1 Answer
- Newest
- Most votes
- Most comments
0
It's impossible to understand or help without additional info, it would be really helpful if you can post the policy configured in the role, and the cloudtrail error (remove info like account numbers).
Thanks!
Relevant content
- asked 2 years ago
- asked 2 years ago
This the service role policy which is created when we create resource for subscription
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:DeregisterResource", "lakeformation:DescribeResource", "lakeformation:GetDataAccess", "lakeformation:GetDataLakeSettings", "lakeformation:GetEffectivePermissionsForPath", "lakeformation:GrantPermissions", "lakeformation:ListPermissions", "lakeformation:ListResources", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "lakeformation:UpdateResource", "ram:AcceptResourceShareInvitation", "ram:GetResourceShareInvitations", "ram:ListPendingInvitationResources" ], "Resource": "*", "Effect": "Allow" },
{ "Action": [ "kms:GenerateDataKey*", "kms:CreateKey*", "kms:CreateAlias", "kms:DescribeKey", "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabase", "glue:GetDatabases", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:GetTable", "glue:GetTables", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:UpdatePartition", "glue:GetPartition", "glue:GetPartitions", "glue:BatchGetPartition", "redshift:DescribeClusters", "redshift:ModifyClusterIamRoles" ], "Resource": "", "Effect": "Allow" }, { "Action": [ "s3:" ], "Resource": "arn:aws:s3:::bdt-glue-bucket-34c8f298-82ba-e3ac-db5e-7262641084db/*", "Effect": "Allow" }, { "Action": [ "s3:ListBucket" ], "Resource": "arn:aws:s3:::bdt-glue-bucket-34c8f298-82ba-e3ac-db5e-7262641084db", "Effect": "Allow" },
{ "Action": [ "redshift:RejectDataShare", "redshift:AuthorizeDataShare", "redshift:DeauthorizeDataShare", "redshift:AssociateDataShareConsumer", "redshift:DisassociateDataShareConsumer" ], "Resource": "arn:aws:redshift:::datashare:/", "Effect": "Allow" }, { "Action": [ "redshift-data:BatchExecuteStatement", "redshift-data:ExecuteStatement" ], "Resource": [ "arn:aws:redshift:us-east-1:accountId:cluster:", "arn:aws:redshift-serverless:us-east-1:accountId:workgroup/" ], "Effect": "Allow" }, { "Action": [ "redshift:GetClusterCredentials" ], "Resource": [ "arn:aws:redshift:us-east-1:accountId:dbuser:/", "arn:aws:redshift:us-east-1:accountId:dbname:/" ], "Effect": "Allow" }, { "Action": [ "redshift-serverless:GetCredentials", "redshift-serverless:ListWorkgroups", "redshift-serverless:GetNamespace", "redshift-data:CancelStatement", "redshift-data:DescribeStatement", "redshift-data:GetStatementResult", "redshift-data:ListStatements", "redshift-data:ListDatabases", "redshift:DescribeDataShares", "redshift:DescribeDataSharesForProducer", "redshift:DescribeDataSharesForConsumer" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "iam:PassRole", "iam:GetRole", "iam:GetRolePolicy" ], "Resource": "arn:aws:iam::accountId:role/bdt-glue-role-us-east-1", "Effect": "Allow" } ] }