Preflight checks for AWS Glue
Before running the AWS Glue crawler, you can run preflight checks to validate credentials and IAM permissions.
Before running the AWS Glue crawler, you can run preflight checks to validate your configuration and IAM permissions. The following preflight checks are completed:
Authentication check
Validates that credentials are correct and Atlan can connect to the AWS Glue Data Catalog.
✅ Success: Authentication successful - connected to AWS Glue Data Catalog
❌ Failure: Authentication failed - could not connect to AWS Glue or Glue client not initialized
If this check fails, verify your AWS Glue access permissions and that the credentials (access key/secret or role ARN) and region are correct.
Get databases permission
Validates that the IAM principal has permission to list databases in the Glue Data Catalog (glue:GetDatabases).
✅ Success: GetDatabases permission validated - can list databases
❌ Failure: Access denied - verify IAM permissions for glue:GetDatabases or GetDatabases permission check failed - invalid response structure
Make sure your IAM user or role has at least glue:GetDatabases (for example, via the managed policy AWSGlueConsoleFullAccess or a custom policy that includes this action).
Get tables permission
Validates that the IAM principal has permission to list tables in at least one Glue database (glue:GetTables). If no databases exist, this check still passes.
✅ Success: GetTables permission validated - can list tables in database '<database name>' or GetTables permission validated - no databases found to test
❌ Failure: Access denied - verify IAM permissions for glue:GetTables or GetTables permission check failed: <error message>
Make sure your IAM user or role has at least glue:GetTables on the Glue databases you intend to crawl.
Tag sync
Runs only when Import tags is Yes. Validates the permissions for the selected Tag sources on one database in the crawl scope, and lists the tag keys found in AWS. A key in Tag keys to sync that isn't listed doesn't block the run, because preflight reads only a sample.
✅ Success: Tag sync is ready for <tag sources>., followed by the tag keys found
❌ Failure: Properties is selected in Tag sources, but Tag keys to sync is empty., Import tags is on, but no option is selected in Tag sources., Atlan cannot read Glue resource tags: the IAM user or role in this connection is not allowed to call glue:GetTags., Atlan cannot read Lake Formation tags: the IAM user or role in this connection is not allowed to call lakeformation:ListLFTags., or Atlan cannot read Lake Formation tags on database <database name>.
If this check fails, grant the permissions for each tag source you select, or clear that source in Tag sources.
What preflight doesn't test
Preflight validates authentication, glue:GetDatabases, and glue:GetTables, plus tag sync when Import tags is on - a much smaller surface than a full crawl. A green preflight doesn't prove:
- Per-database permissions. Preflight touches one database; the crawl touches all of them, including databases shared from other AWS accounts (resource links) whose permissions live in the owning account.
- Lake Formation column grants. Missing column-level grants return tables with empty column lists - no error preflight can see. Run the
aws glue get-tablesself-check in Catalog permissions & Lake Formation. - The circuit breaker. Atlan compares each crawl's volume against the existing catalog and stops if more than 80% of assets are deleted - a data-volume comparison that only happens during the crawl.
If preflight passes but the crawl fails, see Troubleshooting AWS Glue connectivity.