Policy config for Firehose format conversion glue access

I'm looking to set up format conversion for my firehose delivery stream. The configuration involves specifying a role with access to glue to determine the output schema. I haven't been able to find the exact requirements for this role anywhere in the docs, the only descriptor is "The role that Kinesis Data Firehose can use to access AWS Glue."

What actions/resources does a policy need to specify for firehose to be able to use the role for format conversion?