User-defined worker role

Create a new managed policy

To create a new managed policy, complete the following tasks:

Create the policy that the connector requires. Name the policy
data_source_access_policy
. For information about connector requirements, see the help for the appropriate connector.
Attach the policy
data_source_access_policy
to both the Secure Agent role and worker role.

Reuse the IAM policy

staging_log_access_worker_policy

To reuse the IAM policy

staging_log_access_worker_policy

that is attached to the worker role, complete the following tasks:

Specify the data sources in the Resource elements.
For example, the Resource element in the following statement specifies the staging and log locations:
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-staging-dir1>/*",
                "arn:aws:s3:::<cluster-logging-dir1>/*"
            ]
        }
Below
"arn:aws:s3:::<cluster-logging-dir1>/*"
, add the data sources.
Add the Secure Agent role to the trust relationship of the worker role.
Add the worker role to the trust relationship of the Secure Agent role.

Default worker role

Create the policy that the connector requires. Name the policy
data_source_access_policy
. For information about connector requirements, see the help for the appropriate connector.
Attach the policy
data_source_access_policy
to the Secure Agent role. The Secure Agent will automatically pass the policy to the worker role.