AWS Comprehend Tutorial - Unable to create Crawler

This error indicates that your account doesn't have the necessary permissions to create a Glue crawler. Even though you've followed the tutorial prerequisites, there might be some permission issues that need to be addressed.

Based on the error "Account is denied access" when creating a crawler, here are some steps to resolve this issue:

1. First, verify that your IAM user or role has all the required permissions. The tutorial prerequisites mention attaching the AWSGlueConsoleFullAccess managed policy to your IAM entity, which is essential for creating crawlers.

2. Check if you have the iam:PassRole permission properly configured. The error might occur because your IAM entity doesn't have permission to pass a role to AWS Glue. The prerequisite policy includes a statement that allows iam:PassRole for resources with names containing "Comprehend", but you might need to ensure this covers the role you're trying to use for the crawler.

3. If you're using a custom role for the crawler, make sure it has the necessary trust relationship with the Glue service.

4. You can check CloudTrail event history in the region where you're trying to create the crawler to view the failed logs and get more details about the specific permission issue.

5. If you're still encountering issues after verifying permissions, it could be related to your AWS account configuration. In this case, you might want to open a case with AWS Support under "Account and billing" for further assistance.

To specifically fix the iam:PassRole issue, you may need to update your IAM policy to include a statement like:

{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::<your-account-id>:role/<your-glue-role-name>",
"Condition": {
"StringEquals": {
"iam:PassedToService": "glue.amazonaws.com"
}
}
}

Replace <your-account-id> and <your-glue-role-name> with your actual values.
Sources
Troubleshooting Amazon Comprehend identity and access - Amazon Comprehend
Create Crawler error | AWS re:Post
Resolve the IAM error "not authorized to perform iam:PassRole" | AWS re:Post
Tutorial: Analyzing insights from customer reviews with Amazon Comprehend - Amazon Comprehend
One Crawler failed to create. Access account is denied. | AWS re:Post