Preflight checks for AWS Glue
Before running the AWS Glue crawler, you can run preflight checks to validate credentials and IAM permissions.
Before running the AWS Glue crawler, you can run preflight checks to validate your configuration and IAM permissions. The following preflight checks are completed:
Authentication check
Validates that credentials are correct and Atlan can connect to the AWS Glue Data Catalog.
✅ Success: Authentication successful - connected to AWS Glue Data Catalog
❌ Failure: Authentication failed - could not connect to AWS Glue or Glue client not initialized
If this check fails, verify your AWS Glue access permissions and that the credentials (access key/secret or role ARN) and region are correct.
Get databases permission
Validates that the IAM principal has permission to list databases in the Glue Data Catalog (glue:GetDatabases).
✅ Success: GetDatabases permission validated - can list databases
❌ Failure: Access denied - verify IAM permissions for glue:GetDatabases or GetDatabases permission check failed - invalid response structure
Make sure your IAM user or role has at least glue:GetDatabases (for example, via the managed policy AWSGlueConsoleFullAccess or a custom policy that includes this action).
Get tables permission
Validates that the IAM principal has permission to list tables in at least one Glue database (glue:GetTables). If no databases exist, this check still passes.
✅ Success: GetTables permission validated - can list tables in database '<database name>' or GetTables permission validated - no databases found to test
❌ Failure: Access denied - verify IAM permissions for glue:GetTables or GetTables permission check failed: <error message>
Make sure your IAM user or role has at least glue:GetTables on the Glue databases you intend to crawl.
Tag sync
Runs only when Import tags is Yes. Validates the permissions for the selected Tag sources on one database in the crawl scope, and lists the tag keys found in AWS. A key in Tag keys to sync that isn't listed doesn't block the run, because preflight reads only a sample.
✅ Success: Tag sync is ready for <tag sources>., followed by the tag keys found
❌ Failure: Properties is selected in Tag sources, but Tag keys to sync is empty., Import tags is on, but no option is selected in Tag sources., Atlan cannot read Glue resource tags: the IAM user or role in this connection is not allowed to call glue:GetTags., Atlan cannot read Lake Formation tags: the IAM user or role in this connection is not allowed to call lakeformation:ListLFTags., or Atlan cannot read Lake Formation tags on database <database name>.
If this check fails, grant the permissions for each tag source you select, or clear that source in Tag sources.
Business context region
Runs only when Import business context is Yes. Checks whether the region of the connection supports business context. This check always passes, so it never blocks the crawl.
✅ Region supported: Business context is available in <region>.
✅ Region not supported: Business context is not available in <region> during the AWS preview. The rest of the crawl runs as normal.
Business context permissions
Runs only when Import business context is Yes. Checks that the IAM principal can call the business context actions. This check always passes, so it never blocks the crawl.
✅ Permissions granted: Business context permissions validated.
✅ Permissions missing: Business context will be skipped. Missing IAM permissions: <actions>. The rest of the crawl runs as normal.
If actions are missing, add the permissions for business context and run the crawler again.
Glue skills search assets
Runs only when Import Glue skills is Yes. Checks that the IAM principal can list Glue skills with glue:SearchAssets. This check always passes, so it never blocks the crawl.
✅ Permissions granted: Glue skills permissions validated. or Glue skills are readable, but none were found.
✅ Permission denied: Glue skills will be skipped. Missing IAM permission: glue:SearchAssets. The rest of the crawl runs as normal.
✅ Other error: Could not check glue:SearchAssets. The crawl will report it if skills cannot be read. The rest of the crawl runs as normal.
If the permission is denied, add the permissions for Glue skills and run the crawler again.
Glue skills S3 read
Runs only when Import Glue skills is Yes. Reads the markdown of one skill from Amazon S3. This check always passes, so it never blocks the crawl.
✅ Readable: Skill markdown is readable from S3.
✅ Access denied: Skill markdown will be skipped: s3:GetObject is denied on the skill files, or kms:Decrypt on their customer-managed key. Skills still import with their links.
✅ Other failure: Could not read a skill file from S3. Skills still import with their links.
✅ No file to check: No S3 skill file to check; skill markdown will be read during the crawl where allowed.
If access is denied, add the permissions for Glue skills and run the crawler again.
What preflight doesn't test
Preflight validates authentication, glue:GetDatabases, and glue:GetTables, plus tag sync when Import tags is on, the business context checks when Import business context is on, and the Glue skills checks when Import Glue skills is on. That's a much smaller surface than a full crawl. A green preflight doesn't prove:
- Per-database permissions. Preflight touches one database; the crawl touches all of them, including databases shared from other AWS accounts (resource links) whose permissions live in the owning account.
- Lake Formation column grants. Missing column-level grants return tables with empty column lists - no error preflight can see. Run the
aws glue get-tablesself-check in Catalog permissions & Lake Formation. - The circuit breaker. Atlan compares each crawl's volume against the existing catalog and stops if more than 80% of assets are deleted - a data-volume comparison that only happens during the crawl.
If preflight passes but the crawl fails, see Troubleshooting AWS Glue connectivity.