Catalog permissions & Lake Formation
The exact IAM permissions Atlan needs for AWS Glue, plus the Lake Formation grants whose absence silently empties crawls instead of raising errors.
Glue has no firewall to open - its "allowlist" is IAM plus, if you use it, Lake Formation. This page covers the exact permissions, and the silent failure mode that generates more confusion than any hard error.
IAM permissions Atlan needs
Read-only, metadata-only. The full policy JSON is in Connect with IAM access keys; the actions are:
| Actions | Why Atlan needs them |
|---|---|
glue:GetDatabases, glue:GetDatabase | List and read the databases in the catalog |
glue:GetTables, glue:GetTable, glue:SearchTables | List and read tables and views (columns arrive inside the table response) |
glue:GetTableVersions, glue:GetTableVersion | Read table schema versions |
glue:GetPartition, glue:GetPartitions | Read partition metadata (table sizes, structure) |
glue:GetUserDefinedFunctions, glue:GetUserDefinedFunction | Read UDF metadata |
The policy grants these actions on four resource types: catalog, database/*, table/*/*, and tableVersion/*/*/*. A policy that drops the catalog resource line fails with AccessDeniedException … not authorized to perform: glue:GetTables on resource: …:catalog even when everything else is correct. Copy all four lines.
Silent failure mode: Missing permissions ≠ error
When some Glue permissions are missing or scoped too narrowly, the AWS APIs often return empty results instead of an error. The crawl "succeeds" - with 0 tables or 0 columns. Atlan then sees your previously cataloged assets missing from the new crawl and the circuit breaker stops the workflow with Delete percentage is more than 80.0. Exiting. Nothing in that message says "permissions." If a crawl suddenly returns far fewer assets, check permissions first, not the connector.
Lake Formation - extra permission layer
If you're using AWS Lake Formation to manage access to your AWS resources, you need to grant permissions in Lake Formation and to the objects you want to crawl (see Set up AWS Glue). In practice:
- Lake Formation sits on top of IAM. IAM can say yes while Lake Formation quietly filters the response.
- Grant the Atlan IAM role (or user) DESCRIBE and SELECT on each governed database and table, and
lakeformation:GetDataAccess. - If column-level security is configured, grant access to all columns for the Atlan role. With table-level-only grants,
GetTablesreturns every table with an empty column list - no error anywhere.
How to check yourself, in 2 minutes
Ask your AWS admin to run this while assuming the Atlan role (or using the Atlan user's keys):
aws glue get-tables --database-name <one-of-your-databases> --region <region>
# Healthy: each table shows a populated "StorageDescriptor": { "Columns": [ ... ] }
# Lake Formation filtering: tables appear but "Columns" is empty or missing
# Missing IAM grant: AccessDeniedException naming the exact action and resource
This one command distinguishes the three failure classes that account for most Glue issues. Include its output when you open a support ticket - it usually turns a week of back-and-forth into one reply.
Organization guardrails that can interfere
- Service control policies (SCPs) or permission boundaries at your AWS organization level can override the role's own policy. If the policy looks perfect but calls are denied, ask whoever manages your AWS organization.
- Per-database cross-account grants: if some databases in your catalog are shared from another AWS account (resource links), the Atlan role needs
glue:GetTablesgranted on those databases in the owning account too - see Special cases.