Glue operator ignores "iam_role_name" parameter

Question

I am trying to have a DAG trigger a Glue job. I have a role that can run these Glue jobs, and I want the Glue task to assume this role. The operator has a parameter called iam_role_name, but when I pass the name of my Glue role as this parameter, it still tries to execute as the Airflow role rather than assuming the role I gave.

I contacted AWS support and they said that basically my options are:

• Create a connection tied to the Glue role, and use that connection for the operator
• Add the Glue permissions to the Airflow role
• Use their own operator: https://github.com/aws-samples/mwaa-rbac-task

It seems to me that the developers of AwsGlueJobHook intended the iam_role_name parameter to be the easy way to assume roles. Yet the parameter seems to have no effect in practice. Why is this?

---

I am using:

• Airflow 2.2.2 via AWS MWAA
• apache-airflow-providers-amazon 2.4.0

Answer 1

In AwsGlueJobHook, the iam_role_name is used in this method to get the role information, and from these information, it uses only the role arn as an argument for the method create_job which create you job.

But in fact, the role/user used to create the client is the one found in the airflow connection.