RedShift Serverless / Spectrum / Glue access issue

0

I'm running the following in RedShift query editor

create external schema customer_schema
from data catalog database 'customer' region 'us-west-2'
iam_role 'arn:aws:iam::<account-id>:role/RedshiftSpectrumRole'
create external database if not exists;

And getting the following error:

ERROR: Unknown std exception when calling external catalog API: ----------------------------------------------- error: Not authorized to get credentials of role arn:aws:iam::<account-id>:role/RedshiftSpectrumRole code: 30000 context: query: 0 location: xen_aws_credentials_mgr.cpp:402 process: padbm aster [pid=15652] ----------------------------------------------- [ErrorId: 1-6222317d-1fb7af7e7869388e5a5866f3]

The role has access to S3 and Glue, and it has been attached to the RedShift Serverless permissions.

I also submitted a ticket to AWS over 4 days ago and have not heard anything back. Can someone help out? Is there something I missed? Or is this an internal AWS error?

Below is the trust relationship for the role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "redshift.amazonaws.com",
                    "redshift-serverless.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
posta 2 anni fa1669 visualizzazioni
3 Risposte
1
Risposta accettata

I was trying to execute this query signed in as the Root user for this AWS account. It turns out that RedShift Serverless does not support this currently.

The solution is to create an IAM user, login and run these queries with that user.

con risposta 2 anni fa
AWS
ESPERTO
verificato 2 anni fa
1

Hi, I have been using Spectrum with Serverless and never encountered this issue. For this reason I guess it might be something linked to your environment.

Based on the description in your question I think you followed the documentation on the definition of the role, and by the description it seems to me it should be fine.

is the Glue catalogue in the same us-west-2 region ? If not have you looked at this knowledge base to allow cross account access?

If the catalogue is in the same region as the serverless cluster could you please include more information on the policies for the role, please? (as you did for the trust relationship).

Also please not, that Redshift Serverless is still in preview, you could submit your question directly to the serverless team, by sending an email to the address you find in this documentation page. In the email you could include the AWS Account Id, the cluster name and the region.

hope this helps.

AWS
ESPERTO
con risposta 2 anni fa
0

I got the same error message. Have you ever resolved this issue? I got this error after I created an external schema referring to lakeformation catalog and wanted to have permission control integration with the SSO identity center. So I created the external schema without specifying an IAM role, I guess this could be the reason of the issue. But I did this according to the AWS document https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-idp-connect.html, so I'm not sure if it's something wrong at my side or AWS internal issue?

eric
con risposta 19 giorni fa

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande