Skill 73 · Managing Data Catalog
Subchapter 73.3
references/classifying-with-glossaries.mdMarkdown7 KBView on GitHub
The calls are simple. Both platforms fail here for reasons that are not about the calls: on Glue, not believing the capability exists; on both, creating a second term instead of finding the one that is already there.
Check availability first. Before using the Glue business-context operations in this section (glossaries, terms, custom form types, catalog assets and attachments), check their availability and any stated limitations in the AWS Glue documentation (opens in a new tab), and pass any caveat it gives on to the user. The table-layer operations (
Description, columnCommentandParametersviaupdate-table) are not part of that surface.
The AWS Glue Data Catalog has native business glossaries and glossary terms.
glue create-glossary, glue create-glossary-term and
glue associate-glossary-terms are Glue operations.
They are not Amazon DataZone’s glossaries, they are not Lake Formation LF-Tags, and they do not need a SageMaker Catalog domain. You MUST NOT tell a user that “there is no Glue API to create a glossary”. The statement is false, and it was the single most common wrong answer measured on this task.
CreateGlossary takes no catalog scoping. There is no --catalog-id to
find, so an agent looking for the scoped create will not find one and should not
conclude the operation is absent.
aws glue create-glossary --region <region> --name "<Glossary Name>" \
--description "<what this glossary covers>"
# -> {"Id": "<opaque generated id>"}
aws glue create-glossary-term --region <region> \
--glossary-identifier <glossary-id> --name "<Term Name>" \
--short-description "<one sentence: what it means and how it is scoped>"Glossaries and terms get opaque generated ids (bjaif1ziwej5bb), so a name
is never usable as an identifier and a name-to-id lookup is mandatory. This is
where the task fails most often: asked to apply the term a user named, agents
create a new glossary with a new term of that name in it and associate that,
leaving two terms of the same name and the intended one still attached to
nothing. The end state looks correct in the answer and is wrong in the catalog.
# Glue: find the term the user named, across every glossary.
# The name is matched in jq, never pasted into a --query: a quote in it ("Customer's
# ID") would end the JMESPath string early and the search would error or match the
# wrong term. Not called TERM, which is the shell's terminal type.
TERM_NAME='<the term name the user used>'
for g in $(aws glue list-glossaries --region <region> --query 'Items[].Id' --output text); do
aws glue list-glossary-terms --region <region> --glossary-identifier "$g" --output json \
| jq -r --arg name "$TERM_NAME" --arg g "$g" \
'.Items[] | select(.Name == $name) | [$g, .Id, .Name] | @tsv'
doneIt prints one glossary<TAB>term-id<TAB>name line per match. Nothing printed means no
glossary has the term.
If list-glossaries is denied, do not fall back to creating one. A policy
allowing glue:*Glossary* does not cover glue:ListGlossaries, because the plural
has no Glossary substring, so enumerating can be refused on a caller that can
happily create, list terms and associate. In that case:
aws glue list-glossary-terms --glossary-identifier <name-or-id> if the
user named the glossary; the identifier accepts what you were given.glue:ListGlossaries is what you were denied.Creating a second term to work around a read denial is the worst available outcome: the association succeeds, the answer looks right, and the term the user meant is still attached to nothing.
On the SageMaker Catalog the same rule applies through search:
aws datazone search --domain-identifier <domain> --search-scope GLOSSARY_TERM \
--search-text "<term name>" --query 'items[].glossaryTermItem.{Id:id,Name:name}'AssociateGlossaryTerms is additive: associating a second term leaves the
first in place. This is the opposite of the SageMaker Catalog, and it is worth
knowing precisely so you neither warn about a hazard that does not exist nor
assume merging is safe elsewhere in this skill. DisassociateGlossaryTerms
removes one, with the same two flags.
aws glue associate-glossary-terms --region <region> \
--asset-identifier "arn:aws:glue:<region>:<ACCOUNT_ID>:table/<db>/<table>" \
--glossary-term-identifiers <term-id>Resolve <ACCOUNT_ID> at runtime with aws sts get-caller-identity --query Account --output text. Never hardcode it.
Term associations live in the top-level glossaryTerms list on the asset, which
CreateAssetRevision replaces. So associating one term the naive way clears
every other term the asset had. Use the canonical read-modify-write in
references/describing-assets.md, which reads the existing list and sends it
back with the addition. Note that the same revision drops any form you
omit, so tagging an asset can silently unbind it from its table.
To remove the asset’s only term, omit the glossaryTerms parameter. Passing
an empty list is refused client-side: the parameter has a minimum length of one.
When the request describes the assets by meaning (“every table that reports revenue”) rather than by name, read the schema and the column comments. Do not match on table names. Both directions matter: a table whose name says nothing about the concept can still carry a measure column that does, and a table whose name suggests the concept can turn out to measure a neighbouring one: spend, cost, margin and billings are not revenue. Judge on the measure columns and their comments, not the table name.
When asked to create a glossary for a domain rather than a named list of terms: one glossary per business domain, terms named as the business says them, and a one-sentence definition on every term that says how the metric is computed or scoped. A term with no definition is a tag, not a glossary term.