aws-glue-catalog-cross-account
The Glue Data Catalog resource policy names a principal in another AWS account, granting cross-account metadata (and optionally data) access.
match (record)
{
"field": "ResourcePolicy.Statement[].Principal",
"resource_type": "AWS::Glue::DataCatalog"
}
where
at least one Statement principal is in a different account (arn:aws:iam::<other-account>:*)
Effect == Allow
Action includes glue:GetDatabase / glue:GetTable / glue:GetConnection or glue:* (wildcard)
emit
| source type | Data |
|---|---|
| target type | ExternalIdentity |
| source | <DataCatalog node> |
| target | <external account principal named in the policy> |
| conditions | resource_policy |
| state logic | ACTIVE when the resource policy grants the external principal access and the Lake Formation fine-grained grants (if any) also admit the principal. CONDITIONAL(resource_policy) if Lake Formation override controls are enabled and the specific database/table grants are unknown. BLOCKED if the Data Catalog resource policy has been superseded by Lake Formation deny. |
Narrative
The Glue Data Catalog resource policy in account {account.name} grants principal {external.name} (account {external.account}) access to catalog metadata (databases and tables), enabling cross-account ETL and data discovery.
Raw rule rules/derived/aws/glue.yaml
id: aws-glue-catalog-cross-account
emits: CrossAccountTrust
description: The Glue Data Catalog resource policy names a principal in another AWS account, granting
cross-account metadata (and optionally data) access.
applies_to:
- aws
match_record:
resource_type: AWS::Glue::DataCatalog
field: ResourcePolicy.Statement[].Principal
where:
- at least one Statement principal is in a different account (arn:aws:iam::<other-account>:*)
- Effect == Allow
- Action includes glue:GetDatabase / glue:GetTable / glue:GetConnection or glue:* (wildcard)
emit:
source_type: Data
target_type: ExternalIdentity
source: <DataCatalog node>
target: <external account principal named in the policy>
permissions: []
conditions:
- resource_policy
state_logic: ACTIVE when the resource policy grants the external principal access and the Lake Formation
fine-grained grants (if any) also admit the principal. CONDITIONAL(resource_policy) if Lake Formation
override controls are enabled and the specific database/table grants are unknown. BLOCKED if the Data
Catalog resource policy has been superseded by Lake Formation deny.
confidence: 0.9
derived_from:
- <HasPolicy(DataCatalog, ResourcePolicy) edge_id>
false_positive_note: The Glue Data Catalog resource policy grants METADATA access (list/get databases
and tables). Actual data reads from underlying S3 locations require separate S3 bucket policies and
Lake Formation column/row permissions. Do not conflate a Catalog metadata grant with unrestricted
data access. When Lake Formation is in control (UseOnlyIAMAccessControl=false), Lake Formation grants
take precedence over the IAM Catalog policy for data access; model data access under lakeformation.yaml.
When both are relevant, emit CrossAccountTrust here for the Catalog trust and defer data-access derivation
to Lake Formation rules. A condition on the resource policy (e.g. aws:SourceAccount) may restrict
which principals in the listed account can use the trust; honor it before emitting ACTIVE.
narrative: The Glue Data Catalog resource policy in account {account.name} grants principal {external.name}
(account {external.account}) access to catalog metadata (databases and tables), enabling cross-account
ETL and data discovery.