Question

A company runs a central Glue Data Catalog in a shared services account. A data science team in a separate AWS account needs to run Athena queries against several databases and tables registered in that central catalog. The security team requires that access be granted at the Data Catalog level without duplicating table definitions and without using Lake Formation. Which approach should the data engineer implement to enable the cross-account access?

Accepted Answer

Attach a Glue Data Catalog resource policy in the shared services account granting the data science account glue:GetDatabase and glue:GetTable actions, and grant matching IAM permissions in the consumer account.

Answer

Enable a Glue crawler in the data science account that points at the shared services account's S3 buckets to recreate the table definitions locally.

Answer

Create an S3 bucket policy on the underlying data buckets that grants the data science account read access, which automatically shares the catalog metadata.

Answer

Export the databases from the central catalog and import them into a new Glue Data Catalog in the data science account using AWS Backup.