Table of Contents

Search

  1. Preface
  2. Advanced clusters
  3. Setting up AWS
  4. Setting up Google Cloud
  5. Setting up Microsoft Azure
  6. Setting up a self-service cluster
  7. Setting up a local cluster
  8. Advanced configurations
  9. Troubleshooting
  10. Appendix A: Command reference

Advanced Clusters

Advanced Clusters

Identity and Access Management actions

Identity and Access Management actions

The Identity and Access Management actions apply to all AWS resources.

Instance profiles

The following table describes the actions for instance profiles:
Action
Description
iam:AddRoleToInstanceProfile
Optional if you do not specify master and worker instance profiles.
iam:CreateInstanceProfile
Optional when you provide master and worker roles.
iam:DeleteInstanceProfile
Optional when you provide master and worker roles.
iam:GetContextKeysForPrincipalPolicy
iam:SimulatePrincipalPolicy
Required. Allows permission validation, including
advanced configuration
validation and upgrade validation.
iam:GetInstanceProfile
Required. Retrieves information about the specified instance profile, including the instance profile path, GUID, ARN, and role.
iam:ListInstanceProfiles
Required. Lists the instance profiles that have the specified path prefix.

Roles

The following table describes the actions for IAM roles:
Action
Description
iam:CreateRole
Optional when you provide master and worker roles.
iam:CreateServiceLinkedRole
Required. Creates an IAM role that is linked to a specific AWS service.
iam:DeleteRole
Optional when you provide master and worker roles.
iam:GetRole
Required. Retrieves information about the specified role, including the role path.
iam:ListRolePolicies
Required. Retrieves information about the specified role, including the role path.
am:ListRoles
Required. Retrieves information about the specified role, including the role path.

Policies

The following table describes the actions for IAM policies:
Action
Description
iam:AttachRolePolicy
iam:DeleteRolePolicy
iam:DetachRolePolicy
iam:PutRolePolicy
Optional when you provide master and worker roles.
iam:GetRolePolicy
Required. Retrieves the specified inline policy document that AWS embeds with the specified IAM role.
iam:ListAttachedRolePolicies
Required. Lists all managed policies that are attached to the specified IAM role.
iam:ListInstanceProfilesForRole
Required. Lists the instance profiles that have the associated IAM role.
iam:RemoveRoleFromInstanceProfile
Required. Removes the specified IAM role from the specified EC2 instance profile.

Users

The cluster operator role requires the
iam:GetUser
action to retrieve information about the specified IAM user, including the path, unique ID, and ARN.

0 COMMENTS

We’d like to hear from you!