Here is my example JSON role, which allows glue to access s3 and create a table.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ec2:DeleteTags", "ec2:CreateTags" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:network-interface/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:TagKeys": "aws-glue-service-resource" } } }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "iam:GetRole", "cloudwatch:PutMetricData", "ec2:DeleteNetworkInterface", "s3:ListBucket", "s3:GetBucketAcl", "logs:PutLogEvents", "ec2:DescribeVpcAttribute", "glue:*", "ec2:DescribeSecurityGroups", "ec2:CreateNetworkInterface", "s3:GetObject", "s3:PutObject", "logs:CreateLogStream", "s3:ListAllMyBuckets", "ec2:DescribeNetworkInterfaces", "logs:AssociateKmsKey", "ec2:DescribeVpcEndpoints", "iam:ListRolePolicies", "s3:DeleteObject", "ec2:DescribeSubnets", "iam:GetRolePolicy", "s3:GetBucketLocation", "ec2:DescribeRouteTables" ], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": "s3:CreateBucket", "Resource": "arn:aws:s3:::aws-glue-*" }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": "logs:CreateLogGroup", "Resource": "*" } ]
}