## Set up AWS Glue

URL: https://docs.atlan.com/apps/connectors/etl-tools/aws-glue/how-tos/set-up-aws-glue

> Learn about set up aws glue.

:::warning

**🤓 Who can do this?** You will need your AWS Glue Data Catalog administrator to run these commands - you may not have access yourself.

:::

:::info **Did you know?** 
 Prefixing all resources created for Atlan with `atlan-` will help you better identify them. You should also add AWS tags and descriptions to these resources for later reference.

:::

Atlan supports fetching metadata from [AWS Glue Data Catalog](https://docs.aws.amazon.com/glue/latest/dg/catalog-and-crawler.html). If you also want to be able to preview and query the data, you can [set up an Amazon Athena connection](https://docs.atlan.com/llms/connectors/amazon-athena/set-up-amazon-athena/llms.txt) instead.

## Create IAM policy

To create an IAM policy with the necessary permissions follow [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html).

Create the policy using the following JSON:

```json
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "VisualEditor0",
 "Effect": "Allow",
 "Action": [
 "glue:GetTables",
 "glue:GetDatabases",
 "glue:GetTable",
 "glue:GetDatabase",
 "glue:SearchTables",
 "glue:GetTableVersions",
 "glue:GetTableVersion",
 "glue:GetPartition",
 "glue:GetPartitions",
 "glue:GetUserDefinedFunctions",
 "glue:GetUserDefinedFunction"
 ],
 "Resource": [
 "arn:aws:glue:<region>:<account_id>:tableVersion/*/*/*",
 "arn:aws:glue:<region>:<account_id>:table/*/*",
 "arn:aws:glue:<region>:<account_id>:catalog",
 "arn:aws:glue:<region>:<account_id>:database/*"
 ]
 }
 ]
}
```

- Replace `<region>` with the AWS region of your Glue instance.
- Replace `<account_id>` with your account ID.

:::warning

If you're using AWS Lake Formation to manage access to your AWS resources, you will need to [grant permissions in AWS Lake Formation](https://docs.aws.amazon.com/lake-formation/latest/dg/granting-catalog-permissions.html) as well as to the objects you want to crawl.

:::

:::info

If you plan to crawl assets from an Amazon S3 Table Bucket federated catalog, no additional IAM permissions are required. The existing `glue:GetDatabases` and `glue:GetTables` permissions apply to federated catalogs when a Catalog ID is configured.

:::

## Choose authentication mechanism

Using the IAM policy created in [Create IAM policy](#create-iam-policy) step, configure one of the following options for authentication.

### User-based authentication

To configure user-based authentication:

1. Create an AWS IAM user by following [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
2. On the _Set permissions_ page, attach the policy created in the previous step to this user.
3. Once the user is created, view or download the user's _access key ID_ and _secret access key_.

 :::warning

 This will be your only opportunity to view or download the access keys. You will not have access to them again after leaving the user creation screen.

 :::

### Role delegation-based authentication

To configure role delegation-based authentication:

1. [Raise a support ticket](https://docs.atlan.com/support/submit-request) to get the ARN of the _Node Instance Role_ for your Atlan EKS cluster.
2. Create a new role in your AWS account by following [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html).
 1. When prompted for policies, attach the policy created in the previous step to this role.
 2. When prompted, create a trust relationship for the role using the following trust policy. (Replace `<atlan_nodeinstance_role_arn>` with the ARN received from Atlan support.) 

 ```json
 {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "<atlan_nodeinstance_role_arn>"
 },
 "Action": "sts:AssumeRole",
 "Condition": {}
 }
 ]
 }
 ```

3. Now, [reach out to Atlan support](https://docs.atlan.com/support/submit-request) with:
 - The name of the role you created earlier.
 - The ID of the AWS account where the role was created.

:::warning

Wait until the support team confirms the account is allowlisted to assume the role before running the crawler.

:::

---