Runtime Environments

Back Next

Step 2. Create a cluster installer policy

Create a cluster installer policy that contains the permissions that allow the cluster to interact with an elastic runtime environment.

To create the cluster installer policy, use the JSON document in this section and replace the placeholders:

The following table describes each placeholder:

Placeholder	Description
<AWS account ID>	AWS account ID.
<cluster installer role>	Cluster installer role name, such as cluster_installer_role . The name must follow the AWS naming convention for roles. You can decide on the role name in this step, and then use the same role name when you create the role. For information about creating the cluster installer role, see Step 3. Create a cluster installer role.
<worker role>	Worker role name, such as worker_node_role . The name must follow the AWS naming convention for roles. You can decide on the role name in this step, and then use the same role name when you create the role. For information about creating the cluster installer role, see Step 5. Create a worker role.

The following JSON document contains the policy content:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": [
				"autoscaling:CreateAutoScalingGroup",
				"autoscaling:DeleteAutoScalingGroup",
				"autoscaling:TerminateInstanceInAutoScalingGroup",
				"autoscaling:DescribeAutoScalingGroups",
				"autoscaling:DescribeScalingActivities",
				"autoscaling:DescribeTags",
				"autoscaling:UpdateAutoScalingGroup",
				"autoscaling:CreateOrUpdateTags",
				"autoscaling:DeleteTags",
				"autoscaling:DescribeAutoScalingInstances",
				"autoscaling:DescribeLaunchConfigurations",
				"autoscaling:DescribeLifecycleHooks",
				"autoscaling:ResumeProcesses",
				"autoscaling:SetDesiredCapacity",
				"autoscaling:SuspendProcesses"
			],
			"Resource": "*"
		},
		{
			"Sid": "VisualEditor1",
			"Effect": "Allow",
			"Action": [
				"ec2:DescribeAvailabilityZones",
				"ec2:DescribeImages",
				"ec2:DescribeInstanceAttribute",
				"ec2:DescribeInstances",
				"ec2:DescribeInstanceTypes",
				"ec2:DescribeSecurityGroups",
				"ec2:DescribeLaunchTemplateVersions",
				"ec2:DescribeLaunchTemplates",
				"ec2:DescribeTags",
				"ec2:AuthorizeSecurityGroupIngress",
				"ec2:DeleteLaunchTemplate",
				"ec2:ModifyInstanceAttribute",
				"ec2:DescribeVpcs"
			],
			"Resource": "*"
		},
		{
			"Sid": "VisualEditor2",
			"Effect": "Allow",
			"Action": "ec2:RunInstances",
			"Resource": "*"
		},
		{
			"Sid": "VisualEditor3",
			"Effect": "Allow",
			"Action": [
				"ec2:CreateKeyPair",
				"ec2:CreateTags",
				"ec2:CreateLaunchTemplate"
			],
			"Resource": [
				"arn:aws:ec2:*:<AWS account ID>:security-group/*",
				"arn:aws:ec2:*:<AWS account ID>:network-interface/*",
				"arn:aws:ec2:*:<AWS account ID>:launch-template/*",
				"arn:aws:ec2:*:<AWS account ID>:instance/*",
				"arn:aws:ec2:*:<AWS account ID>:subnet/*",
				"arn:aws:ec2:*:<AWS account ID>:volume/*",
				"arn:aws:ec2::*::image/*",
				"arn:aws:ec2:*:<AWS account ID>:key-pair/*"
			]
		},
		{
			"Sid": "VisualEditor5",
			"Effect": "Allow",
			"Action": "ec2:CreateTags",
			"Resource": [
				"arn:aws:ec2:*:<AWS account ID>:network-interface/*",
				"arn:aws:ec2:*:<AWS account ID>:key-pair/*",
				"arn:aws:ec2:*:<AWS account ID>:launch-template/*",
				"arn:aws:ec2:*:<AWS account ID>:instance/*",
				"arn:aws:ec2:*:<AWS account ID>:volume/*",
				"arn:aws:ec2:*:<AWS account ID>:subnet/*"
			],
			"Condition": {
				"StringEquals": {
					"ec2:CreateAction": [
						"RunInstances",
						"CreateKeyPair",
						"CreateLaunchTemplate",
						"CreateLaunchTemplateVersion",
						"network-interface",
						"CreateTags",
						"CreateAutoScalingGroup"
					]
				}
			}
		},
		{
			"Sid": "VisualEditor13",
			"Effect": "Allow",
			"Action": "iam:PassRole",
			"Resource": [
				"arn:aws:iam::<AWS account ID>:role/<cluster installer role>",
				"arn:aws:iam::<AWS account ID>:role/<worker role>"
			]
		},
		{
			"Sid": "VisualEditor21",
			"Effect": "Allow",
			"Action": [
				"secretsmanager:DescribeSecret",
				"secretsmanager:GetSecretValue",
				"secretsmanager:ListSecrets",
				"secretsmanager:CreateSecret",
				"secretsmanager:TagResource",
				"secretsmanager:DeleteSecret",
				"secretsmanager:UpdateSecret"
			],
			"Resource": "arn:aws:secretsmanager:*:<AWS account ID>:secret:*"
		},
		{
			"Sid": "VisualEditor10",
			"Effect": "Allow",
			"Action": [
				"elasticfilesystem:CreateMountTarget",
				"elasticfilesystem:DescribeAccessPoints",
				"elasticfilesystem:DescribeFileSystems",
				"elasticfilesystem:DescribeMountTargets"
			],
			"Resource": "*"
		},
		{
			"Sid": "VisualEditor11",
			"Effect": "Allow",
			"Action": [
				"ec2:DescribeSubnets"
			],
			"Resource": "*"
		},
		{
			"Sid": "EC2Management",
			"Effect": "Allow",
			"Action": [
				"ec2:AssociateIamInstanceProfile",
				"ec2:CreateKeyPair",
				"ec2:CreateLaunchTemplate",
				"ec2:CreateLaunchTemplateVersion",
				"ec2:CreateTags",
				"ec2:DeleteLaunchTemplate",
				"ec2:DeleteTags",
				"ec2:ModifyLaunchTemplate",
				"ec2:RunInstances",
				"ec2:TerminateInstances",
				"iam:PassRole"
			],
			"Resource": "*"
		}
	]
}

For more information about the permissions in the cluster installer policy, see Cluster installer policy statements.

Rename Saved Search

Table of Contents

Runtime Environments

Runtime Environments

Step 2. Create a cluster installer policy

Step 2. Create a cluster installer policy