Runtime Environments

Back Next

Worker policy statements

Use the statement descriptions in the worker policy to understand the level of access that the worker nodes have in your AWS environment. The worker policy includes the permissions that worker nodes need to process data in an elastic runtime environment.

Describing resources

The following statement provides read-only resource descriptions:

		{
			"Sid": "DescribeActions",
			"Effect": "Allow",
			"Action": [
				"elasticfilesystem:DescribeMountTargets",
				"autoscaling:DescribeAutoScalingGroups",
				"autoscaling:DescribeAutoScalingInstances",
				"autoscaling:DescribeLaunchConfigurations",
				"autoscaling:DescribeTags",
				"ec2:DescribeInstances",
				"ec2:DescribeLaunchTemplateVersions",
				"ec2:DescribeTags",
				"autoscaling:DescribeLifecycleHooks",
				"autoscaling:DescribeScalingActivities",
				"ec2:DescribeLaunchTemplates",
				"ec2:DescribeInstanceTypes",
				"ec2:DescribeVpcs",
				"secretsmanager:DescribeSecret",
				"secretsmanager:ListSecrets"
			],
			"Resource": "*"
		},

Auto Scaling

The following statement allows the role to manage Auto Scaling groups:

		{
			"Sid": "AutoscalingCapacity",
			"Effect": "Allow",
			"Action": [
				"autoscaling:SetDesiredCapacity",
				"autoscaling:TerminateInstanceInAutoScalingGroup",
				"autoscaling:CreateAutoScalingGroup",
				"autoscaling:CreateOrUpdateTags",
				"autoscaling:DeleteAutoScalingGroup",
				"autoscaling:DeleteTags",
				"autoscaling:SuspendProcesses",
				"autoscaling:UpdateAutoScalingGroup"
			],
			"Resource": "*"
		},

Amazon EC2

The following statement allows the role to manage EC2 resources:

		{
			"Sid": "EC2Management",
			"Effect": "Allow",
			"Action": [
				"ec2:AssociateIamInstanceProfile",
				"ec2:CreateKeyPair",
				"ec2:CreateLaunchTemplate",
				"ec2:CreateLaunchTemplateVersion",
				"ec2:CreateTags",
				"ec2:DeleteLaunchTemplate",
				"ec2:DeleteTags",
				"ec2:ModifyLaunchTemplate",
				"ec2:RunInstances",
				"ec2:TerminateInstances",
				"iam:PassRole"
			],
			"Resource": "*"
		},

Amazon EFS

The following statement allows the role to create and delete access points on EFS file systems:

		{
			"Sid": "EFSManagement",
			"Effect": "Allow",
			"Action": [
				"elasticfilesystem:CreateAccessPoint",
				"elasticfilesystem:DeleteAccessPoint"
			],
			"Resource": "*"
		},

AWS Secrets Manager

The following statement allows the role to access and update secrets in AWS Secrets Manager:

		{
			"Sid": "SecretsManagerAccess",
			"Effect": "Allow",
			"Action": [
				"secretsmanager:GetSecretValue",
				"secretsmanager:UpdateSecret"
			],
			"Resource": "*"
		}

Rename Saved Search

Table of Contents

Runtime Environments

Runtime Environments

Worker policy statements

Worker policy statements

Describing resources

Auto Scaling

Amazon EC2

Amazon EFS

AWS Secrets Manager