How to write an AWS IAM Policy document such that it does the following:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "ec2:StartInstances",
"Condition": {
"StringEquals": {
"glue:SourceGlueJobArn": "arn:aws:glue:some_glue_job_name"
},
},
"Effect": "Allow",
"Resource": "arn:aws:ec2:some_instance_id"
}
]
}
The idea would be that only a Glue Job named some_glue_job_name (or any other valid identifier as far as IAM conditions go) can do ec2:StartInstances (note that this action is just for example).
To compare, Lambda has lambda:SourceFunctionArn. But Glue seems to not have any such identifier supported for IAM conditionals.
Is there a workaround or am I missing something?
Just changing the execution role of the glue job is not possible, hence the necessity in the first place.
