Cross-account Access to AWS Glue

To connect your e6data Workspace to an AWS Glue Metastore and S3 data source in a different cloud account, please follow the four (4) steps below:

This guide assumes:

  • the e6data Workspace (clusters/compute) is installed in a cloud account named Account A.

  • the AWS Glue metastore & S3 data stores are located in a different cloud account named Account B.

  • Both Account A & Account B are in the same AWS region.

Step 1: Create policies to access Glue & S3 data sources in Account B

  1. Sign in to the Account B AWS Console.

  2. Search for IAM.

  3. Click Policies

  4. Choose Create policy.

  5. In the Policy editor section, choose the JSON option.

  6. Edit the policy provided below:

    1. Replace <DATASTORE_BUCKET_ARN> with the ARN of the S3 bucket/s containing the data

    2. Replace <GLUE_REGION> with the region that the Glue metastore is located in.

    3. Replace <ACCOUNT_B_ID> with the Account ID of the account containing the S3 bucket & Glue metastore.

S3 & Glue Access Policy

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Action":[
            "s3:GetObject",
            "s3:ListBucket",
            "s3:GetObjectVersion",
            "s3:GetObjectTagging"
         ],
         "Resource":[
            "<DATASTORE_BUCKET_ARN>/*",
            "<DATASTORE_BUCKET_ARN>"
         ],
         "Effect":"Allow"
      },
      {
            "Effect": "Allow",
            "Action": [
                "glue:GetDatabase*",
                "glue:GetTable*",
                "glue:GetPartitions"
            ],
            "Resource": [
                "arn:aws:glue:<GLUE_REGION>:<ACCOUNT_B_ID>:catalog",
                "arn:aws:glue:<GLUE_REGION>:<ACCOUNT_B_ID>:database/*",
                "arn:aws:glue:<GLUE_REGION>:<ACCOUNT_B_ID>:table/*"
            ]
        }
   ]
}

  1. Copy & paste the edited policy to the JSON editor.

  2. Choose Next.

  3. On the Review and create page, type a Policy Name and a Description (optional) for the policy.

  4. Review the Permissions defined in this policy to see the permissions that are granted by your policy.

  5. Choose Create policy

    • Make note of the policy name as it will be required further along the process.

  6. Return to IAM Management

  7. In the navigation pane, choose Roles.

  8. Click Create role.

  9. Under Trusted entity type, choose Custom trust policy.

  10. Replace <ENGINE_ROLE_ARN> in the policy provided below. The role name can be found in IAM management dashboard in Account A, and will follow this format: e6data-workspace-<WORKSPACE_NAME>-engine-role

Custom Trust Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<ENGINE_ROLE_ARN>"
            },
            "Action": "sts:AssumeRole",
            "Condition": {}
        }
    ]
}

  1. Copy & paste it into the Custom trust policy editor.

  2. Click Next

  3. Search for the name of the policy created in Steps 4 - 11 and attach this policy to the role.

  4. Click Next: Add tags.

  5. Optional: You can add tags to the role. Or leave these fields blank, and click Next: Review.

  6. Enter a Role name that follows your organization's naming convention.

  7. Click Create role.

  8. Copy the ARN of the newly created role.

    • Make note of the ARN as it will be required further along the process.

Step 2: Add access policy to AWS Glue in Account B

  1. In the AWS Console, navigate to AWS Glue > Data Catalog > Catalog settings.

  2. Edit the policy below:

    1. Replace <ENGINE_ROLE_ARN> with the ARN of the Role created for the e6data engine in Account A. The ARN can be found in IAM management dashboard in Account A, the role name will follow this format: e6data-workspace-<WORKSPACE_NAME>-engine-role.

    2. Replace <GLUE_REGION> with the region that the Glue metastore is located in.

    3. Replace <ACCOUNT_B_ID> with the Account ID of the account containing the S3 bucket & Glue metastore.

  3. Copy & paste the edited policy to the Catalog settings in Glue.

Glue Access Policy

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Principal":{
            "AWS":
               "<ENGINE_ROLE_ARN>"
         },
         "Action":[
            "glue:GetDatabase*",
            "glue:GetTable*",
            "glue:GetPartitions"
         ],
         "Resource":[
            "arn:aws:glue:<GLUE_REGION>:<ACCOUNT_B_ID>:catalog",
            "arn:aws:glue:<GLUE_REGION>:<ACCOUNT_B_ID>:database/*",
            "arn:aws:glue:<GLUE_REGION>:<ACCOUNT_B_ID>:table/*"
         ]
      }
   ]
}

Step 3: Configure Glue & S3 Access in Account A

  1. Sign in to the Account A AWS Console.

  2. Search for IAM

  3. Choose Create policy.

  4. In the Policy editor section, choose the JSON option.

  5. Replace arn:aws:iam::<ACCOUNT_B_ID>:role/<ROLENAME> with the ARN of the policy created in Step 1: Create policies to access Glue & S3 data sources in Account B, in the policy provided below.

  6. Replace <ACCOUNT_B_ID> with the Account B ID.

  7. Copy and paste the edited policy into the JSON editor.

  8. Choose Next.

  9. On the Review and create page, type a Policy Name and a Description (optional) for the policy.

    • Make note of the policy name as it will be required further along the process.

  10. Review the Permissions defined in this policy to see the permissions that are granted by your policy.

  11. Return to IAM Management

  12. In the navigation pane, choose Roles.

  13. Search for the e6data Engine Role (e6data-workspace-<WORKSPACE_NAME>-engine-role).

    • This role would have been created during the e6data Workspace deployment.

  14. Click Add permission > Attach policies

  15. Search for the policy created in Steps 3 - 9

  16. Click Add permissions.

Cross-account STS Policy for S3 & Glue

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::<ACCOUNT_B_ID>:role/<ROLENAME>"
        },
        {
            "Effect": "Allow",
            "Action": [
                "glue:GetDatabase*",
                "glue:GetTable*",
                "glue:GetPartitions"
            ],
            "Resource": [
                "arn:aws:glue:<GLUE_REGION>:<ACCOUNT_B_ID>:catalog",
                "arn:aws:glue:<GLUE_REGION>:<ACCOUNT_B_ID>:database/*",
                "arn:aws:glue:<GLUE_REGION>:<ACCOUNT_B_ID>:table/*"
            ]
        }
    ]
}

Step 4: Add cross-account catalog in e6data Console

  1. Login to the e6data Console.

  2. Navigate to the e6data Workspace that should be connected to the cross-account catalog.

  3. Go to Catalogs

  4. Refer to the instructions provided to Connect to a Glue Metastore

The cross-account catalog will now be available to be attached to all current & future clusters in the e6data Workspace.

PreviousCross-account Catalog AccessNextManage Catalogs

Last updated