Connect to AWS Glue native using an assumed role

How-to guideApplies to: Unified engine deployments

Before you start

Use an existing catalog with at least one readable Iceberg table. The engine and workers must reach the catalog and its table storage. Have the remote identity and permissions ready before creating the Unified registration. Replace the namespace and table with one you know has data. The identity comes from the engine runtime, not your browser or laptop. Grant catalog metadata access and access to the actual table-file prefixes, including any required KMS keys. The source identity needs permission to assume the target role, and that role must trust the source. Native Glue uses a region and optional catalog account ID, rather than a REST URI. Use the S3 endpoint for the table data region.

Values to collect

AWS region, namespace, table, and service-specific catalog identifiers.
Target role ARN and a working source identity.

Run the SQL

Replace every <placeholder> before running. Use unused names for the resources below. Run the statements in order in Workbench.

CREATE CREDENTIAL recipe_glue_native_assume_role_source USING aws
OPTIONS (
  'authentication' = 'default_chain',
  'region' = '<aws-region>'
);

CREATE CREDENTIAL recipe_glue_native_assume_role_auth USING aws
OPTIONS (
  'authentication' = 'assume_role',
  'region' = '<aws-region>',
  'source' = 'recipe_glue_native_assume_role_source',
  'role_arn' = '<role-arn>'
);

CREATE CATALOG recipe_glue_native_assume_role USING glue
OPTIONS (
  'region' = '<aws-region>',
  's3.region' = '<aws-region>',
  's3.endpoint' = '<s3-endpoint>',
  's3.allow-http' = 'false'
)
CREDENTIALS ('auth' = 'recipe_glue_native_assume_role_auth', 'storage' = 'recipe_glue_native_assume_role_auth');

SELECT *
FROM recipe_glue_native_assume_role.`<namespace>`.`<table>`
LIMIT 5;

Check the result

The SELECT should return up to five rows from the chosen table. Use a nonempty table for this check. This verifies both metadata and table-file access; creating the registration alone does not verify either.

Clean up

This removes only the Unified registrations. It leaves the remote catalog and its tables in place.

DROP CATALOG recipe_glue_native_assume_role;
DROP CREDENTIAL recipe_glue_native_assume_role_auth;
DROP CREDENTIAL recipe_glue_native_assume_role_source;

Transformation Engine

Learn Laminar

Workloads

SQL reference

HTTP API

Recipes

Operations

Connect to AWS Glue native using an assumed role

Before you start

Values to collect

Run the SQL

Check the result

Clean up

​Before you start

​Values to collect

​Run the SQL

​Check the result

​Clean up

Before you start

Values to collect

Run the SQL

Check the result

Clean up