Advanced Clusters

Back Next

Create worker policies

Create IAM policies for the worker role. You can define each policy as an inline policy or a managed policy.

The following table describes each IAM policy:

Policy	Description
minimal_worker_policy	Required. Provides the minimal access permissions for the worker role.
ebs_autoscaling_worker_policy	Required only if EBS volumes auto-scale.
staging_log_access_worker_policy	Required. Provides access to the staging and log locations.
init_script_worker_policy	Required only if you use an initialization script. Provides access to the initialization script path and the location that stores init script and cloud-init logs.

For information about each permission and why it's required, see IAM policy reference. For information about editing the policies, see Master and worker policy restriction reference.

You can also generate the policy content by running the

generate-policies-for-userdefined-roles.sh

command. For more information about the command, see generate-policies-for-userdefined-roles.sh. The command creates the output file

my-userdefined-master-worker-role-policies.json

minimal_worker_policy

The IAM policy

minimal_worker_policy

lists the minimal requirements for the user-defined worker role.

You can use the following JSON document as a template for the

minimal_worker_policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeRegions"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:DescribeAutoScalingInstances",
                "autoscaling:DescribeTags"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:Get*"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-staging-dir1>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

ebs_autoscaling_worker_policy

The IAM policy

ebs_autoscaling_worker_policy

is required by the worker nodes to auto-scale EBS volumes.

You can use the following JSON document as a template for the

ebs_autoscaling_worker_policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:DescribeVolumes",
                "ec2:CreateVolume",
                "ec2:ModifyInstanceAttribute"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ]
        },
        {
            "Action": [
                "ec2:CreateTags"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:ec2:*:*:volume/*"
            ]
        },
        {
            "Action": [
                "ec2:AttachVolume",
                "ec2:DetachVolume"
            ],
            "Condition": {
                "StringLike": {
                    "ec2:ResourceTag/KubernetesCluster": "*.k8s.local"
                }
            },
            "Effect": "Allow",
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ]
        },
        {
            "Action": [
                "ec2:AttachVolume",
                "ec2:DetachVolume",
                "ec2:DeleteVolume"
            ],
            "Condition": {
                "StringLike": {
                    "ec2:ResourceTag/CREATED_BY": "infa-storage-scalerd-*"
                }
            },
            "Effect": "Allow",
            "Resource": [
                "arn:aws:ec2:*:*:volume/*"
            ]
        }
    ]
}

staging_log_access_worker_policy

The IAM policy

staging_log_access_worker_policy

is required by the Cluster Computing System to permit worker nodes to access staging and logging directories.

You can use the following JSON document as a template for the

staging_log_access_worker_policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetEncryptionConfiguration",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-staging-bucket-name1>",
                "arn:aws:s3:::<cluster-logging-bucket-name1>"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-staging-dir1>/*",
                "arn:aws:s3:::<cluster-logging-dir1>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

init_script_worker_policy

The IAM policy

staging_log_access_worker_policy

is required by the Cluster Computing System to allow worker nodes to access the initialization script and init script logging directories.

You can use the following JSON document as a template for the

init_script_worker_policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-init-script-bucket-name1>"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-init-script-dir1>/*"
                
            ]
        }
    ]
}

Rename Saved Search

Table of Contents

Advanced Clusters

Advanced Clusters

Create worker policies

Create worker policies

minimal_worker_policy

ebs_autoscaling_worker_policy

staging_log_access_worker_policy

init_script_worker_policy