Skip to content

Commit b1afdc1

Browse files
committed
Remove IAM policy change - address in new PR instead
Apply suggestion from doc review
1 parent 74aeae3 commit b1afdc1

1 file changed

Lines changed: 1 addition & 60 deletions

File tree

modules/manage/pages/iceberg/iceberg-topics-aws-glue.adoc

Lines changed: 1 addition & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ If you want to use partitioning, you must implement custom partitioning using yo
4646

4747
[NOTE]
4848
====
49-
In Redpanda versions 25.2.1, and 25.1.9 and earlier, an empty partition spec () can cause a known issue that prevents certain engines like Amazon Redshift from successfully querying the table. To resolve this issue, specify custom partitioning, or upgrade Redpanda to versions 25.2.2 or 25.1.10 and later.
49+
In Redpanda versions 25.2.1 and earlier, an empty partition spec `()` can cause a known issue that prevents certain engines like Amazon Redshift from successfully querying the table. To resolve this issue, specify custom partitioning, or upgrade Redpanda to versions 25.2.2 or later.
5050
====
5151

5252
=== Manual deletion of Iceberg tables
@@ -65,7 +65,6 @@ When `iceberg_delete` or the topic override `redpanda.iceberg.delete` is set to
6565

6666
== Authorize access to AWS Glue
6767

68-
ifndef::env-cloud[]
6968
You must allow Redpanda access to AWS Glue services in your AWS account. You can use the same access credentials that you configured for S3 (IAM role, access keys, and KMS key), as long as you have also added read and write access to AWS Glue Data Catalog.
7069

7170
For example, you could create a separate IAM policy that manages access to AWS Glue, and attach it to the IAM role that Redpanda also uses to access S3. It is recommended to add all AWS Glue API actions in the policy (`"glue:*"`) on the following resources:
@@ -95,64 +94,6 @@ Your IAM policy should include a statement similar to the following:
9594
]
9695
}
9796
----
98-
endif::[]
99-
100-
ifdef::env-cloud[]
101-
You must allow Redpanda access to AWS Glue services in your AWS account. It is recommended to create a new IAM policy or role that manages access to AWS Glue, allowing all AWS Glue API actions (`"glue:*"`) on the following resources:
102-
103-
- Root catalog (`catalog`)
104-
- All databases (`database/*`)
105-
- All tables (`table/\*/*`)
106-
107-
Your IAM policy should include a statement similar to the following:
108-
109-
[,json]
110-
----
111-
{
112-
"Version": "2012-10-17",
113-
"Statement": [
114-
{
115-
"Effect": "Allow",
116-
"Action": [
117-
"glue:*"
118-
],
119-
"Resource": [
120-
"arn:aws:glue:<aws-region>:<aws-account-id>:catalog",
121-
"arn:aws:glue:<aws-region>:<aws-account-id>:database/*",
122-
"arn:aws:glue:<aws-region>:<aws-account-id>:table/*/*"
123-
]
124-
},
125-
{
126-
"Effect": "Allow",
127-
"Action": [
128-
"s3:PutObject",
129-
"s3:PutObjectAcl",
130-
"s3:DeleteObject"
131-
],
132-
"Resource": [
133-
"arn:aws:s3:::redpanda-cloud-storage-<redpanda-cluster-id>/redpanda-iceberg-catalog/*"
134-
]
135-
},
136-
{
137-
"Effect": "Allow",
138-
"Action": [
139-
"s3:ListBucket"
140-
],
141-
"Resource": [
142-
"arn:aws:s3:::redpanda-cloud-storage-<redpanda-cluster-id>"
143-
],
144-
"Condition": {
145-
"StringLike": {
146-
"s3:prefix": [
147-
"redpanda-iceberg-catalog/*"
148-
]
149-
}
150-
}
151-
}
152-
]
153-
}
154-
----
155-
endif::[]
15697

15798
For more information on configuring IAM permissions, see the https://docs.aws.amazon.com/glue/latest/dg/configure-iam-for-glue.html[AWS Glue documentation^].
15899

0 commit comments

Comments
 (0)