Generated banner for Ingesting Into Data Lake
Generated logo for Ingesting Into Data Lake

Ingesting Into Data Lake

AWSOfficialPublished by AWS

  • Skill
  • Workflow
  • Data and AI
  • Apache-2.0
  • Low risk

From the author

Import data into the AWS data lake from S3 files, local uploads, JDBC databases (Oracle, SQL Server, PostgreSQL, MySQL, RDS, Aurora), Amazon Redshift, Snowflake, BigQuery, DynamoDB, or existing Glue catalog tables (migration). Default target is S3 Tables; standard Iceberg on a general purpose bucket is supported where S3 Tables is not adopted. Handles one-time loads, recurring pipelines, migrations. Triggers on: import data, load data, ingest, sync database, migrate table, move data to AWS, set up pipeline, ETL, pull from Snowflake, query BigQuery into S3, export DynamoDB, CTAS, convert to Iceberg. Do NOT use for setting up or troubleshooting Glue connections (use connecting-to-data-source), creating empty tables (use creating-data-lake-table), running queries (use querying-data-lake), finding tables by fuzzy name (use finding-data-lake-assets), catalog audit (use exploring-data-catalog), or SaaS platforms like Salesforce, ServiceNow, SAP, MongoDB, Kafka.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured workflow for importing data from various sources—including JDBC databases, cloud warehouses like Snowflake and BigQuery, DynamoDB, and S3 files—into an AWS data lake. It prioritizes modern S3 Tables or standard Iceberg formats, ensuring data is queryable and well-structured. The skill guides users through connection verification, target configuration, and validation, while delegating complex setup tasks to specialized sub-skills.

What it does

  • Imports data from JDBC databases, cloud warehouses, and S3 into a data lake
  • Supports one-time loads, recurring ETL pipelines, and catalog migrations
  • Configures target tables using S3 Tables or standard Iceberg formats
  • Validates data integrity via row counts, null checks, and sample verification
  • Automates scheduling for recurring ingestion tasks using Glue triggers
  • Provides clear delegation paths for connection setup and table creation

When to use it

  • When you need to move data from an external database or cloud service into your AWS data lake
  • When setting up a new recurring ETL pipeline for data synchronization
  • When migrating existing Hive-style tables to modern Iceberg formats
  • When you need to perform a one-time bulk load of files from S3 or local storage

Advantages

  • Standardizes ingestion patterns across multiple source types
  • Ensures data quality through built-in validation steps
  • Promotes modern data lake practices by defaulting to S3 Tables and Iceberg
  • Reduces configuration errors by enforcing connection verification before execution

Usage examples

“Import the customers table from our Oracle database into the data lake.”
The agent verifies the existing JDBC connection, confirms the target S3 Tables configuration, and initiates a Glue ETL job to migrate the data.
“Set up a recurring pipeline to pull data from BigQuery into S3.”
The agent configures a Glue job with the necessary BigQuery connection, sets up the target Iceberg table, and creates a Glue trigger for scheduled execution.
“Convert our existing Hive tables to Iceberg.”
The agent performs a catalog migration, updating the table metadata to Iceberg format while maintaining data accessibility.
“Load these local CSV files into the data lake.”
The agent guides the user through the local upload process and maps the data into a queryable S3 Tables format.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/aws/ingesting-into-data-lake/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip ingesting-into-data-lake.zip -d .agents/skills

Documentation by AWS

Ingest into Data Lake

Move data from a source into a queryable table in the data lake. This skill assumes the source connection (if one is needed) already exists. For Glue connection setup or troubleshooting, delegate to connecting-to-data-source.

Philosophy

Default to S3 Tables unless the environment says otherwise. S3 Tables is the recommended target for new data lake work. If the user's catalog inventory shows they haven't adopted S3 Tables, recommend standard Iceberg on their existing general-purpose bucket instead of forcing them to change posture.

Common Tasks

You MUST execute commands using AWS MCP server tools when connected -- they provide validation, sandboxed execution, and audit logging. Fall back to AWS CLI only if MCP is unavailable. You MUST explain each step before executing.

Workflow

1. Verify Dependencies and Context
  • You MUST check whether AWS MCP tools or AWS CLI are available and inform the user if missing

  • You MUST confirm target AWS region and verify credentials with aws sts get-caller-identity

  • For SageMaker Unified Studio project roles, note that target tables and connections may be scoped to the project. See the caller ARN detection pattern in querying-data-lake.

2. Classify the Source
User says...Source typeReference
"upload my file", "local CSV", "move to S3"Local filelocal-upload.md
"load from S3", "import CSV/JSON/Parquet from s3://"S3 filess3-files.md
"import from Oracle/Postgres/MySQL/SQL Server/Redshift/RDS/Aurora"JDBCjdbc-ingest.md
"pull from Snowflake", "Snowflake table to S3"Snowflakesnowflake-ingest.md
"import from BigQuery", "GCP analytics to S3"BigQuerybigquery-ingest.md
"export DynamoDB", "DynamoDB to data lake"DynamoDBdynamodb-ingest.md
"migrate Glue table", "convert Hive to Iceberg"Catalog migrationcatalog-migration.md

If the user names Salesforce, ServiceNow, SAP, MongoDB, Kafka, or another SaaS/streaming source, decline -- these are not supported in this release.

If the source table is referenced by a fuzzy or business name ("migrate our orders table", "pull from the sales warehouse"), delegate to finding-data-lake-assets to resolve before proceeding.

3. Confirm Connection Exists (if applicable)

For JDBC, Snowflake, and BigQuery sources, a Glue connection is required. Check:

aws glue get-connection --name <CONNECTION_NAME> --region <REGION>

If the connection does not exist, stop and delegate to connecting-to-data-source to create and test it. Do not proceed with ingest until the connection is verified.

Local files, S3 files, DynamoDB, and catalog migration do not need a Glue connection.

4. Clarify the Target

You MUST ask the user (or suggest based on catalog inventory) before creating or writing to any table:

  • Database/namespace: Does a specific target database exist? Or should one be created?

  • Table: Existing table (append/merge) or new table (delegate to creating-data-lake-table)?

  • Format: S3 Tables (default), standard Iceberg, or raw Parquet?

Inventory-aware defaults:

If you have already run exploring-data-catalog or can quickly check, use what exists:

  • Account has an s3tablescatalog federated catalog and active table buckets: recommend S3 Tables

  • Account has general-purpose buckets with Iceberg tables and no S3 Tables usage: recommend standard Iceberg on their existing bucket

  • Account uses Parquet/ORC on S3 without Iceberg metadata: ask whether to adopt Iceberg now (recommend yes) or continue with raw files

Do not force S3 Tables on customers who haven't adopted it. See iceberg-catalog-config-and-usage.md.

Delegations from this step:

  • Target table doesn't exist -> creating-data-lake-table

  • Target database named by fuzzy term -> finding-data-lake-assets

  • User doesn't know what exists -> exploring-data-catalog

5. Execute Source Workflow

Read the source-specific reference and follow its phases. Each is self-contained with job templates, gotchas, and troubleshooting:

  • Local / S3 / JDBC / Snowflake / BigQuery / DynamoDB / catalog migration -- one reference per source

Common Glue 5.1 or higher job configuration and PySpark templates are shared in glue-job-config.md and glue-job-scripts.md.

6. Validate

Run all three, do not skip:

  1. Row count matches expected (source vs target)

  2. Null check on critical columns

  3. Spot-check 3-5 sample rows

See data-quality-validation.md.

7. Schedule (if recurring)

For recurring pipelines, create a Glue Trigger with a cron schedule. See testing-and-scheduling.md. Simple single-step pipelines use Glue Triggers; multi-step with branching uses MWAA.

Argument Routing

  • S3 path only: Infer one-time load, start Step 2 with S3 files

  • Connection name: Start Step 3 with the named connection

  • Table name: Start Step 4, ask whether this is source or target

  • --target flag: Pre-fill the target format in Step 4

  • No args: Walk through interactively

Gotchas

  • S3 Tables requires Glue 5.1 or higher and --datalake-formats iceberg job argument

  • All spark.sql.catalog.* config MUST go in --conf job arguments, never in spark.conf.set(). Glue 5.x throws AnalysisException: Cannot modify the value of a static config otherwise. See iceberg-catalog-config-and-usage.md for correct catalog configs.

  • The warehouse parameter is required in S3 Tables catalog config. Without it Spark fails with "Cannot derive default warehouse location".

  • Table and column names in S3 Tables MUST be all lowercase

  • overwritePartitions() only replaces partitions present in the DataFrame -- for full refresh with deletes, use createOrReplace()

  • Standard Iceberg targets MUST include a LOCATION clause; S3 Tables MUST NOT

  • DynamoDB does not need a Glue connection -- do not attempt to create one

  • Connection failures during ingest delegate back to connecting-to-data-source; do not debug network/credentials in this skill

  • For target tables in SageMaker Unified Studio projects, ensure the project role has write access to the target namespace before the Glue job runs

Troubleshooting

ErrorLikely causeAction
Access Denied on S3Missing IAM permissionsCheck Glue role has s3:GetObject, s3:PutObject
Access Denied on S3 TablesMissing s3tables:* permissionsAdd S3 Tables inline policy to Glue role
CTAS timeoutDataset too large for AthenaSwitch to Glue ETL or batch with WHERE filters
JDBC connection timeout/auth failureConnection-level issueDelegate to connecting-to-data-source
Throughput exceeded (DynamoDB)Read percent too highLower read.percent or use native export

See error-handling.md for the full catalog.

References

Source-specific
Cross-cutting
Migration-specific
JDBC-specific

Files

references/testing-and-scheduling.md

Testing and Scheduling Guide

Complete guide for testing Glue ETL jobs, validating data loads, and setting up recurring schedules for external data import pipelines.

Overview

After creating a Glue ETL job, you must:

  1. Test the job - Run manually to verify it works

  2. Validate data - Confirm data loaded correctly into target table

  3. Schedule the job - Set up recurring execution (for ongoing pipelines)

  4. Monitor execution - Track job runs and handle failures

Testing the Job

Run the Job Manually

Before scheduling, run the job once to validate the entire workflow.

JOB_RUN_ID=$(aws glue start-job-run \
  --job-name "external-import-<source>-<table>" \
  --region <region> \
  --query 'JobRunId' --output text)

echo "Job run started: $JOB_RUN_ID"
Monitor Job Execution

Check job status and logs:

# Get job run status
aws glue get-job-run \
  --job-name "external-import-<source>-<table>" \
  --run-id "$JOB_RUN_ID" \
  --region <region>

# Check if job succeeded
STATUS=$(aws glue get-job-run \
  --job-name "external-import-<source>-<table>" \
  --run-id "$JOB_RUN_ID" \
  --query 'JobRun.JobRunState' \
  --output text)

echo "Job status: $STATUS"

Job states:

  • STARTING - Job is initializing

  • RUNNING - Job is executing

  • SUCCEEDED - Job completed successfully

  • FAILED - Job failed (check logs for errors)

  • TIMEOUT - Job exceeded timeout limit

  • STOPPED - Job was manually stopped

View CloudWatch Logs

Glue streams logs to CloudWatch Logs:

# Get log stream name
LOG_STREAM=$(aws glue get-job-run \
  --job-name "external-import-<source>-<table>" \
  --run-id "$JOB_RUN_ID" \
  --query 'JobRun.LogGroupName' \
  --output text)

# Tail logs
aws logs tail /aws-glue/jobs/output --follow \
  --log-stream-names "<job-name>-<run-id>" \
  --region <region>

Key log messages to look for:

  • Last watermark: <value> - Starting point for incremental load

  • Loading X new/updated records - Number of records found

  • Updated watermark to: <value> - New watermark after successful load

  • Successfully loaded X records - Confirmation of append/upsert

  • ERROR or Exception - Errors that caused failure

Common Issues During Testing
Connection Timeouts

Symptom: Job fails with "Connection timeout" or "Unable to connect to database"

Causes:

  • VPC/subnet configuration incorrect

  • Security groups blocking traffic

  • Database firewall rules

  • Network ACLs blocking Glue's IP ranges

Solution:

  1. Test connection in Glue console: Connections → Select connection → Test

  2. Verify security groups allow inbound from Glue's security group

  3. Check database firewall allows connections from Glue subnet CIDR

  4. Ensure NAT gateway/internet gateway for outbound connectivity (if needed)

Authentication Failures

Symptom: "Access denied" or "Invalid username/password"

Causes:

  • Incorrect credentials in connection

  • Password expired

  • Database user lacks required permissions

  • IP-based restrictions on database user

Solution:

  1. Verify credentials by connecting manually (e.g., via SQL client)

  2. Check database user has SELECT permission on source tables

  3. Ensure user is allowed from Glue's IP/subnet

  4. For AWS Secrets Manager: verify secret ARN and IAM permissions

Schema Mismatches

Symptom: "Type mismatch" or "Cannot cast X to Y"

Causes:

  • Source column type incompatible with target schema

  • Source column is NULL but target doesn't allow NULL

  • Decimal precision/scale mismatch

Solution:

  1. Add explicit type casting in PySpark script

  2. Use .cast("string") as fallback for problematic columns

  3. Add NULL handling: when(col("x").isNotNull(), col("x")).otherwise(default_value)

  4. Update target schema to match source types more closely

Performance Issues

Symptom: Job runs slowly or times out

Causes:

  • Source database query is slow (no indexes, full table scan)

  • Too few Glue workers

  • Network bandwidth limitations

  • Reading too much data in single batch

Solution:

  1. Add indexes on watermark column in source database

  2. Increase number of Glue workers

  3. Use parallel reads with numPartitions option

  4. Reduce batch size by using smaller date ranges

  5. Optimize source query (add WHERE clauses, select only needed columns)

Watermark Not Advancing

Symptom: Job runs but no new records loaded, watermark stays same

Causes:

  • No new data in source

  • Watermark column comparison incorrect (timezone issue)

  • Watermark file not updating due to S3 permissions

  • Filter logic incorrect

Solution:

  1. Verify new data exists in source: Query source directly

  2. Check timezone handling: Convert all timestamps to UTC

  3. Verify Glue job role has S3 write permissions for watermark bucket

  4. Add debug logging: Print watermark values and filter query

Validating Data Load

After the job completes successfully, verify data was loaded correctly.

Check Row Count

Query the target S3 Table to confirm records were written:

-- Count total rows
SELECT COUNT(*) FROM "<catalog>"."<namespace>"."<table>";

Compare with expected count from job logs (e.g., "Successfully loaded X records").

Inspect Latest Records

View the most recently loaded records:

-- Get latest records by watermark column
SELECT *
FROM "<catalog>"."<namespace>"."<table>"
ORDER BY <watermark-column> DESC
LIMIT 10;

Verify:

  • Columns match expected schema

  • Data types are correct

  • Values look reasonable

  • Timestamps are in expected timezone

Verify Watermark Updated

Check that the watermark file was updated:

# Read watermark file from S3
aws s3 cp s3://<bucket>/watermarks/<table-name>.txt -

# Should show the new watermark value matching the job logs
Compare Source and Target

For critical tables, compare aggregations between source and target:

Source (via Glue connection):

SELECT COUNT(*), SUM(amount), MAX(updated_at)
FROM <schema>.<table>
WHERE updated_at > '<last-watermark>';

Target (S3 Table):

SELECT COUNT(*), SUM(amount), MAX(load_timestamp)
FROM "<catalog>"."<namespace>"."<table>"
WHERE load_timestamp >= '<job-start-time>';

Counts and sums should match.

Validate Data Quality

Run basic data quality checks:

-- Check for NULL values in key columns
SELECT COUNT(*) FROM "<catalog>"."<namespace>"."<table>"
WHERE customer_id IS NULL OR email IS NULL;

-- Check for duplicates (if using append instead of upsert)
SELECT customer_id, COUNT(*)
FROM "<catalog>"."<namespace>"."<table>"
GROUP BY customer_id
HAVING COUNT(*) > 1;

-- Check date range
SELECT MIN(order_date), MAX(order_date)
FROM "<catalog>"."<namespace>"."<table>";

For production pipelines, consider using AWS Glue Data Quality rules to automate validation.

Scheduling Recurring Pipelines

Once testing is complete, set up scheduling for ongoing data syncs.

Determine Schedule Frequency

Choose schedule based on data freshness requirements:

Real-time (<1 minute latency):

  • Don't use Glue batch jobs - use AWS DMS, Glue Streaming, or Kinesis instead

Near real-time (5-15 minute latency):

  • Schedule: Every 15 minutes: cron(0/15 * * * ? *)

  • Consider costs - Glue jobs have minimum 1-minute billing

Hourly:

  • Schedule: Top of each hour: cron(0 * * * ? *)

  • Good for: Transaction logs, event streams

Every 6 hours:

  • Schedule: cron(0 */6 * * ? *)

  • Good for: Slowly changing data, reporting tables

Daily:

  • Schedule: 2 AM UTC: cron(0 2 * * ? *)

  • Good for: Dimension tables, reference data

  • Choose off-peak hours to avoid source database load

Weekly:

  • Schedule: Monday at 2 AM: cron(0 2 ? * MON *)

  • Good for: Historical archives, full refreshes

Coordinate with source system:

  • Avoid peak hours when source database is under load

  • Schedule after batch processes complete (if applicable)

  • Consider maintenance windows

Create Glue Trigger

Glue Triggers schedule job execution.

aws glue create-trigger \
  --name "external-import-<table>-schedule" \
  --type SCHEDULED \
  --schedule "cron(0 */6 * * ? *)" \
  --actions JobName="external-import-<source>-<table>" \
  --description "Scheduled sync from <source> to S3 Tables" \
  --start-on-creation \
  --region <region>

Cron expression format:

cron(Minutes Hours Day-of-month Month Day-of-week Year)

Examples:

  • Every 15 minutes: cron(0/15 * * * ? *)

  • Hourly: cron(0 * * * ? *)

  • Every 6 hours: cron(0 */6 * * ? *)

  • Daily at 2 AM UTC: cron(0 2 * * ? *)

  • Weekdays at 6 AM UTC: cron(0 6 ? * MON-FRI *)

  • First day of month at midnight: cron(0 0 1 * ? *)

Start/Stop Triggers

Start a trigger (enable scheduling):

aws glue start-trigger \
  --name "external-import-<table>-schedule" \
  --region <region>

Stop a trigger (disable scheduling):

aws glue stop-trigger \
  --name "external-import-<table>-schedule" \
  --region <region>
View Trigger Status

Check trigger details and recent runs:

aws glue get-trigger \
  --name "external-import-<table>-schedule" \
  --region <region>

Monitoring Scheduled Jobs

CloudWatch Alarms

Set up CloudWatch alarms for job failures:

# Create alarm for job failures
aws cloudwatch put-metric-alarm \
  --alarm-name "glue-job-failure-<table>" \
  --alarm-description "Alert when Glue job fails" \
  --metric-name JobFailure \
  --namespace AWS/Glue \
  --statistic Sum \
  --period 300 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --dimensions Name=JobName,Value="external-import-<source>-<table>" \
  --evaluation-periods 1 \
  --alarm-actions <sns-topic-arn>

Metrics to monitor:

  • glue.driver.aggregate.recordsRead - Records read from source

  • glue.driver.aggregate.elapsedTime - Job duration

  • Job state (SUCCEEDED, FAILED, TIMEOUT)

View Recent Job Runs

List recent executions of a job:

aws glue get-job-runs \
  --job-name "external-import-<source>-<table>" \
  --region <region> \
  --max-results 10
Track Watermark Progression

Monitor how watermark advances over time:

# List watermark history (if versioning enabled on S3 bucket)
aws s3api list-object-versions \
  --bucket <bucket> \
  --prefix watermarks/<table-name>.txt \
  --query 'Versions[*].[LastModified,VersionId]' \
  --output table

Create a Lambda function to log watermark values to CloudWatch Logs after each job run for historical tracking.

Advanced Scheduling Patterns

Conditional Triggers

Run a job only after another job succeeds:

aws glue create-trigger \
  --name "external-import-orders-after-customers" \
  --type CONDITIONAL \
  --actions JobName="external-import-orders" \
  --predicate '{
    "Conditions": [{
      "LogicalOperator": "EQUALS",
      "JobName": "external-import-customers",
      "State": "SUCCEEDED"
    }]
  }' \
  --start-on-creation

Use for:

  • Loading dimension tables before fact tables

  • Ensuring dependencies load in correct order

  • Chaining transformations

Event-Driven Triggers

Trigger job based on EventBridge events:

# Create EventBridge rule to trigger Glue job
aws events put-rule \
  --name "trigger-glue-on-event" \
  --event-pattern '{
    "source": ["aws.s3"],
    "detail-type": ["Object Created"],
    "detail": {
      "bucket": {
        "name": ["source-data-bucket"]
      }
    }
  }'

aws events put-targets \
  --rule "trigger-glue-on-event" \
  --targets "Id=1,Arn=arn:aws:glue:region:account:job/external-import-job"
On-Demand Triggers

Allow users to trigger jobs manually via API/console without scheduling:

# Don't create a trigger, just run the job when needed
aws glue start-job-run \
  --job-name "external-import-<source>-<table>"

Best Practices

Testing
  1. Test connection first - Use Glue console's "Test connection" before creating job

  2. Start small - Test with small data subset or short time window first

  3. Validate thoroughly - Check row counts, data quality, watermark progression

  4. Test failure scenarios - Kill job mid-run to verify watermark isn't corrupted

Scheduling
  1. Start conservatively - Begin with less frequent schedule, increase if needed

  2. Avoid peak hours - Schedule during off-peak times for source database

  3. Set appropriate timeouts - Allow buffer for larger-than-expected data volumes

  4. Use conditional triggers - For dependent jobs, use conditional triggers instead of fixed time delays

Monitoring
  1. Set up CloudWatch alarms - Alert on failures, long durations, no records loaded

  2. Track watermark progression - Ensure watermark advances on each run

  3. Monitor source lag - Compare source max timestamp vs loaded max timestamp

  4. Review logs regularly - Check for warnings, performance issues

Maintenance
  1. Review and adjust schedules - As data volumes change, adjust frequency or worker count

  2. Update scripts in Git - Version control all job scripts

  3. Test script changes in dev - Before deploying to production

  4. Archive old watermarks - Keep historical watermark values for debugging

Summary

Testing and scheduling workflow:

  1. Run job manually - Start job and monitor execution

  2. Check CloudWatch logs - Verify no errors, watermark advanced

  3. Validate data load - Query target table, check row counts, inspect data

  4. Verify watermark - Confirm watermark file updated correctly

  5. Create trigger - Set up scheduled execution with appropriate frequency

  6. Set up monitoring - CloudWatch alarms for failures, duration, data lag

  7. Monitor initial runs - Watch first few scheduled executions closely

With proper testing and monitoring, scheduled Glue jobs provide reliable, automated data pipelines from external databases to S3 Tables.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server, Needs a command-line tool

Security

What our scanner noticed· Low risk

  • Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · plugins/aws-data-analytics/skills/ingesting-into-data-lake · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
aws/agent-toolkit-for-aws

AutoGineer is not affiliated with or endorsed by AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download ingesting-into-data-lake.zip