Table of Contents

Search

  1. Preface
  2. Advanced clusters
  3. Setting up AWS
  4. Setting up Google Cloud
  5. Setting up Microsoft Azure
  6. Setting up a self-service cluster
  7. Setting up a local cluster
  8. Advanced configurations
  9. Troubleshooting
  10. Appendix A: Command reference

Advanced Clusters

Advanced Clusters

Step 10.1. Create policies for the Secure Agent and worker roles

Step 10.1. Create policies for the Secure Agent and worker roles

Create policies to allow the Secure Agent and worker roles to access Amazon data sources in an
advanced job
. Create and distribute the policies based on the worker role type.

User-defined worker role

If you create a user-defined worker role, you can provide access to the data sources in one of the following ways:
Create a new managed policy
To create a new managed policy, complete the following tasks:
  1. Create the policy that the connector requires. Name the policy
    data_source_access_policy
    . For information about connector requirements, see the help for the appropriate connector.
  2. Attach the policy
    data_source_access_policy
    to both the Secure Agent role and worker role.
Reuse the IAM policy
staging_log_access_worker_policy
To reuse the IAM policy
staging_log_access_worker_policy
that is attached to the worker role, complete the following tasks:
  1. Specify the data sources in the Resource elements.
    For example, the Resource element in the following statement specifies the staging and log locations:
    { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObjectAcl", "s3:GetObject", "s3:DeleteObject", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::<cluster-staging-dir1>/*", "arn:aws:s3:::<cluster-logging-dir1>/*" ] }
    Below
    "arn:aws:s3:::<cluster-logging-dir1>/*"
    , add the data sources.
  2. Add the Secure Agent role to the trust relationship of the worker role.
  3. Add the worker role to the trust relationship of the Secure Agent role.

Default worker role

If you use the default worker role, complete the following tasks:
  1. Create the policy that the connector requires. Name the policy
    data_source_access_policy
    . For information about connector requirements, see the help for the appropriate connector.
  2. Attach the policy
    data_source_access_policy
    to the Secure Agent role. The Secure Agent will automatically pass the policy to the worker role.

0 COMMENTS

We’d like to hear from you!