Advanced Clusters

Back Next

Learn about roles and policies in the AWS environment

The Secure Agent and the

advanced cluster

use IAM roles and the IAM policies that you attach to those roles to access and process data in an AWS environment. For example, the agent and the cluster use the roles to manage cloud resources such as EC2 instances and to access data on S3 like staging, log, and initialization script files.

Roles

An AWS environment uses the following IAM roles:

Cluster operator role: The cluster operator role is an IAM role that has elevated permissions to manage the cloud resources that host an
advanced cluster
.
Secure Agent role: The Secure Agent role is an IAM role for the Secure Agent. This IAM role is attached to the Secure Agent machine which is the Amazon EC2 instance where the Secure Agent runs.

The Secure Agent uses the Secure Agent role to assume the cluster operator role to manage an
advanced cluster
. The Secure Agent also uses the Secure Agent role to process jobs and access some resources on the cloud.
Master role: The master role is an IAM role that defines the permissions for the master nodes in an
advanced cluster
.
Worker role: The worker role is an IAM role that defines the permissions for the worker nodes in an
advanced cluster
.

For more information about the roles, see Step 7. Create IAM roles.

Policies

Each IAM role uses one or more IAM policies.

The following table describes the policies and the roles that use each policy:

Policy	Used by role	Description
cluster_operator_policy	Cluster operator role	Required. Provides the minimal access permissions to create and manage cloud resources for an advanced cluster .
assume_role_agent_policy	Secure Agent role	Required. Allows the Secure Agent to use the Secure Agent role to assume the cluster operator role.
data_source_access_policy	Secure Agent role Worker role	Required if you use role-based security for Amazon data sources and want to create a unique policy. Provides access to the Amazon data sources in an advanced job .
log_access_agent_policy	Secure Agent role	Required if you do not configure a trust relationship between the Secure Agent role and worker role. Provides access to the log location to upload the agent job log at the end of an advanced job .
minimal_master_policy	Master role	Required. Provides the minimal access permissions for the master role.
staging_log_access_master_policy	Master role	Required. Provides access to the staging and log locations.
init_script_master_policy	Master role	Required only if you use an initialization script. Provides access to the initialization script path and the location that stores init script and cloud-init logs.
minimal_worker_policy	Worker role	Required. Provides the minimal access permissions for the worker role.
ebs_autoscaling_worker_policy	Worker role	Required only if EBS volumes auto-scale. Provides permissions to auto-scale the EBS volumes.
staging_log_access_worker_policy	Worker role	Required. Provides access to the staging and log locations.
init_script_worker_policy	Worker role	Required only if you use an initialization script. Provides access to the initialization script path and the location that stores init script and cloud-init logs.

Rename Saved Search

Table of Contents

Advanced Clusters

Advanced Clusters

Learn about roles and policies in the AWS environment

Learn about roles and policies in the AWS environment

Roles

Policies