[SOLVED] What permission am I missing for AWS Glue and Development Endpoint?

What permission am I missing for AWS Glue and Development Endpoint?

I'm getting the following error when I try to create a development endpoint for AWS Glue.

{ "service":"AWSGlue",
"statusCode":400,
"errorCode":"ValidationException",
"requestId":"<here goes an UUID>",
"errorMessage":"Role arn:aws:iam::<IAM ID>:role/AWSGlueServiceRole-DefaultRole 
      should be given assume role permissions for Glue Service.\n",
"type":"AwsServiceError" }

And my role has the following permissions.

AmazonS3FullAccess
AWSGlueServiceNotebookRole
AmazonAthenaFullAccess
AWSGlueServiceRole
CloudWatchLogsReadOnlyAccess
AWSGlueConsoleFullAccess
AWSCloudFormationReadOnlyAccess

Any clues on what am I missing?

Solution

I was tripped up by this as well; the problem is that when you use the console to create a default glue service role it ends up creating the IAM role like this:

arn:aws:iam:::role/service-role/AWSGlueServiceRole-DefaultRole

Make note of the "service-role" in the path.

But then when choosing that role as the role you want to use in the console wizard for setting up a new dev endpoint it doesn't include the "service-role" in the path and looks for a role named like this:

arn:aws:iam:::role/AWSGlueServiceRole-DefaultRole

I think this is just a bug in the console wizard for creating dev endpoints. I got around it by creating a new role that doesn't have "service-role" in the path and then chose that role in the console wizard and was able to successfully create a dev endpoint.