glue:TagResource

Tagging

glue:TagResource is a Tagging access-level action in the glue service. Grants permission to add tags to a resource

Resource types

ARNs that glue:TagResource can be scoped to in an IAM policy.

arn:${Partition}:glue:${Region}:${Account}:blueprint/${BlueprintName}

blueprint

arn:${Partition}:glue:${Region}:${Account}:catalog/${CatalogName}

catalog

arn:${Partition}:glue:${Region}:${Account}:connection/${ConnectionName}

connection

arn:${Partition}:glue:${Region}:${Account}:connectionType:${ConnectionTypeName}

connectionType

arn:${Partition}:glue:${Region}:${Account}:crawler/${CrawlerName}

crawler

arn:${Partition}:glue:${Region}:${Account}:customEntityType/${CustomEntityTypeId}

customEntityType

arn:${Partition}:glue:${Region}:${Account}:dataQualityRuleset/${RulesetName}

dataQualityRuleset

arn:${Partition}:glue:${Region}:${Account}:database/${DatabaseName}

database

arn:${Partition}:glue:${Region}:${Account}:devEndpoint/${DevEndpointName}

devendpoint

arn:${Partition}:glue:${Region}:${Account}:integration:${IntegrationId}

integration

arn:${Partition}:glue:${Region}:${Account}:integrationresourceproperty/${ResourceType}/${ResourceName}

integrationResourceProperty

arn:${Partition}:glue:${Region}:${Account}:job/${JobName}

job

arn:${Partition}:glue:${Region}:${Account}:mlTransform/${TransformId}

mlTransform

arn:${Partition}:glue:${Region}:${Account}:registry/${RegistryName}

registry

arn:${Partition}:glue:${Region}:${Account}:schema/${SchemaName}

schema

arn:${Partition}:glue:${Region}:${Account}:session/${SessionId}

session

arn:${Partition}:glue:${Region}:${Account}:trigger/${TriggerName}

trigger

arn:${Partition}:glue:${Region}:${Account}:usageProfile/${UsageProfileId}

usageProfile

arn:${Partition}:glue:${Region}:${Account}:workflow/${WorkflowName}

workflow

Condition keys

Keys you can use in the Condition block of a policy that grants glue:TagResource.

aws:ResourceTag/${TagKey} String

Filters access by tag key-value pairs attached to the resource

Example IAM policy

A minimal policy that allows glue:TagResource. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowGlueTagResource",
      "Effect": "Allow",
      "Action": "glue:TagResource",
      "Resource": "*"
    }
  ]
}

Related actions in glue

glue:AuthorizeInboundIntegration Write glue:BatchCreatePartition Write glue:BatchDeleteConnection Write glue:BatchDeletePartition Write glue:BatchDeleteTable Write glue:BatchDeleteTableVersion Write glue:BatchGetBlueprints Read glue:BatchGetCrawlers Read glue:BatchGetCustomEntityTypes Read glue:BatchGetDevEndpoints Read glue:BatchGetJobs Read glue:BatchGetPartition Read

View all glue actions →