# Setting up AWS Identity and Access Management (IAM) permissions
Setting up IAM permissions
Before you get started, you need to set up a few things in IAM. You need to be an administrator or have help from one. However, if you have an account with administrator access, you can do these tasks yourself. You can find simple instructions for each task in this section.
Following is an overview of what you need to do:
+ As part of this process, you add a user. You don't have to add a new user, you can use an existing one. You attach DataBrew permissions so that the user can open the DataBrew console.
+ Create an IAM role. A role allows certain actions and gives permissions when it is used, within limits. For example, it only works for users in your AWS account. You can add more limitations later.
+ Create the IAM policy or policies that you need. A policy is a list of things that a user is allowed to do. To create a policy, you open another console page and paste in the text from a file you download.
**Note**
What we provide here is basic setup information. We recommend that you take time to customize your permissions so they meet your security and compliance needs. If you need help, contact your administrator or AWS Support.
**To add the required permissions**
1. Create IAM policies to enable users to run DataBrew by doing the following:
+ [Add a custom IAM policy for a console user](setting-up-iam-policy-for-databrew-console-access.md). If you don't need a custom policy, you can choose the AWS-managed policy instead. Just add it to the user in step 2. A user with these permissions can access the DataBrew service console.
+ [Add permissions for data resources](setting-up-iam-policy-for-data-resources-role.md). An IAM role with these permissions can access data on behalf of the user.
You need to be an administrator to create users, roles, and policies.
1. [Add users or groups for DataBrew](setting-up-iam-users-and-groups-for-databrew.md). A user or group with the correct permissions attached can access the DataBrew console.
1. [Add a role with permissions to access data for DataBrew](setting-up-iam-role-to-use-in-databrew.md). A role with the correct permissions can access data on the user's behalf.
# Setting up IAM policies for DataBrew
You use IAM policies to manage permissions. A policy makes it easier to add related permissions all at once, rather than one at a time.
We recommend that you create the policies using the same names we provide. We use the names shown following for these policies throughout the documentation. Using these names also makes it easier if you ever need to contact AWS Support. However, you can choose to change both the policy names and their contents. For more information about IAM policies, see [Create a customer managed policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_managed-policies.html) in the *IAM User Guide*.
After you create the policies needed to use DataBrew, you attach them to users and roles. How to do this is covered later in this section.
**Topics**
+ [
# Adding an IAM policy for a console user
](setting-up-iam-policy-for-databrew-console-access.md)
+ [
# Adding permissions for data resources for an IAM role
](setting-up-iam-policy-for-data-resources-role.md)
+ [
# Configuring IAM policies for DataBrew
](iam-policy-config-for-databrew.md)
# Adding an IAM policy for a console user
Adding an IAM policy for a console user
Setting up permissions for a user for the AWS Management Console is optional, but if you require console access, take this step first.
To set up permissions to reach DataBrew on the console, choose one of the following:
+ Use the policy that's managed by AWS: `AwsGlueDataBrewFullAccessPolicy`. If you choose this option, skip to the next policy, [Adding permissions for data resources for an IAM role](setting-up-iam-policy-for-data-resources-role.md).
+ Create the policy described in this section, `AwsGlueDataBrewCustomUserPolicy`. This option enables you to customize the policy with additional custom security requirements.
The following policy grants the permissions needed to run the DataBrew console. You provide those permissions by using IAM.
**To define the AwsGlueDataBrewCustomUserPolicy IAM policy for DataBrew (console)**
1. Download the JSON for the [samples/AwsGlueDataBrewCustomUserPolicy.json.zip](samples/AwsGlueDataBrewCustomUserPolicy.json.zip) IAM policy.
1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).
1. In the navigation pane, choose **Policies**.
1. For each policy, choose **Create Policy**.
1. On the **Create Policy** screen, navigate to the **JSON** tab.
1. Copy the policy JSON statement that you downloaded. Paste it over the sample statement in the editor.
1. Verify that the policy is customized to your account, security requirements, and required AWS resources. If you need to make changes, you can make them in the editor.
1. Choose **Review policy**.
**To define the AwsGlueDataBrewCustomUserPolicy IAM policy for DataBrew (AWS CLI)**
1. Download the JSON for the [samples/AwsGlueDataBrewCustomUserPolicy.json.zip](samples/AwsGlueDataBrewCustomUserPolicy.json.zip) IAM policy.
1. Customize the policy as described in the first step of the previous procedure.
1. Run the following command to create the policy.
```
aws iam create-policy --policy-name AwsGlueDataBrewCustomUserPolicy --policy-document file://iam-policy-AwsGlueDataBrewCustomUserPolicy.json
```
# Adding permissions for data resources for an IAM role
Adding permissions for DataBrew data resources
To connect to data, AWS Glue DataBrew needs to have an IAM role that it can pass on behalf of the user. Following, you can find how to create the policy that you later attach to an IAM role.
The `AwsGlueDataBrewDataResourcePolicy` policy grants the permissions needed to connect to data using DataBrew. For any operation that accesses data in another AWS resource, such as accessing your objects in Amazon S3, DataBrew needs permission to access the resource on your behalf.
**To define the AwsGlueDataBrewDataResourcePolicy IAM policy for DataBrew (console)**
1. Download the JSON for [samples/AwsGlueDataBrewDataResourcePolicy.json.zip](samples/AwsGlueDataBrewDataResourcePolicy.json.zip).
1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).
1. In the navigation pane, choose **Policies**.
1. For each policy, choose **Create Policy**.
1. On the **Create Policy** screen, navigate to the **JSON** tab.
1. Copy the policy JSON statement that you downloaded. Paste it over the sample statement in the editor.
1. Verify that the policy is customized to your account, security requirements, and required AWS resources. If you need to make changes, you can make them in the editor.
1. Choose **Review policy**.
**To define the AwsGlueDataBrewDataResourcePolicy IAM policy for DataBrew (AWS CLI)**
1. Download the JSON for [samples/AwsGlueDataBrewDataResourcePolicy.json.zip](samples/AwsGlueDataBrewDataResourcePolicy.json.zip).
1. Customize the policy as described in the first step of the previous procedure.
1. Run the following command to create the policy.
```
aws iam create-policy --policy-name AwsGlueDataBrewDataResourcePolicy --policy-document file://iam-policy-AwsGlueDataBrewDataResourcePolicy.json
```
# Configuring IAM policies for DataBrew
Configuring policies
Following, you can find details and examples about IAM policies that you can use with DataBrew. Details about the basic policies are provided here. Plus, there are more examples that are not required to use DataBrew. They are additional configurations that you might use in certain situations.
**Topics**
+ [
# AwsGlueDataBrewCustomUserPolicy
](iam-policy-to-use-databrew-console.md)
+ [
# AwsGlueDataBrewDataResourcePolicy
](iam-policy-for-data-resources-role.md)
+ [
# IAM policy to use Amazon S3 objects with DataBrew
](iam-policy-to-use-s3-for-data-resource-role.md)
+ [
# IAM policy to use encryption with DataBrew
](iam-policy-to-use-kms-encrypted-s3-for-data-resource-role.md)
# AwsGlueDataBrewCustomUserPolicy
The `AwsGlueDataBrewCustomUserPolicy` policy grants most of the permissions required to use the DataBrew console. Some of the resources that are specified in this policy refer to services that are used by DataBrew. These include names for AWS Glue Data Catalog, Amazon S3 buckets, Amazon CloudWatch Logs, and AWS KMS resources. It is similar to the AWS-managed policy named `AwsGlueDataBrewFullAccessPolicy`.
The following table describes the permissions granted by this policy.
| **Action** | **Resource** | **Description** |
| --- | --- | --- |
| `"databrew:*"` | `"*"` | Grants permission to run all DataBrew API operations. |
| `"glue:GetDatabases"` `"glue:GetPartitions"` `"glue:GetTable"` `"glue:GetTables"` `"glue:GetDataCatalogEncryptionSettings"` | "\$1" | Allows listing of AWS Glue databases and tables. |
| `"dataexchange:ListDataSets"` `"dataexchange:ListDataSetRevisions"` `"dataexchange:ListRevisionAssets"` `"dataexchange:CreateJob"` `"dataexchange:StartJob"` `"dataexchange:GetJob"` | `"*"` | Allows listing of AWS Data Exchange resources in datasets. |
| `"kms:DescribeKey"` `"kms:ListKeys"` `"kms:ListAliases"` | `"*"` | Allows listing of AWS KMS keys to use for encryption of job output. |
| `"kms:GenerateDataKey"` | `"arn:aws:kms:::key/key_ids"` | Allows encrypting of job output. |
| `"s3:ListAllMyBuckets"` `"s3:GetBucketCORS"` `"s3:GetBucketLocation"` `"s3:GetEncryptionConfiguration"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows listing of Amazon S3 buckets for projects, datasets, and jobs. Allows sending output files to S3. |
| `"sts:GetCallerIdentity"` | `"*"` | Get information about the current caller. |
| `"cloudtrail:LookupEvents",` | `"*"` | Allow listing AWS CloudTrail events for datasets (data lineage). |
| `"iam:ListRoles"` `"iam:GetRole"` | `"*"` | Allows listing IAM roles to use for projects and jobs. |
# AwsGlueDataBrewDataResourcePolicy
The `AwsGlueDataBrewDataResourcePolicy` policy grants the permissions needed to connect to data and to configure DataBrew.
The following table describes the permissions granted by this policy.
| **Action** | **Resource** | **Description** |
| --- | --- | --- |
| `"s3:GetObject"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows you to preview your files. |
| `"s3:PutObject"` `"s3:PutBucketCORS"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows sending output files to S3. |
| `"s3:DeleteObject"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows deleting an object created by DataBrew. |
| `"s3:ListBucket"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows listing of Amazon S3 buckets from projects, datasets, and jobs. |
| "kms:Decrypt" | `"arn:aws:kms:::key/key_ids"` | Allows decrypting for encrypted datasets. |
| `"kms:GenerateDataKey"` | `"arn:aws:kms:::key/key_ids"` | Allows encrypting of job output. |
| `"ec2:DescribeVpcEndpoints"` `"ec2:DescribeRouteTables"` `"ec2:DeleteNetworkInterface"` `"ec2:DescribeNetworkInterfaces"` `"ec2:DescribeSecurityGroups"` `"ec2:DescribeSubnets"` `"ec2:DescribeVpcAttribute"` `"ec2:CreateNetworkInterface"` | `"*"` | Allows the setup of Amazon EC2 network items, such as virtual private clouds (VPCs), when running jobs and projects. |
| `"ec2:DeleteNetworkInterface"` | "\$1" | Allows deleting a network interface in a VPC. |
| `"ec2:CreateTags"` `"ec2:DeleteTags"` | `"arn:aws:ec2:::network-interface/*", "arn:aws:ec2:::security-group/*"` | Allows creating and deleting tags. You need these permissions if you use an AWS Glue Data Catalog with a VPC enabled. DataBrew passes data to AWS Glue to run your jobs and projects. These permissions allow tagging of Amazon EC2 resources created for development endpoints. AWS Glue tags Amazon EC2 network interfaces, security groups, and instances with `aws-glue-service-resource`. |
| `"logs:CreateLogGroup"` `"logs:CreateLogStream"` `"logs:PutLogEvents"` | `"arn:aws:logs:::log-group:/aws-glue-databrew/*"` | Allows writing logs to Amazon CloudWatch Logs DataBrew writes logs to log groups whose names begin with `aws-glue-databrew`. |
| `"lakeformation:GetDataAccess"` | `"*"` | Allows access to AWS Lake Formation, provided `"Glue":"GetTable"` is also allowed Using Lake Formation requires further configuration in the Lake Formation console. |
# IAM policy to use Amazon S3 objects with DataBrew
IAM policy for S3
The `AwsGlueDataBrewSpecificS3BucketPolicy` policy grants the permissions needed to access S3 on behalf of nonadministrative users.
Customize the policy as follows:
1. Replace the Amazon S3 paths in the policy so they point to the paths that you want to use. In the sample text, *`BUCKET-NAME-1/SPECIFIC-OBJECT-NAME`* represents a specific object or file. *`BUCKET-NAME-2/`* represents all objects (`*`) whose path name starts with `BUCKET-NAME-2/`. Update these to name the buckets that you are using.
1. (Optional) Use wildcards in the Amazon S3 paths to further restrict permissions. For more information, see [IAM policy elements: Variables and tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html) in the *IAM User Guide*.
**Security Best Practice**: To prevent unauthorized access to Amazon S3 buckets with similar names in other AWS accounts, include the `aws:ResourceAccount` condition key in your policy. This ensures that DataBrew can only access buckets within your own AWS account, even when using wildcard resource ARNs. Add the following condition to your policy statements:
```
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "123456789012"
}
}
```
Replace `123456789012` with your actual AWS account ID.
As part of doing this, you might restrict permissions for the actions `s3:PutObject` and `s3:PutBucketCORS`. These actions are required only for users who create DataBrew projects, because those users need to be able to send output files to S3.
For more information and to see some examples of what you can add to an IAM policy for Amazon S3, see [Bucket Policy Examples](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html) in the *Amazon S3 Developer Guide.*
The following table describes the permissions granted by this policy.
| **Action** | **Resource** | **Description** |
| --- | --- | --- |
| `"s3:GetObject"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows you to preview your files. |
| `"s3:PutObject"` `"s3:PutBucketCORS"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows sending output files to S3. |
| `"s3:DeleteObject"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows deleting an object. |
**To define the AwsGlueDataBrewSpecificS3BucketPolicy IAM policy for DataBrew (console)**
1. Download the JSON for the [samples/AwsGlueDataBrewSpecificS3BucketPolicy.json.zip](samples/AwsGlueDataBrewSpecificS3BucketPolicy.json.zip) IAM policy.
1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).
1. In the navigation pane, choose **Policies**.
1. For each policy, choose **Create Policy**.
1. On the **Create Policy** screen, navigate to the **JSON** tab.
1. Paste in the policy JSON statement over the sample statement in the editor.
1. Verify that the policy is customized to your account, security requirements, and required AWS resources. If you need to make changes, you can make them in the editor.
1. Choose **Review policy**.
**To define the AwsGlueDataBrewSpecificS3BucketPolicy IAM policy for DataBrew (AWS CLI)**
1. Download the JSON for [samples/AwsGlueDataBrewSpecificS3BucketPolicy.json.zip](samples/AwsGlueDataBrewSpecificS3BucketPolicy.json.zip).
1. Customize the policy as described in the first step of the previous procedure.
1. Run the following command to create the policy.
```
aws iam create-policy --policy-name AwsGlueDataBrewSpecificS3BucketPolicy --policy-document file://iam-policy-AwsGlueDataBrewSpecificS3BucketPolicy.json
```
# IAM policy to use encryption with DataBrew
IAM policy for encryption
The `AwsGlueDataBrewS3EncryptedPolicy` policy grants the permissions needed to access S3 objects encrypted with AWS Key Management Service (AWS KMS) on behalf of nonadministrative users.
Customize the policy as follows:
1. Replace the Amazon S3 paths in the policy so that they point to the paths you want to use. In the sample text, *`BUCKET-NAME-1/SPECIFIC-OBJECT-NAME`* represents a specific object or file. *`BUCKET-NAME-2/`* represents all objects (`*`) whose path name starts with `BUCKET-NAME-2/`. Update these to name the buckets you are using.
1. (Optional) Use wildcards in the Amazon S3 paths to further restrict permissions. For more information, see [IAM policy elements: Variables and tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html).
As part of doing this, you might restrict permissions for the actions `s3:PutObject` and `s3:PutBucketCORS`. These actions are required only for users who create DataBrew projects, because those users need to be able to send output files to S3.
For more information and to see some examples of what you can add to an IAM policy for Amazon S3, see [Bucket Policy Examples](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html).
1. Find the following resource ARNs in the `ToUseKms` file.
```
"arn:aws:kms:AWS-REGION-NAME:AWS-ACCOUNT-ID-WITHOUT-DASHES:key/KEY-IDS",
"arn:aws:kms:AWS-REGION-NAME:AWS-ACCOUNT-ID-WITHOUT-DASHES:key/KEY-IDS"
```
1. Change the example AWS account to your AWS account number (without hyphens).
1. Change the sample list to instead list the IAM roles you want to use. We recommend scoping your IAM policies to the smallest permissions set possible. However, you can allow your user to access all IAM roles, for example if you are using a personal learning account with sample data. To allow the list to access all IAM roles, change the sample list to one entry: `"arn:aws:iam::111122223333:role/*"`.
The following table describes the permissions granted by this policy.
| **Action** | **Resource** | **Description** |
| --- | --- | --- |
| `"s3:GetObject"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows you to preview your files. |
| `"s3:ListBucket"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows listing of Amazon S3 buckets from projects, datasets, and jobs. |
| `"s3:PutObject"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows sending output files to S3. |
| `"s3:DeleteObject"` | `"arn:aws:s3:::bucket_name/*", "arn:aws:s3:::bucket_name"` | Allows deleting an object created by DataBrew. |
| "kms:Decrypt" | `"arn:aws:kms:::key/key_ids"` | Allows decrypting for encrypted datasets. |
| `"kms:GenerateDataKey*"` | `"arn:aws:kms:::key/key_ids"` | Allows encrypting of job output. |
**To define the AwsGlueDataBrewS3EncryptedPolicy IAM policy for DataBrew (console)**
1. Download the JSON for the [samples/AwsGlueDataBrewS3EncryptedPolicy.json.zip](samples/AwsGlueDataBrewS3EncryptedPolicy.json.zip) IAM policy.
1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).
1. In the navigation pane, choose **Policies**.
1. For each policy, choose **Create Policy**.
1. On the **Create Policy** screen, navigate to the **JSON** tab.
1. Paste in the policy JSON statement over the sample statement in the editor.
1. Verify that the policy is customized to your account, security requirements, and required AWS resources. If you need to make changes, you can make them in the editor.
1. Choose **Review policy**.
**To define the AwsGlueDataBrewS3EncryptedPolicy IAM policy for DataBrew (AWS CLI)**
1. Download the JSON for [samples/AwsGlueDataBrewS3EncryptedPolicy.json.zip](samples/AwsGlueDataBrewS3EncryptedPolicy.json.zip).
1. Customize the policy as described in the first step of the previous procedure.
1. Run the following command to create the policy.
```
aws iam create-policy --policy-name AwsGlueDataBrewS3EncryptedPolicy --policy-document file://iam-policy-AwsGlueDataBrewS3EncryptedPolicy.json
```
# Adding users or groups with DataBrew permissions
Adding users and groups with DataBrew permissions
You assign policies to roles, and roles to users and groups to manage permissions. For more information, see [IAM Identities (users, groups, and roles)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html) in the *IAM User Guide*.
Before you begin, you need to have at least one user to assign permissions to.
Use the following procedure to set up DataBrew permissions for users who need to work in the DataBrew console, or run DataBrew commands in the CLI.
**To set up DataBrew permissions**
1. Create an access key for you user to use the AWS CLI for DataBrew, and other development tools.
1. Enable **AWS Management Console access** to allow the user to use the AWS console.
1. Create a role for DataBrew users or groups.
1. Choose the policy you are using. Do one of the following:
+ If you created `AwsGlueDataBrewCustomUserPolicy`, select it from the list.
+ To use the AWS-managed policy, select `AwsGlueDataBrewFullAccessPolicy` from the list.
1. Assign that policy to the role.
1. Set the Trust relationships for the role so that a user or group can assume the relevant role.
+ If you are not using groups, trust the user with the role.
+ If you are using groups, trust the group with the role and add the user to the group.
# Adding an IAM role with data resource permissions
Adding an IAM role with DataBrew permissions
You use IAM roles to manage policies that are assigned together. An IAM role can be used by someone acting in a particular role, such as a DataBrew user or DataBrew itself. For more information, see [IAM Roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) in the *IAM User Guide.*
Use the following procedure to create an IAM role that is required for DataBrew projects to access data.
**To attach the required IAM policy to a new IAM role for DataBrew**
1. In the navigation pane, choose **Roles**, **Create Role**.
1. For **Select type of trusted entity**, choose the card labeled **AWS service**.
1. Choose **DataBrew** from the list, then choose **Next: Permissions**.
1. Enter **AwsGlueDataBrewDataResourcePolicy** in the search box (the IAM policy you created in an earlier step). Select the policy and choose **Next: Tags**.
1. Choose **Next: Review**.
1. For **Role name**, enter **AwsGlueDataBrewDataAccessRole**, and choose **Create role**.