Error: 403 Forbidden or Invalid Json when running AWS Glue POJO job in AutoSys System Agent

Products

• Autosys Workload Automation
• Workload Automation Agent

Issue/Introduction

When attempting to run an AWS Glue job using the POJO job type in AutoSys, the job fails with either an Invalid Json error or a 403 Forbidden error.
This typically occurs due to incorrect character escaping in the JIL definition or insufficient permissions in the AWS IAM Trust Policy.

Environment

• Autosys Workload Automation AE 12.X, 24.X
• Workload Automation Agent 12.X, 24.X
• AWS Glue Plugin Extension

Resolution

Scenario 1: Invalid Json Error If the job fails with java.lang.reflect.InvocationTargetException or Invalid Json, it is often because backslashes are being treated as literal characters.

1. Wrap the entire glue.Payload value in double quotes.
2. Remove backslash escapes from colons (:) and commas (,).
3. Only escape internal double quotes (\").

Correct JIL Snippet:

j2ee_parameter: glue.Payload="{\"JobName\":\"your_glue_job\",\"Arguments\":{\"--dbname\":\"your_db\"}}"

Scenario 2: 403 Forbidden Error If the job fails with Unable to make AWS call for AssumeRole: 403 - Forbidden, the IAM Role being assumed does not trust the IAM User providing the credentials.

1. Identify the ARN of the IAM User associated with the AccessKey in your JIL.
2. In the AWS IAM Console, edit the Trust Relationship for the target Role.
3. Add the IAM User to the Principal block of the Trust Policy:

json

 

{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::####:user/YOUR_AUTOSYS_USER"      },      "Action": "sts:AssumeRole"    }  ]}

Additional Information

For more information on job definitions, see the AWS Glue Plugin Extension Documentation.

If you require further assistance, please see Contact Broadcom Support.