Create an AWS Glue Service Role to Assign to ETL Jobs

The role you create should have access to the typical permissions of a Glue Service Role, but also access to read the secret and S3 bucket you've created.

• In AWS, go to the IAM service.
• Under Access Management, select Roles.
• In roles, click on Create role.
• In select trusted entity, select AWS service and pick Glue from the dropdown.
• In add permissions:
  • Search for AWSGlueServiceRole.
  • Click the related checkbox.
  • Search for SecretsManagerReadWrite.
  • Click the related checkbox.

• In Name, review, and create:

  • Define a name for your role.
  • Click on Create role.

• Return to Access Management, Roles, and search for the role you've just created.

• Select your role.
• Click on Add permissions, then Create inline policy.
• Click on JSON.
• In the Policy editor, paste the JSON object below, substituting the name of the bucket you've created.

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "FullAccessToSpecificBucket",
              "Effect": "Allow",
              "Action": "s3:*",
              "Resource": [
                  "arn:aws:s3:::<bucket-name>",
                  "arn:aws:s3:::<bucket-name>/*"
              ]
          }
      ]
  }
  

• Click Next.
• Assign a name to your policy.
• Click on Create policy.