title: Restricting access to Glue Jobs and Crawlers
body: <p>So, as per the AWS documenation (and confirmed through some testing and tweaking with IAM policies), there is no way to control access to running Glue Jobs or Crawlers, either via resource-based authorization (using ARNs) or tag-based (using resource tags). In a nutshell: if you give some entity access to <code>glue:StartJobRun</code> for instance, this will give access to run ALL and ANY jobs it wants. Pretty weird, right?</p>
  <p>I need ideas for achieving access control outside Glue. I thought of Lambda, but it doesn't really work because the Lambda function can't really &quot;know&quot; who called it in order to check some parameters like Principal tags and compare it to the accessed resources.</p>
  <p>Also, the solution should not be too cumbersome to the user, as I'm removing his ability to easily run stuff with the console to somewhere else. I can't really force him to go through several complicated steps to achieve something as simple as running his own job.</p>
  <p>Thoughts?</p>