RedShift Serverless / Spectrum / Glue access issue

0

I'm running the following in RedShift query editor

create external schema customer_schema
from data catalog database 'customer' region 'us-west-2'
iam_role 'arn:aws:iam::<account-id>:role/RedshiftSpectrumRole'
create external database if not exists;

And getting the following error:

ERROR: Unknown std exception when calling external catalog API: ----------------------------------------------- error: Not authorized to get credentials of role arn:aws:iam::<account-id>:role/RedshiftSpectrumRole code: 30000 context: query: 0 location: xen_aws_credentials_mgr.cpp:402 process: padbm aster [pid=15652] ----------------------------------------------- [ErrorId: 1-6222317d-1fb7af7e7869388e5a5866f3]

The role has access to S3 and Glue, and it has been attached to the RedShift Serverless permissions.

I also submitted a ticket to AWS over 4 days ago and have not heard anything back. Can someone help out? Is there something I missed? Or is this an internal AWS error?

Below is the trust relationship for the role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "redshift.amazonaws.com",
                    "redshift-serverless.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
質問済み 2年前1669ビュー
3回答
1
承認された回答

I was trying to execute this query signed in as the Root user for this AWS account. It turns out that RedShift Serverless does not support this currently.

The solution is to create an IAM user, login and run these queries with that user.

回答済み 2年前
AWS
エキスパート
レビュー済み 2年前
1

Hi, I have been using Spectrum with Serverless and never encountered this issue. For this reason I guess it might be something linked to your environment.

Based on the description in your question I think you followed the documentation on the definition of the role, and by the description it seems to me it should be fine.

is the Glue catalogue in the same us-west-2 region ? If not have you looked at this knowledge base to allow cross account access?

If the catalogue is in the same region as the serverless cluster could you please include more information on the policies for the role, please? (as you did for the trust relationship).

Also please not, that Redshift Serverless is still in preview, you could submit your question directly to the serverless team, by sending an email to the address you find in this documentation page. In the email you could include the AWS Account Id, the cluster name and the region.

hope this helps.

AWS
エキスパート
回答済み 2年前
0

I got the same error message. Have you ever resolved this issue? I got this error after I created an external schema referring to lakeformation catalog and wanted to have permission control integration with the SSO identity center. So I created the external schema without specifying an IAM role, I guess this could be the reason of the issue. But I did this according to the AWS document https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-idp-connect.html, so I'm not sure if it's something wrong at my side or AWS internal issue?

eric
回答済み 19日前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ