Advanced Clusters

Back Next

Create role-based security policies for Amazon data sources (optional)

Role-based security uses IAM roles to access data sources. If a connector directly accesses AWS, such as Amazon S3 V2 Connector or Amazon Redshift V2 Connector, create policies to allow the Secure Agent and worker roles to have access to data sources and fine-tune their permissions in your AWS environment.

You can skip this step if you use connectors that don't have direct access to AWS. For example, JDBC V2 Connector uses a driver to query data on Amazon Aurora and does not directly access the underlying data.

If you're looking for a quick setup, you can use credential-based security. For more information, see Use credential-based security (alternative).

Complete the following tasks:

Create policies for the Secure Agent and worker roles.

Optionally, configure cross-account access.

By default, the agent and worker roles access data sources, but you can specify an IAM role at the connection level to access the data sources instead of using the agent and worker roles.

If you use default master and worker roles, consider the following guidelines:

If you edit the Secure Agent role, you must restart the agent to update the master and worker roles.

The default worker role doesn't honor the permission boundaries for the Secure Agent role.

The staging location, log location, and cluster operator role must be in the same AWS account.

Step 7. Create IAM roles

Step 10.1. Create policies for the Secure Agent and worker roles

Step 10.2. Configure cross-account access (optional)

Use credential-based security (alternative)

Download Guide

Watch

Comments

Communities