In this chalk talk, we describe how resource-level authorization and resource-based authorization work in the AWS Glue Data Catalog, and how these features are integrated with other AWS data analytics services such as Amazon Athena. In addition, we cover a few cross-account access patterns, and how cross-account access in AWS Glue Data Catalog can be used to support some of these use cases.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Access Control in AWS Glue
Data Catalog
Austin Lee
Software Engineer
AWS Glue
A N T 3 7 6

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Overview
• Fine-grained access control on Data Catalog resources (in other words,
metadata), not data
• You can use both identity-based policies as well as resource-based
policies
• You can enable cross-account access using AWS Glue resource policies
(resource-based)
• No support for tag-based authorization yet

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Fine-grained access control at the resource level
• Database
• Table
• Connection
• Function

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Glue Data Catalog resource ARN
• arn:aws:glue:<region>:<account-id>:<resource-type>/<resource-path>
• Allowed resource type strings
• catalog
• database
• table
• connection
• userDefinedFunction
• Examples
• arn:aws:glue:us-east-1:12345:catalog
• arn:aws:glue:us-east-1:12345:database/aws
• arn:aws:glue:us-east-1:12345:table/aws/demo
• arn:aws:glue:us-east-1:12345:userDefinedFunction/aws/udf1
• arn:aws:glue:us-east-1:12345:connection/conn1

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Enforcement mechanisms (policies)
• Identity-based policies (AWS Identity and Access Management [IAM]
policies)
• Managed by IAM
• Attached to IAM principals, for example, IAM users, IAM roles
• Resource-based policies
• Managed by AWS Glue
• Attached to your catalog
• One policy per account/catalog, similar to Amazon Simple Storage Service (Amazon S3)
bucket policies
• Required to allow cross-account access
• You can use either one to grant access to users in the same account

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cross-account access
• Scenario – a user (“Bob”) in Account B, 12345, wants to access the
catalog in Account A, 67890; the table he is interested in is ”demo” in
database “aws”
• Bob’s IAM user ARN in Account B: arn:aws:iam::12345:user/bob
• Let’s say the catalog in Account A is in us-east-1
• The catalog ARN in Account A: arn:aws:glue:us-east-1:67890:catalog
• The database ARN in Account A: arn:aws:glue:us-east-1:67890:database/aws
• The table ARN in Account A: arn:aws:glue:us-east-1:67890:table/aws/demo

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cross-account access
• Bob needs both an IAM policy and a resource policy to get access to the
table
• IAM policy (attached to Bob’s IAM user “user/bob”)

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cross-account access
• Resource policy
• The policy editor on AWS Glue console
• PutResourcePolicy API
"Principal": {"AWS": [
"arn:aws:iam::12345:user/bob"
]}

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cross-account access in AWS Glue ETL

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cross-account access on Amazon EMR

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cross-account access on Amazon EMR
/etc/hive/conf.dist/hive-site.xml

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Glue Data Catalog Resource Policy Editor

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Hierarchical permission model
• No direct access to a child resource without explicit allow on ALL
parents
• For the GetTable action on a table resource to succeed, you need permissions on its parent
database and the catalog
• Access to a child can be blocked via an explicit deny on any of the
parents

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Organizing permissions
• By action

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Organizing permissions
• By resource
catalog
database
database
table
table

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Gotchas
• DeleteDatabase
• Database “default” in Amazon Athena
• Filtering on GetDatabases and GetTables
• Wildcards
• No fine-grained access control for partitions and table versions

19. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.