Glue 5.0: Cannot create Redshift connection — “AccessDeniedException when creating service linked secrets”

When you encounter the "AccessDeniedException when creating service linked secrets, insufficient privilege" error while creating a Redshift connection in AWS Glue 5.0, this typically indicates permission issues related to AWS Secrets Manager.

Here are the steps to resolve this issue:

1. IAM Permissions: Ensure your IAM role for AWS Glue has the required secretsmanager:GetSecretValue permission. Without this permission, you'll receive an AccessDeniedException when Glue tries to access credentials stored in Secrets Manager.

2. VPC Endpoints: For Redshift connections (especially Version 2 connections), you need to set up the following VPC endpoints with private DNS enabled:

• AWS Secrets Manager (interface type)
• Security Token Service (STS) (interface type)
• AWS KMS (interface type)
• Amazon S3 (gateway type)
• Amazon Redshift (interface type)

3. Trust Relationships: Make sure your IAM role has the proper trust relationships configured to allow Glue to assume the role. You may need to add Redshift as one of the trust relationship principals.

4. Security Groups and Network ACLs: Verify that your security groups and network ACLs allow the necessary traffic between AWS Glue, Redshift, Secrets Manager, and other required services.

5. VPC Connectivity: Ensure proper VPC connectivity to all required services. The error message suggests that Glue cannot connect to Secrets Manager to create or access the secrets needed for the Redshift connection.

If you've checked all these settings and still encounter issues, you might want to try creating the connection using AWS CLI with a custom connector for Redshift using the JDBC URL as a workaround.
Sources
The new version 2 redshift connection for Glue fails | AWS re:Post
Glue Connection (Version 2) for redshift | AWS re:Post
Troubleshoot Secrets Manager code 400 | AWS re:Post