Tutorial: configure cross-account access for Redshift federated catalog table
This tutorial provides step-by-step instructions on how to configure cross account sharing of Redshift federated catalog tables using Lake Formation permissions. For more information, see Sharing a data lake using Lake Formation fine-grained access control.
Prerequisites
Before proceeding, ensure you have the following prerequisites:
-
Two accounts; account A as the sharing account, account B as the recipient account.
-
Two AWS accounts with Lake Formation cross-account sharing version 4 and Lake Formation administrator configured. For more information, see Data lake administrator permissions and initial setup of Lake Formation.
-
Permissions for managing Amazon Redshift namespaces in the Data Catalog granted to the Lake Formation administrator role on both accounts.
-
An Amazon S3 bucket in the account A account to host the sample Iceberg table data.
-
An IAM role in the account A account to register your Amazon S3 location for Iceberg table with Lake Formation. For more information, see Registering an Amazon S3 location and Requirements for roles used to register locations.
-
An Redshift Serverless namespace in the account A account. Follow the instructions in Creating a data warehouse with Amazon Redshift Serverless to launch a serverless namespace with default settings.
-
An IAM role,
Glue-execution-role, in account B with appropriate policies.
Required IAM policies for Glue-execution-role
The Glue-execution-role in account B requires the following AWS managed
policies:
-
AWSGlueServiceRole -
AmazonRedshiftDataFullAccess
Additionally, create an inline policy with the following permissions:
Add the following trust policy to Glue-execution-role:
