AwsGlueDataBrewDataResourcePolicy

"s3:GetObject"

"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"

Allows you to preview your files.

"s3:PutObject"

"s3:PutBucketCORS"

"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"

Allows sending output files to S3.

"s3:DeleteObject"

"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"

"s3:ListBucket"

"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"

"arn:aws:kms:::key/key_ids"

"kms:GenerateDataKey"

"arn:aws:kms:::key/key_ids"

Allows encrypting of job output.

"ec2:DescribeVpcEndpoints"

"ec2:DescribeRouteTables"

"ec2:DeleteNetworkInterface"

"ec2:DescribeNetworkInterfaces"

"ec2:DescribeSecurityGroups"

"ec2:DescribeSubnets"

"ec2:DescribeVpcAttribute"

"ec2:CreateNetworkInterface"

"*"

Allows the setup of Amazon EC2 network items, such as virtual private clouds (VPCs), when running jobs and projects.

"ec2:DeleteNetworkInterface"

"ec2:CreateTags"

"ec2:DeleteTags"

"arn:aws:ec2:::network-interface/*", "arn:aws:ec2:::security-group/*"

Allows creating and deleting tags.

You need these permissions if you use an AWS Glue Data Catalog with a VPC enabled. DataBrew passes data to AWS Glue to run your jobs and projects. These permissions allow tagging of Amazon EC2 resources created for development endpoints. AWS Glue tags Amazon EC2 network interfaces, security groups, and instances with aws-glue-service-resource.

"logs:CreateLogGroup"

"logs:CreateLogStream"

"logs:PutLogEvents"

"arn:aws:logs:::log-group:/aws-glue-databrew/*"

Allows writing logs to Amazon CloudWatch Logs

DataBrew writes logs to log groups whose names begin with aws-glue-databrew.

"lakeformation:GetDataAccess"

"*"

Allows access to AWS Lake Formation, provided "Glue":"GetTable" is also allowed

Using Lake Formation requires further configuration in the Lake Formation console.