无法启动AWS Glue Crawler：IAM权限问题及所需权限咨询

API 探路者

2026-8-5

解决AWS Glue爬虫启动失败的权限问题

针对你遇到的爬虫8秒内失败、提示角色权限不足的问题，除已配置的策略外，还需检查/添加以下权限：

CloudWatch Logs 权限：Glue爬虫需要将运行日志写入CloudWatch，需为AWSGlueServiceRoleDefault角色附加CloudWatchLogsFullAccess托管策略，或创建自定义策略包含以下操作：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:*:*:/aws-glue/crawlers/*"
        }
    ]
}

KMS 解密权限（若S3桶启用加密）：如果目标S3桶使用了SSE-KMS加密，需为角色添加对应KMS密钥的权限，自定义策略示例：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:你的区域:你的账号ID:key/密钥ID"
        }
    ]
}

Glue 资源细粒度权限：尽管AWSGlueServiceRole托管策略包含基础权限，可补充以下操作确保覆盖爬虫及相关资源的访问：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glue:StartCrawler",
                "glue:GetCrawler",
                "glue:UpdateCrawler",
                "glue:CreateDatabase",
                "glue:CreateTable"
            ],
            "Resource": [
                "arn:aws:glue:你的区域:你的账号ID:crawler/你的爬虫名称",
                "arn:aws:glue:你的区域:你的账号ID:database/*",
                "arn:aws:glue:你的区域:你的账号ID:table/*"
            ]
        }
    ]
}

额外检查项：