I have listed the different documentation that can help you :
AWS Glue permission : https://docs.aws.amazon.com/glue/latest/dg/permissions.html
IAM Role for Amazon Web Service : https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html
AWS RedShift permission : https://docs.aws.amazon.com/redshift/latest/mgmt/grant-privileges.html
S3 permissions : https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.html
Dynamo IAM Permission : https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/iam-policy-examples.html
EMR IAM Permission : https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-roles.html
And an example of configuration in CloudFormation, i let you try it and adapt it if necessary :
Resources:
GlueJobRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Service: "glue.amazonaws.com"
Action: "sts:AssumeRole"
Policies:
- PolicyName: "GlueJobS3Policy"
PolicyDocument:
Version: "2012-10-17"
Statement:
# Permissions for Redshift
- Effect: "Allow"
Action:
- "redshift:DescribeClusters"
- "redshift:CopyFromS3"
- "redshift:Select"
Resource: "*"
# Permissions for S3
- Effect: "Allow"
Action:
- "s3:GetObject"
- "s3:PutObject"
- "s3:ListBucket"
- "s3:ListBucketMultipartUploads"
Resource:
- "arn:aws:s3:::your-s3-bucket-name/*"
- "arn:aws:s3:::your-s3-bucket-name"
# Permissions for Glue resources
- Effect: "Allow"
Action:
- "glue:GetTable"
- "glue:GetTableVersion"
- "glue:GetTableVersions"
- "glue:GetDatabase"
- "glue:GetPartitions"
- "glue:BatchGetPartition"
- "glue:CreateJob"
- "glue:GetJob"
- "glue:UpdateJob"
- "glue:StartJobRun"
- "glue:GetJobRun"
Resource: "*"
# Permissions for DynamoDB (optional)
- Effect: "Allow"
Action:
- "dynamodb:Scan"
- "dynamodb:Query"
Resource: "*"
# Permissions for EMR (optional)
- Effect: "Allow"
Action:
- "elasticmapreduce:ListClusters"
- "elasticmapreduce:DescribeCluster"
- "elasticmapreduce:DescribeStep"
Resource: "*"