(upbeat Music)
- Hello, I am Shweta, a Cloud Support Engineer head
at the AWS office in Bangalore, India.
Sometimes customers tell me
that their Amazon Redshift cluster is present
in Vonda account, for example, their production account,
but their S3 bucket and AWS Glue catalog is present
in another account that is Development Account.
They want to know how Amazon Redshift spectrum
can access AWS Glue and S3 resources.
So I'm going to show you how to create Amazon Redshift
spectrum, cross account access to AWS Glue and Amazon S3.
Let's get started.
In account A, after logging into the AWS management console,
navigate to the IM console, and create a role trusting
Amazon Redshift as the AWS service.
For now, we won't add any policies to this role.
We will come back to this later to maintain the flow.
Now let's attach this role to the Amazon Redshift cluster.
Now let's switch to the other account that is using AWS Glue
and Amazon S3.
Navigate to the IM console, and then create a policy
with list and read permissions for all AWS Glue resources
and list and read permissions
for the S3 bucket in this account.
Create a role, selecting the type of trusted entity
as another AWS account, and provide the account ID
of the account that is using Amazon Redshift.
With this rule, account B, trust the entire account A
for accessing AWS Glue and S3 resources present
in account B.
However, to further limit the access to our use case,
we'll modify the policy of trust relationship to limit
the access to only the concerned role of account A.
So returning to the first account, we'll be adding
the inland policy to the role
that we created earlier in the first step.
This policy allows the role in account A to assume the role
of account B.
Now that we are done with the setup,
let's verify the same by creating a schema
and running a simple query against the cluster.
Now let's look at the terminal.
Thanks for watching and happy cloud computing
from all of us here at AWS.
(upbeat music).