What is the "DataAccessRoleArn" for Comprehend in boto 3?

Question

I am using boto3's interface for AWS Comprehend for sentiment analysis.

I have an issue with the 'DataAccessRoleArn' parameter. What kind of value is inserted in this? I am requesting for the format of it or some sample.

Have you checked the [boto3 docs for Comprehend](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/comprehend.html)? — Gino Mempin, Jan 07 '20 at 04:54
@GinoMempin yes I have, probably looked everywhere but I am still not getting it right — ANKIT BISHT, Jan 07 '20 at 05:03
IMPORTANT NOTE TO ALL ANSWERERS: there's about 99% likelihood that the asker of this question is confronted with the hurdle, "this thing is asking me to give it a magic string and I don't have the slightest idea how to obtain it". A string of technical gobbledygook like "the IAM role that grants Amazon Comprehend read access to your input data" is completely useless as an answer in this situation. — Szczepan Hołyszewski, Jan 13 '22 at 14:38

score 2 · Answer 1 · answered Jan 09 '20 at 13:06

I'm answering to provide a more complete reference.

From the boto3 docs on Comprehend, the DataAccessRoleArn is a string described as:

DataAccessRoleArn (string) --
[REQUIRED]

The Amazon Resource Name (ARN) of the AWS Identity and Management (IAM) role that grants Amazon Comprehend read access to your input data.

From the AWS IAM ARNs reference, ARNs are of the form:

arn:partition:service:region:account:resource

For IAM roles, this usually are of the form:

arn:aws:iam::123456789012:role/<role name>

where `region` is left blank for IAM resources
  and `123456789012` is the AWS account ID

To get your ARN, you can simply login to your IAM console, and open the page of the role that includes the Comprehend policy. Here's a screenshot (taken from the AWS docs):

Or, if you are using AWS CLI, you can also use the get-role command to get information about an IAM role (including the ARN):

$ aws iam get-role --role-name Test-Role
{
    "Role": {
        "Description": "Test Role",
        ...
        "Arn": "arn:aws:iam::123456789012:role/Test-Role"
    }
}

Sudarshan Rampuria · Answer 2 · 2020-01-07T05:20:41.690

1

For DataAccessRoleArn you should add the arn of iam role you want to assign. You can find the arn in IAM page inside roles and after selecting the role you will find the role arn.

The format of the role arn is:

arn:aws:iam::<account_number>:role/<role_name>

edited Jan 07 '20 at 05:20

answered Jan 07 '20 at 05:09

Sudarshan Rampuria

287
1
8

score -1 · Accepted Answer · answered Jan 07 '20 at 05:16

Adding to above answer yes it requires ARN of the IAM role that grants Amazon Comprehend read access to your input data.

But the ARN should be in below format with account number and which is not an unique id:

arn:aws:iam::<account number>:role/<role_name>

What is the "DataAccessRoleArn" for Comprehend in boto 3?

3 Answers3