessionId}	aws:ResourceTag/${TagKey}
table	arn:${Partition}:glue:${Region}:${Account}:table/${DatabaseName}/${TableName}	aws:ResourceTag/${TagKey}
tableversion	arn:${Partition}:glue:${Region}:${Account}:tableVersion/${DatabaseName}/${TableName}/${TableVersionName}	aws:ResourceTag/${TagKey}
trigger	arn:${Partition}:glue:${Region}:${Account}:trigger/${TriggerName}	aws:ResourceTag/${TagKey}
usageProfile	arn:${Partition}:glue:${Region}:${Account}:usageProfile/${UsageProfileId}	aws:ResourceTag/${TagKey}
userdefinedfunction	arn:${Partition}:glue:${Region}:${Account}:userDefinedFunction/${DatabaseName}/${UserDefinedFunctionName}	aws:ResourceTag/${TagKey}
workflow	arn:${Partition}:glue:${Region}:${Account}:workflow/${WorkflowName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Glue

Amazon Glue defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
glue:CredentialIssuingService	Filters access by the service from which the credentials of the request is issued	String
glue:EnabledForRedshiftAutoDiscovery	Filters access by the presence of the key configured for role's identity-based policy	Bool
glue:FederatedAuthorizationSource	Filters access by whether the resource belongs to federated authorization	String
glue:LakeFormationPermissions	Filters access by whether Lake Formation permission checks will be performed for a given caller and the Glue resource	String
glue:RoleAssumedBy	Filters access by the service from which the credentials of the request is obtained by assuming the customer role	String
glue:SecurityGroupIds	Filters access by the ID of security groups configured for the Glue job	ArrayOfString
glue:SubnetIds	Filters access by the ID of subnets configured for the Glue job	ArrayOfString
glue:VpcIds	Filters access by the ID of the VPC configured for the Glue job	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Free Tier (freetier)

Amazon Glue DataBrew (databrew)