OvertureMaps/data

Add policy for cross-account access to AWS Glue data catalog in documentation?

Closed this issue · 5 comments

gregorhd commented

Could the Overture documentation include the policy one has to create to grant permission for cross-account access to AWS Glue data catalogs (specifically the Overture one), as described under step 1a in the AWS documentation here, instead of just linking to that page?

Otherwise, the great webinar here cannot be followed for new AWS users.

Could you post the policy here as well?

Thanks!

mojodna commented

The cross-account Glue catalog policy (AWS Glue → Catalog settings → Permissions) looks like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "glue:GetTable*",
        "glue:GetDatabase*",
        "glue:GetPartition*"
      ],
      "Resource": [
        "arn:aws:glue:<region>:<account id>:catalog",
        "arn:aws:glue:<region>:<account id>:database/release",
        "arn:aws:glue:<region>:<account id>:table/*"
      ]
    }
  ]
}

release is the name of the database containing Overture tables.

@danabauer mind adding this to the docs?

  • ❤️1
mojodna commented

I just realized that OP was asking about the permissions that need to be added to a role in order to access the shared catalog. The policy is actually the same, supporting access in the opposite direction, just without the Principal, since that's implied by the Role it's ultimately attached to:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "glue:GetTable*",
        "glue:GetDatabase*",
        "glue:GetPartition*"
      ],
      "Resource": [
        "arn:aws:glue:us-west-2:913550007193:catalog",
        "arn:aws:glue:us-west-2:913550007193:database/release",
        "arn:aws:glue:us-west-2:913550007193:table/*"
      ]
    }
  ]
}
  • ❤️1
gregorhd commented

Thanks a lot for adding this! Works like a charm. Just one more thing: Could you still fix the broken link to the webinar_queries.md which you link to in the description of the webinar video and the accompanying blog post? Thanks!

jenningsanderson commented

Thanks for catching that @gregorhd — At this point, I think those queries might be outdated with improvements to the schema since then. I recommend referring to docs.overturemaps.org/ for the latest queries — if you have any specific types of examples you'd like to see, please let me know and we can try to put together some more examples.

  • 👍1