Advanced Clusters

Back Next

Configure permissions for AWS

In an AWS environment, configure IAM roles for the Secure Agent and cluster operator.

Complete the following steps:

In AWS, create an IAM role named agent_role and attach it to the Amazon EC2 instance where the Secure Agent is installed. Alternatively, you can designate an existing IAM role to be the Secure Agent role.

For instructions about creating an IAM role, refer to the AWS documentation. AWS provides several ways to create an IAM role, such as using the AWS Management Console or the AWS CLI.

In AWS, create an IAM role for the cluster operator named cluster_operator_role.

Create the following IAM policy with the name cluster_operator_policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetEncryptionConfiguration",
        "s3:ListBucket",
        "s3:PutObject",
        "s3:GetObjectAcl",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:PutObjectAcl"
      ],
      "Resource": [
        "arn:aws:s3:::<cluster-staging-dir1>/*",
        "arn:aws:s3:::<cluster-logging-dir1>/*"
      ]
    }
  ]
}

Replace <cluster-staging-dir1>
and <cluster-logging-dir1>
with your staging and log locations, respectively. To accommodate S3 locations that change frequently, you can use wildcard characters. For more information, refer to the AWS documentation.

Attach the IAM policy cluster_operator_policy to the IAM role cluster_operator_role.

Configure the trust relationship for the cluster operator role to include the Secure Agent role. Because the Secure Agent needs to assume the cluster operator role, the cluster operator role needs to trust the Secure Agent.

Edit the trust relationship of the IAM role cluster_operator_role and specify the following IAM policy:

{
      "Version": "2012-10-17",
      "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            },
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::{{account-id}}:role/agent_role"
              },
              "Action": "sts:AssumeRole",
            }
        ]
    }

The value in the Principal element is the ARN of the Secure Agent role.

Optionally, you can configure an external ID to allow only the Secure Agent to assume the cluster operator role.

For example, you can configure the external ID "123" using the following policy:

{
      "Version": "2012-10-17",
      "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            },
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::{{account-id}}:role/agent_role"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalId": "123"
                }
              }
            }
        ]
  }

Rename Saved Search

Table of Contents

Advanced Clusters

Advanced Clusters

Configure permissions for AWS

Configure permissions for AWS