Advanced Clusters

Back Next

Create master policies

Create IAM policies for the master role. You can define each policy as an inline policy or a managed policy.

The following table describes each IAM policy:

Policy	Description
minimal_master_policy	Required. Provides the minimal access permissions for the master role.
staging_log_access_master_policy	Required. Provides access to the staging and log locations.
init_script_master_policy	Required only if you use an initialization script. Provides access to the initialization script path and the location that stores init script and cloud-init logs.

For information about each permission and why it's required, see IAM policy reference. For information about editing the policies, see Master and worker policy restriction reference.

You can also generate the policy content by running the

generate-policies-for-userdefined-roles.sh

command. For more information about the command, see generate-policies-for-userdefined-roles.sh. The command creates the output file my-userdefined-master-worker-role-policies.json.

minimal_master_policy

The IAM policy

minimal_master_policy

lists the minimal requirements for the user-defined master role.

You can use the following JSON document as a template for the

minimal_master_policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeRegions",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVolumes"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcs",
                "ec2:CreateTags",
                "ec2:CreateVolume",
                "ec2:DescribeVolumesModifications",
                "ec2:ModifyInstanceAttribute",
                "ec2:ModifyVolume"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AttachVolume", // If enabling CLAIRE, move AttachVolume to the same section as CreateVolume.
                "ec2:DeleteVolume",
                "ec2:DetachVolume"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringLike": {
                    "ec2:ResourceTag/KubernetesCluster": "*.k8s.local"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeLaunchConfigurations",
                "autoscaling:DescribeAutoScalingInstances",
                "autoscaling:DescribeTags",
                "autoscaling:DescribeScalingActivities"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:SetDesiredCapacity",
                "autoscaling:TerminateInstanceInAutoScalingGroup",
                "autoscaling:UpdateAutoScalingGroup"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringLike": {
                    "autoscaling:ResourceTag/KubernetesCluster": "*.k8s.local"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticloadbalancing:AddTags",
                "elasticloadbalancing:AttachLoadBalancerToSubnets",
                "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
                "elasticloadbalancing:ConfigureHealthCheck",
                "elasticloadbalancing:DeleteLoadBalancer",
                "elasticloadbalancing:DeleteLoadBalancerListeners",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeLoadBalancerAttributes",
                "elasticloadbalancing:DetachLoadBalancerFromSubnets",
                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                "elasticloadbalancing:ModifyLoadBalancerAttributes",
                "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringLike": {
                    "elasticloadbalancing:ResourceTag/KubernetesCluster": "*.k8s.local"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticloadbalancing:AddTags",
                "elasticloadbalancing:DeleteListener",
                "elasticloadbalancing:DeleteTargetGroup",
                "elasticloadbalancing:DeregisterTargets",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancerPolicies",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeTargetHealth",
                "elasticloadbalancing:ModifyListener",
                "elasticloadbalancing:ModifyTargetGroup",
                "elasticloadbalancing:RegisterTargets",
                "elasticloadbalancing:SetLoadBalancerPoliciesOfListener"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringLike": {
                    "elasticloadbalancing:ResourceTag/KubernetesCluster": "*.k8s.local"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:ListServerCertificates",
                "iam:GetServerCertificate"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:Get*"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-staging-dir1>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

staging_log_access_master_policy

The IAM policy

staging_log_access_master_policy

provides access to the staging and log locations.

You can use the following JSON document as a template for the

staging_log_access_master_policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetEncryptionConfiguration",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-staging-bucket-name1>",
                "arn:aws:s3:::<cluster-logging-bucket-name1>"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-staging-dir1>/*",
                "arn:aws:s3:::<cluster-logging-dir1>/*"
            ]
        }
    ]
}

init_script_master_policy

The IAM policy

init_script_master_policy

is required by the Cluster Computing System to allow the master node to access the initialization script and init script logging directories for the cluster.

You can use the following JSON document as a template for the

init_script_master_policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-init-script-bucket-name1>"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-init-script-dir1>/*"
                
            ]
        }
    ]
}

Rename Saved Search

Table of Contents

Advanced Clusters

Advanced Clusters

Create master policies

Create master policies

minimal_master_policy

staging_log_access_master_policy

init_script_master_policy