Note
Firehose supports database as a source in all AWS Regions except China Regions, AWS GovCloud (US) Regions, and Asia Pacific (Malaysia). This feature is in preview and is subject to change. Do not use it for your production workloads.
You must have an IAM role before you create a Firehose stream and Apache Iceberg Tables using AWS Glue. Use the following steps to create a policy and an IAM role. Firehose assumes this IAM role and performs the required actions.
-
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/
. -
Create a policy and choose JSON in policy editor.
-
Add the following inline policy that grants Amazon S3 permissions like the read/write permissions, permissions to update the table in the data catalog, and other.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:GetTable", "glue:GetDatabase", "glue:UpdateTable", "glue:CreateTable", "glue:CreateDatabase" ], "Resource": [ "arn:aws:glue:<region>:<aws-account-id>:catalog", "arn:aws:glue:<region>:<aws-account-id>:database/*", "arn:aws:glue:<region>:<aws-account-id>:table/*/*" ] }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:GetBucketLocation", "s3:GetObject", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::amzn-s3-demo-bucket", "arn:aws:s3:::amzn-s3-demo-bucket/*" ] }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": [ "arn:aws:kms:<region>:<aws-account-id>:key/<key-id>" ], "Condition": { "StringEquals": { "kms:ViaService": "s3.region.amazonaws.com" }, "StringLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::amzn-s3-demo-bucket/prefix*" } } }, { "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:<region>:<aws-account-id>:log-group:<log-group-name>:log-stream:<log-stream-name>" ] }, { "Effect": "Allow", "Action": "secretsmanager:GetSecretValue", "Resource": "<Secret ARN>" }, { "Effect": "Allow", "Action": [ "ec2:DescribeVpcEndpointServices" ], "Resource": [ "*" ] } ] }
