{"record":{"id":"09d73ed8a8b51123","repo":"apache/iceberg","slug":"cannot-commit-s-because-glue-cannot-access-the-re","errorCode":null,"errorMessage":"Cannot commit %s because Glue cannot access the requested resources","messagePattern":"Cannot commit (.+?) because Glue cannot access the requested resources","errorType":"exception","errorClass":"ForbiddenException","httpStatus":null,"severity":"error","filePath":"aws/src/main/java/org/apache/iceberg/aws/glue/GlueTableOperations.java","lineNumber":369,"sourceCode":"  }\n\n  private void handleAWSExceptions(AwsServiceException persistFailure) {\n    if (persistFailure instanceof ConcurrentModificationException) {\n      throw new CommitFailedException(\n          persistFailure, \"Cannot commit %s because Glue detected concurrent update\", tableName());\n    } else if (persistFailure\n        instanceof software.amazon.awssdk.services.glue.model.AlreadyExistsException) {\n      throw new AlreadyExistsException(\n          persistFailure,\n          \"Cannot commit %s because its Glue table already exists when trying to create one\",\n          tableName());\n    } else if (persistFailure instanceof EntityNotFoundException) {\n      throw new NotFoundException(\n          persistFailure,\n          \"Cannot commit %s because Glue cannot find the requested entity\",\n          tableName());\n    } else if (persistFailure instanceof AccessDeniedException) {\n      throw new ForbiddenException(\n          persistFailure,\n          \"Cannot commit %s because Glue cannot access the requested resources\",\n          tableName());\n    } else if (persistFailure\n        instanceof software.amazon.awssdk.services.glue.model.ValidationException) {\n      throw new ValidationException(\n          persistFailure,\n          \"Cannot commit %s because Glue encountered a validation exception \"\n              + \"while accessing requested resources\",\n          tableName());\n    } else {\n      int statusCode = persistFailure.statusCode();\n      if (statusCode < 500 || statusCode >= 600) {\n        throw persistFailure;\n      }\n    }\n  }\n","sourceCodeStart":351,"sourceCodeEnd":387,"githubUrl":"https://github.com/apache/iceberg/blob/86d9c8fc543e7c56c9f624eb725f76c9baff9570/aws/src/main/java/org/apache/iceberg/aws/glue/GlueTableOperations.java#L351-L387","documentation":"ForbiddenException thrown by GlueTableOperations.handleAWSExceptions when the Glue API raises AccessDeniedException during a commit. The AWS credentials in use are not authorized to perform the required Glue operations (GetTable/UpdateTable/CreateTable) on the target database and table. Iceberg maps this to its ForbiddenException so callers can treat it as an authorization problem rather than a transient commit failure.","triggerScenarios":"doCommit → persistGlueTable Glue calls rejected by IAM/lake-formation policy: missing glue:GetTable, glue:UpdateTable, glue:CreateTable permissions, or Lake Formation not granting the principal on the table.","commonSituations":"EC2 task role or IRSA service account lacking glue:UpdateTable permission; Lake Formation permissions never granted to the job's principal; SCP or resource-based policy restricting the Glue calls; credentials from a different account than the Glue catalog.","solutions":["Grant the executing principal IAM permissions glue:GetTable, glue:UpdateTable, glue:CreateTable on the relevant databases/tables.","If Lake Formation is enabled, grant the principal LF permissions (DESCRIBE, INSERT/ALTER as needed) on the table.","Verify the configured credentials/role belong to the same account and region as the Glue catalog.","Check for SCPs, permission boundaries, or VPC endpoint policies denying glue API calls."],"exampleFix":"// before\n// job role policy grants only glue:GetDatabase -> AccessDeniedException on commit\n// after\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\"glue:GetTable\", \"glue:UpdateTable\", \"glue:CreateTable\"],\n  \"Resource\": \"arn:aws:glue:*:<account>:table/<db>/*\"\n}","handlingStrategy":"validation","validationCode":"// dry-run IAM check before running jobs\naws glue get-table --database-name <db> --name <table>\naws sts get-caller-identity  # confirm principal/account","typeGuard":null,"tryCatchPattern":"try {\n  table.append(df);\n} catch (ForbiddenException e) {\n  // do not retry; surface IAM/Lake Formation configuration problem\n  throw new IllegalStateException(\"Insufficient Glue permissions, check IAM/LF grants\", e);\n}","preventionTips":["Grant glue:GetTable, glue:UpdateTable, glue:CreateTable to the job principal","Grant Lake Formation permissions when LF is enabled","Validate credentials with aws sts get-caller-identity before jobs","Check SCPs and VPC endpoint policies for glue API denials"],"tags":["aws","glue","commit","iam","access-denied"],"backgroundTag":"permission-denied","analyzedSha":"86d9c8fc543e7c56c9f624eb725f76c9baff9570","analyzedAt":"2026-09-12T00:46:39.097Z","contentChangedAt":"2026-09-12T00:46:39.097Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}