Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Glue virtual view permissions #1575

Open
mycaule opened this issue Nov 10, 2023 · 1 comment
Open

Glue virtual view permissions #1575

mycaule opened this issue Nov 10, 2023 · 1 comment
Labels
question Further information is requested

Comments

@mycaule
Copy link

mycaule commented Nov 10, 2023

After having setup a new federated source Federated, I have created a virtual view on a federated query in a second database my_database where I use the data.

With my admin account, I was able to perform both a query on the federated database, and on the federated view.
(Admin: query-1 ✔️, query-2 ✔️)

query-1

select * from Federated.public.my_table;

query-2

create view my_database.my_view as 
select * from Federated.public.my_table

select * my_database.from my_view

With an analyst AWS account with less permissions, I configured the IAM as recommended in the step 1 of Readme, but they are unable to query the federated view and get the following error, even though they can query the existing views (VIRTUAL_VIEW) and tables (EXTERNAL_TABLE) from the database and perform the direct query on the federated database.
(Analyst: query-1 ✔️, query-2 ❌)
https://docs.aws.amazon.com/athena/latest/ug/federated-query-iam-access.html

Insufficient permissions to execute the query.
This query ran against the `my_database` database, unless qualified by the query.

What's more, analysts can't recreate the view themselves,

create view my_database.analyst_view as 
select * from Federated.public.my_table

-- Error: Schema 'public' does not exist

As I understand creating a federated view creates a new VIRTUAL_VIEW in the Glue catalog. In Lake Formation I already granted "Super" access the the whole my_database and tables.

Do I have to set more permissions?

Thank you very much.

@mycaule mycaule added the question Further information is requested label Nov 10, 2023
@mycaule
Copy link
Author

mycaule commented Nov 18, 2023

AWS support told me I primarily needed to allow the athena:GetDataCatalog action.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

1 participant