Advanced Clusters

Back Next

Master and worker policy restriction reference

You can restrict resources in the master and worker policies to limit the resources that the master and worker nodes can access.

You can restrict the following elements depending on their values:

Resource elements with the value *: If the value for a Resource element is the wildcard
*
, you cannot restrict the resources.

For example, the generated policy for the master node might have the following statement:

{ "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVolumes" ], "Resource": [ "*" ] },

Because the value for the Resource element is the wildcard
*
, you cannot edit the Resource element.

If you edit a Resource element whose value is the wildcard
*
, the Secure Agent might fail to identify the required resources to start an
advanced cluster
and the cluster might not start properly.

If you encrypt staging data and log files using SSE-KMS, you can edit the resources in the statement that contains actions on AWS Key Management Service (KMS) even though the Resource element is the wildcard
*
. For more information, see Encrypt staging data and log files at rest (optional).
Resource elements without the value *: If the value for a Resource element is not the wildcard
*
, you can restrict the Resource element to specify the resources that the statement covers.

For example, a generated policy for the worker node might have the following statement:
{ "Effect": "Allow", "Action": [ "s3:Get*" ], "Resource": [ "arn:aws:s3:::<cluster-staging-dir1>/*", "arn:aws:s3:::<cluster-staging-dir2>/*" ] },

Because the value for the Resource element is not the wildcard
*
, you can edit the resources in the statement. In this example, you can restrict the Resource element to the S3 resources that define one or more staging locations.

You can provide staging, log, and initialization script locations for multiple
advanced clusters
to share the same policy content between clusters that use different
advanced configurations
.

To avoid cross-region data-transfer costs, use S3 buckets that are in the same region. To help you manage each bucket, use different buckets for staging locations, log locations, initialization scripts, and data sources.

Rename Saved Search

Table of Contents

Advanced Clusters

Advanced Clusters

Master and worker policy restriction reference

Master and worker policy restriction reference