Skill 123 · Creating Data Lake Table
Subchapter 123.1
references/access-control.mdMarkdown1 KBView on GitHub
You MUST use least-privilege permissions when configuring access to S3 Tables.
Actions: s3tables:GetTableBucket, s3tables:GetNamespace, s3tables:GetTable, s3tables:GetTableMetadataLocation, s3tables:GetTableData
Resources:
arn:aws:s3tables:{region}:{account_id}:bucket/{bucket_name}arn:aws:s3tables:{region}:{account_id}:bucket/{bucket_name}/table/*Set with aws s3tables put-table-bucket-policy --table-bucket-arn <ARN> --resource-policy '<POLICY_JSON>'.
Actions: glue:GetCatalog, glue:GetDatabase, glue:GetTable
Resources (all three actions on each):
arn:aws:glue:{region}:{account_id}:catalog (root – required for federated catalog resolution)arn:aws:glue:{region}:{account_id}:catalog/s3tablescatalogarn:aws:glue:{region}:{account_id}:catalog/s3tablescatalog/*arn:aws:glue:{region}:{account_id}:database/s3tablescatalog/*/*arn:aws:glue:{region}:{account_id}:table/s3tablescatalog/*/*/*If the table bucket uses SSE-KMS, the querying principal also needs kms:Decrypt and kms:GenerateDataKey on the KMS key.
See table-creation-glue-etl.md for the Glue job service role permissions.
For latest IAM guidance, search AWS docs for "S3 Tables identity-based policies IAM", "S3 Tables access management", and "S3 Tables Glue catalog prerequisites".