ETL Connector not loading in aws

When Glue job tried using connector, it has to download the connector in the form of container. The containers for connectors are available in amazon public ECR repo. To pull the container from the AWS public repo, we have to add "AmazonEC2ContainerRegistryFullAccess" policy to your IAM role. We can limit the access to read only as well.

I've come around this in an organizational setting trying to use the BigQuery Markertplace connector. I was explicitly denied to GetAuthorizationToken on non eu regions. Hence, the Glue Job will fail in a similar way as describes by OP because it tries to download the docker image on run from here: https://709825985650.dkr.ecr.us-east-1.amazonaws.com/amazon-web-services/glue/bigquery:0.22.0-glue3.0-2

A possible workaround is to push a copy of the image to your private ECR. Then, when creating the GLUE connection, set CONNECTOR_URL in its connection_properties to your private ECR url. This will solve similar issues. Also, this seems more reasonable then adding wide reaching policies like AmazonEC2ContainerRegistryFullAccess (as suggested by Sparkian) to a role. You'll be able to give granular access permissions on this specific ECR repo instead.

/e: If AmazonEC2ContainerRegistryFullAccess solves your issue, you can also use AmazonEC2ContainerRegistryReadOnly instead. This will be more restrictive in the permissions you add and achieve the same. It's also described in this AWS Marketplace connector troubleshooting guide

This could very likely be a permissions issue. I was running into it and temporarily gave looser permissions, which seemed to resolve it.

I was also facing the same issue with Glue3.0.

Error log was:

Glue ETL Marketplace - Requesting ECR authorization token for registryIds=709825985650 and region_name=us-east-1.
...
...
socket.timeout: timed out
...
...
(<botocore.awsrequest.AWSHTTPSConnection object at 0x7f1136778a90>, 'Connection to api.ecr.us-east-1.amazonaws.com timed out. (connect timeout=60)')

...

botocore.exceptions.ConnectTimeoutError: Connect timeout on endpoint URL: "https://api.ecr.us-east-1.amazonaws.com/"
Glue ETL Marketplace - failed to download connector, activation script exited with code 1
LAUNCH ERROR | Glue ETL Marketplace - failed to download connector.Please refer logs for details.

I was able to solve this by adding AmazonEC2ContainerRegistryFullAccess to the service role, along with the following policy to get a random password. My guess is that when it tries to pull the ECR image, it needs to generate some random password for the time being.

I also added this IAM policy to IAM Role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "secretsmanager:GetRandomPassword",
            "Resource": "*"
        }
    ]
}

And then it worked.

I have this issue with the GCP BigQuery connector. Some jobs are able to run the connector, some aren't. All have the same permissions and settings. There seems to be an issue after requesting the ECR Authorization Token where the request times out.