## Preflight checks for AWS Glue

URL: https://docs.atlan.com/apps/connectors/etl-tools/aws-glue/references/preflight-checks-for-aws-glue

> Before running the AWS Glue crawler, you can run preflight checks to validate credentials and IAM permissions.

Before [running the AWS Glue crawler](https://docs.atlan.com/llms/connectors/aws-glue/crawl-aws-glue/llms.txt), you can run [preflight checks](https://docs.atlan.com/llms/catalog/connector-capabilities/what-are-preflight-checks/llms.txt) to validate your configuration and IAM permissions. The following preflight checks are completed:

## Authentication check

Validates that credentials are correct and Atlan can connect to the AWS Glue Data Catalog.

✅ **Success:** `Authentication successful - connected to AWS Glue Data Catalog`

❌ **Failure:** `Authentication failed - could not connect to AWS Glue` or `Glue client not initialized`

If this check fails, verify your [AWS Glue access permissions](https://docs.atlan.com/llms/connectors/aws-glue/set-up-aws-glue/llms.txt) and that the credentials (access key/secret or role ARN) and region are correct.

## Get databases permission

Validates that the IAM principal has permission to list databases in the Glue Data Catalog (`glue:GetDatabases`).

✅ **Success:** `GetDatabases permission validated - can list databases`

❌ **Failure:** `Access denied - verify IAM permissions for glue:GetDatabases` or `GetDatabases permission check failed - invalid response structure`

Make sure your IAM user or role has at least `glue:GetDatabases` (for example, via the managed policy `AWSGlueConsoleFullAccess` or a custom policy that includes this action).

## Get tables permission

Validates that the IAM principal has permission to list tables in at least one Glue database (`glue:GetTables`). If no databases exist, this check still passes.

✅ **Success:** `GetTables permission validated - can list tables in database '<database name>'` or `GetTables permission validated - no databases found to test`

❌ **Failure:** `Access denied - verify IAM permissions for glue:GetTables` or `GetTables permission check failed: <error message>`

Make sure your IAM user or role has at least `glue:GetTables` on the Glue databases you intend to crawl.

## What preflight doesn't test

Preflight validates authentication, `glue:GetDatabases`, and `glue:GetTables` - a much smaller surface than a full crawl. A green preflight doesn't prove:

- **Per-database permissions.** Preflight touches one database; the crawl touches all of them, including databases shared from other AWS accounts (resource links) whose permissions live in the owning account.
- **Lake Formation column grants.** Missing column-level grants return tables with empty column lists - no error preflight can see. Run the `aws glue get-tables` self-check in [Catalog permissions & Lake Formation](https://docs.atlan.com/llms/connectors/aws-glue/catalog-permissions-and-lake-formation/llms.txt).
- **The circuit breaker.** Atlan compares each crawl's volume against the existing catalog and stops if more than 80% of assets are deleted - a data-volume comparison that only happens during the crawl.

If preflight passes but the crawl fails, see [Troubleshooting AWS Glue connectivity](https://docs.atlan.com/llms/connectors/aws-glue/troubleshooting-aws-glue-connectivity/llms.txt).

---