Advanced Clusters

Back Next

Create a storage role on AWS

If the self-service cluster is on AWS, create an IAM role that can access the staging and log locations and associate it with the Kubernetes user-managed service account.

On Amazon EKS, you can add the storage role to the instance profiles of the cluster nodes, or you can attach the role to the service account that you assign to Informatica.

For instructions about creating an IAM role, refer to the AWS documentation. AWS provides several ways to create an IAM role, such as using the AWS Management Console or the AWS CLI.

In AWS, create an IAM role named storage_role.

Create the following IAM policy with the name storage_policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetEncryptionConfiguration",
        "s3:ListBucket",
        "s3:PutObject",
        "s3:GetObjectAcl",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:PutObjectAcl"
      ],
      "Resource": [
        "arn:aws:s3:::<cluster staging dir1>/*",
        "arn:aws:s3:::<cluster logging dir1>/*"
      ]
    }
  ]
}

Replace

and

with your staging and log locations, respectively. To accommodate S3 locations that change frequently, you can use wildcard characters. For more information, refer to the AWS documentation.

Attach the IAM policy storage_policy to the IAM role storage_role.

Configure the trust relationship for the storage role to include the Secure Agent role that's attached to the Secure Agent machine.

Because the Secure Agent needs to assume the storage role, the storage role needs to trust the Secure Agent.

Edit the trust relationship of the IAM role storage_role and specify the following IAM policy:

{
      "Version": "2012-10-17",
      "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            },
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::{{account-id}}:role/agent_role"
              },
              "Action": "sts:AssumeRole",
            }
        ]
    }

The value in the Principal element is the ARN of the Secure Agent role.

Optionally, you can configure an external ID to allow only the Secure Agent to assume the storage role.

For example, you can configure the external ID "123" using the following policy:

{
      "Version": "2012-10-17",
      "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            },
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::{{account-id}}:role/agent_role"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalId": "123"
                }
              }
            }
        ]
  }

Rename Saved Search

Table of Contents

Advanced Clusters

Advanced Clusters

Create a storage role on AWS

Create a storage role on AWS