AmazonDataZoneGlueManageAccessRolePolicy
Last Modified
Mar 12, 2026
March 12, 2026 at 09:27 PM UTC
Version
v18
Total Versions
11
Created
Feb 12, 2026
Actions
63
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can rewrite resource policies and sharing
Grants 2 permissions management actions across 2 services (lakeformation, ram) on any resource, enough to share resources outside the account.
lakeformation:revokepermissionsram:acceptresourceshareinvitationUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
IAM Access Analyzer (1)
- Error / INVALID_SERVICE_CONDITION_KEY
The condition key lakeformation:GlueARN does not exist in the service lakeformation. Use a valid condition key. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "GlueTagDatabase",
"Effect": "Allow",
"Action": [
"glue:TagResource",
"glue:UntagResource"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
},
"ForAnyValue:StringLikeIfExists": {
"aws:TagKeys": "DataZoneDiscoverable_*"
}
}
},
{
"Sid": "GlueDataQuality",
"Effect": "Allow",
"Action": [
"glue:ListDataQualityResults",
"glue:GetDataQualityResult"
],
"Resource": "arn:aws:glue:*:*:dataQualityRuleset/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "GlueCrawler",
"Effect": "Allow",
"Action": "glue:ListCrawls",
"Resource": "arn:aws:glue:*:*:crawler/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "GlueConnection",
"Effect": "Allow",
"Action": "glue:GetConnection",
"Resource": [
"arn:aws:glue:*:*:connection/*",
"arn:aws:glue:*:*:catalog"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "GlueTableDatabaseCatalog",
"Effect": "Allow",
"Action": [
"glue:CreateTable",
"glue:DeleteTable",
"glue:GetDatabases",
"glue:GetTables",
"glue:SearchTables",
"glue:CreateCatalog",
"glue:CreateDatabase",
"glue:DeleteCatalog",
"glue:DeleteDatabase"
],
"Resource": [
"arn:aws:glue:*:*:catalog",
"arn:aws:glue:*:*:catalog/*",
"arn:aws:glue:*:*:database/*",
"arn:aws:glue:*:*:table/*",
"arn:aws:glue:*:*:userDefinedFunction/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "GlueGetTags",
"Effect": "Allow",
"Action": [
"glue:GetTags",
"glue:GetCatalog"
],
"Resource": [
"arn:aws:glue:*:*:catalog",
"arn:aws:glue:*:*:catalog/*",
"arn:aws:glue:*:*:database/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "LakeformationResourceSharing",
"Effect": "Allow",
"Action": [
"lakeformation:BatchGrantPermissions",
"lakeformation:BatchRevokePermissions",
"lakeformation:CreateDataCellsFilter",
"lakeformation:CreateLakeFormationOptIn",
"lakeformation:DeleteDataCellsFilter",
"lakeformation:DeleteLakeFormationOptIn",
"lakeformation:GrantPermissions",
"lakeformation:GetDataCellsFilter",
"lakeformation:GetResourceLFTags",
"lakeformation:ListDataCellsFilter",
"lakeformation:ListLakeFormationOptIns",
"lakeformation:ListPermissions",
"lakeformation:RegisterResource",
"lakeformation:RevokePermissions",
"lakeformation:UpdateDataCellsFilter",
"glue:GetDatabase",
"glue:GetTable",
"organizations:DescribeOrganization",
"ram:GetResourceShareInvitations",
"ram:ListResources"
],
"Resource": "*"
},
{
"Sid": "LakeformationResourceFederatedSharing",
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": "*",
"Condition": {
"Null": {
"lakeformation:GlueARN": "true"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"glue.amazonaws.com",
"lakeformation.amazonaws.com"
]
}
}
},
{
"Sid": "CrossAccountRAMResourceSharing",
"Effect": "Allow",
"Action": [
"glue:DeleteResourcePolicy",
"glue:PutResourcePolicy"
],
"Resource": [
"arn:aws:glue:*:*:catalog",
"arn:aws:glue:*:*:catalog/*",
"arn:aws:glue:*:*:database/*",
"arn:aws:glue:*:*:table/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"ram.amazonaws.com"
]
}
}
},
{
"Sid": "CrossAccountLakeFormationResourceSharing",
"Effect": "Allow",
"Action": [
"ram:CreateResourceShare"
],
"Resource": "*",
"Condition": {
"StringEqualsIfExists": {
"ram:RequestedResourceType": [
"glue:Table",
"glue:Database",
"glue:Catalog"
]
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"lakeformation.amazonaws.com"
]
}
}
},
{
"Sid": "CrossAccountRAMResourceShareInvitation",
"Effect": "Allow",
"Action": [
"ram:AcceptResourceShareInvitation"
],
"Resource": "arn:aws:ram:*:*:resource-share-invitation/*"
},
{
"Sid": "CrossAccountRAMResourceSharingViaLakeFormation",
"Effect": "Allow",
"Action": [
"ram:AssociateResourceShare",
"ram:DeleteResourceShare",
"ram:DisassociateResourceShare",
"ram:ListResourceSharePermissions",
"ram:UpdateResourceShare"
],
"Resource": "*",
"Condition": {
"StringLike": {
"ram:ResourceShareName": [
"LakeFormation*"
]
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"lakeformation.amazonaws.com"
]
}
}
},
{
"Sid": "GetResourceSharesViaLakeFormation",
"Effect": "Allow",
"Action": "ram:GetResourceShares",
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"lakeformation.amazonaws.com"
]
}
}
},
{
"Sid": "CrossAccountRAMResourceSharingViaLakeFormationHybrid",
"Effect": "Allow",
"Action": "ram:AssociateResourceSharePermission",
"Resource": "*",
"Condition": {
"ArnLike": {
"ram:PermissionArn": "arn:aws:ram::aws:permission/AWSRAMLFEnabled*"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"lakeformation.amazonaws.com"
]
}
}
},
{
"Sid": "KMSDecrypt",
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/datazone:projectId": "proj-all"
}
}
},
{
"Sid": "GetRoleForDataZone",
"Effect": "Allow",
"Action": [
"iam:GetRole"
],
"Resource": [
"arn:aws:iam::*:role/AmazonDataZone*",
"arn:aws:iam::*:role/service-role/AmazonDataZone*",
"arn:aws:iam::*:role/AmazonSageMakerManageAccess*",
"arn:aws:iam::*:role/service-role/AmazonSageMakerManageAccess*"
]
},
{
"Sid": "PassRoleForDataLocationRegistration",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AmazonDataZone*",
"arn:aws:iam::*:role/service-role/AmazonDataZone*",
"arn:aws:iam::*:role/AmazonSageMakerManageAccess*",
"arn:aws:iam::*:role/service-role/AmazonSageMakerManageAccess*",
"arn:aws:iam::*:role/datazone_usr_role*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"lakeformation.amazonaws.com",
"glue.amazonaws.com"
]
}
}
},
{
"Sid": "CreateCatalogEC2",
"Effect": "Allow",
"Action": [
"ec2:DescribeAccountAttributes",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeAvailabilityZones"
],
"Resource": "*"
},
{
"Sid": "CreateCatalogS3",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:PutBucketPolicy",
"s3:PutEncryptionConfiguration",
"s3:PutLifecycleConfiguration",
"s3:PutBucketVersioning",
"s3:PutBucketTagging"
],
"Resource": "arn:aws:s3:::redshift-staging-bucket*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
},
"VersionId": "v18",
"IsDefaultVersion": true,
"CreateDate": "2026-02-12T18:00:04+00:00"
}
}Version History (16 recorded)
Raw historyAmazonDataZoneGlueManageAccessRolePolicy - Policy Version v18
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
c8e2f4bAmazonDataZoneGlueManageAccessRolePolicy - Policy Version v18
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
eb1fde5AmazonDataZoneGlueManageAccessRolePolicy - Policy Version v14
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
cd00d57Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 19, 2025
2219996Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 8, 2025
f6f7d43Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 7, 2025
b9f589dUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 26, 2024
c34d213Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 28, 2024
bde36a6Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 4, 2024
30fa8a8Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 1, 2024
380994eUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 15, 2023
b52ddb4Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 14, 2023
30bdbf1Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 29, 2023
24a6644Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 22, 2023
b7d0a73