Create Glue Job Using CloudFormation Template

Question

I am trying to create a Glue job by executing CloudFormation template. Below are the IAM policies details:
- test_glue_role : (AmazonS3FullAccess,AWSCloudFormationFullAccess)
- test_cloudformation_role : (AWSGlueConsoleFullAccess,AmazonS3FullAccess)
template.yml file is uploaded to S3 bucket.

When I am trying to create the cloudformation stack, every time its throwing the below error:
Error:
User: arn:aws:sts::300800030007:assumed-role/test_cloudformation_role/AWSCloudFormation is not authorized to perform: iam:PassRole on resource: arn:aws:iam::300800030007:role/test_glue_role because no identity-based policy allows the iam:PassRole action (Service: AWSGlue; Status Code: 400; Error Code: AccessDeniedException; Request ID: 883499f2-71ce-4c71-a6d4-6bfe49f23dc3; Proxy: null)

How to resolve this issue?

Matt-B · Accepted Answer

Hi There

The role you are using for CloudFormation doesn't have the required permissions to assign the role to Glue.  You have to add the `iam:PassRole` permission to the policy assigned to  `test_cloudformation_role` to allow it to *pass* the `test_glue_role`.

example policy entry:

```
{
    "Action": [
        "iam:PassRole"
    ],
    "Resource": [
        "arn:aws:iam::123456789123:role/test_glue_role",
    ],
    "Effect": "Allow"
}

```

See https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html for more info.

Create Glue Job Using CloudFormation Template

Relevant content