Facing error while trying to read a table which is shared from Lake formation

Question

I am trying to read a table from the same account that i used to create the table , the table is shared to other accounts through lake formation 
in the glue job in the source account i get this error

Py4JJavaError - An error occurred while calling o87.getDynamicFrame. : java.lang.RuntimeException: class com.amazonaws.services.gluejobexecutor.model.AccessDeniedException:User: arn:aws:sts::xxxxx-glue-service-role/GlueJobRunnerSession is not authorized to perform: lakeformation:GetDataAccess on resource: arn:aws:glue:xxxxxx:table/xxxxx_db/xxxxx_table because no identity-based policy allows the lakeformation:GetDataAccess action (Service: AWSLakeFormation; Status Code: 400; Error Code: AccessDeniedException; Request ID: ef65ce54-fb6f-47e4-bc68-6c897e6c58df; Proxy: null) (Service: AWSGlueJobExecutor; Status Code: 400; Error Code: AccessDeniedException; Request ID: 170c064c-fcc0-46f0-9b1b-4b6566eb8152; Proxy: null) at com.amazonaws.services.glue.remote.LakeformationCredentialsProvider.refresh(LakeformationCredentialsProvider.scala:50) at com.amazonaws.services.glue.remote.LakeformationCredentialsProvider.(LakeformationCredentialsProvider.scala:77) at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.lang.reflect.Constructor.newInstance(Constructor.java:423) at com.amazonaws.services.glue.remote.MichiganAWSCredentialProviderProxy$.get(MichiganAWSCredentialProviderProxy.scala:14) at com.amazonaws.services.glue.util.FileSchemeWrapper.setHadoopConfiguration(FileSchemeWrapper.scala:43) at com.amazonaws.services.glue.util.FileSchemeWrapper.executeWith(FileSchemeWrapper.scala:94) at com.amazonaws.services.glue.util.FileSchemeWrapper.executeWithQualifiedScheme(FileSchemeWrapper.scala:102) at com.amazonaws.services.glue.HadoopDataSource.getDynamicFrame(DataSource.scala:561) at com.amazonaws.services.glue.DataSource.getDynamicFrame(DataSource.scala:104) at com.amazonaws.services.glue.DataSource.getDynamicFrame$(DataSource.scala:104) at com.amazonaws.services.glue.HadoopDataSource.getDynamicFrame(DataSource.scala:249) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:244) at py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:357) at py4j.Gateway.invoke(Gateway.java:282) at py4j.commands.AbstractCommand.invokeMethod(AbstractCommand.java:132) at py4j.commands.CallCommand.execute(CallCommand.java:79) at py4j.GatewayConnection.run(GatewayConnection.java:238) at java.lang.Thread.run(Thread.java:750)

Accepted Answer

This issue generally occurred, if your IAM role do not have sufficient permission. In your case, it throws error IAM user/role "glue-service-role" is not authorized to perform: lakeformation:GetDataAccess on table.

I would suggested you to add the following policy to your IAM role.

https://docs.aws.amazon.com/lake-formation/latest/dg/upgrade-glue-lake-formation-step3.html

`
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "LakeFormationDataAccess",
            "Effect": "Allow",
            "Action": [
                "lakeformation:GetDataAccess"
            ],
            "Resource": "*"
        }
    ]
}

`

Facing error while trying to read a table which is shared from Lake formation

관련 콘텐츠