Document required AWS Permissions for `AWSKafkaAvroSerDe`
er1c opened this issue · 3 comments
I don't really want to play a game of whack a mole, can you list all of the required AWS Permissions for AWSKafkaAvroSerDe
Dec 01 10:50:02 ecs-fargate svc-financial-line-item Caused by: software.amazon.awssdk.services.glue.model.AccessDeniedException: User: arn:aws:sts::1234:assumed-role/stuff is not authorized to perform: glue:GetSchemaVersion because no identity-based policy allows the glue:GetSchemaVersion action (Service: Glue, Status Code: 400, Request ID)
Are there others?
+1
Caused by: software.amazon.awssdk.services.glue.model.AccessDeniedException: User: arn:aws:sts::1234:assumed-role/even-service/1234 is not authorized to perform: glue:GetSchemaByDefinition on resource: arn:aws:glue:us-east-1:12233:registry/kafka-connect-dev-keys because no identity-based policy allows the glue:GetSchemaByDefinition action (Service: Glue, Status Code: 400, Request ID: foo)
We have a AWSGlueSchemaRegistryFullAccess managed policy that contains all the necessary permissions. If you find it over-permissive, you can create a customer-managed policy from it and remove unnecessary permissions.