Hi, I'm Ask INFA!
What would you like to know?
ASK INFAPreview
Please to access Ask INFA.
Not Found
English

Page Not Found

The page or file you are looking for has been moved or no longer exists.

The following links might help you find the content you need:


You can also search the Documentation Portal or visit the home page.

English
  • Administrator
  • All Products

Table of Contents

Search

  1. Preface
  2. Advanced clusters
  3. Setting up Amazon Web Services
  4. Setting up Google Cloud
  5. Setting up Microsoft Azure
  6. Setting up a self-service cluster
  7. Local cluster setup
  8. Advanced configurations
  9. Troubleshooting advanced clusters
  10. Appendix A: Command reference

Advanced Clusters

Advanced Clusters

Back Next

Master and worker policy restriction reference

Master and worker policy restriction reference

You can restrict resources in the master and worker policies to limit the resources that the master and worker nodes can access.
You can restrict the following elements depending on their values:
Resource elements with the value
*
If the value for a Resource element is the wildcard
*
, you cannot restrict the resources.
For example, the generated policy for the master node might have the following statement: 
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeRegions",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVolumes"
            ],
            "Resource": [
                "*"
            ]
        },
Because the value for the Resource element is the wildcard
*
, you cannot edit the Resource element.
If you edit a Resource element whose value is the wildcard
*
, the Secure Agent might fail to identify the required resources to start an
advanced cluster
 and the cluster might not start properly.
If you encrypt staging data and log files using SSE-KMS, you can edit the resources in the statement that contains actions on AWS Key Management Service (KMS) even though the Resource element is the wildcard
*
. For more information, see Encrypt staging data and log files at rest (optional).
Resource elements without the value
*
If the value for a Resource element is not the wildcard
*
, you can restrict the Resource element to specify the resources that the statement covers.
For example, a generated policy for the worker node might have the following statement: 
        {
            "Effect": "Allow",
            "Action": [
                "s3:Get*"
            ],
            "Resource": [
                "arn:aws:s3:::<cluster-staging-dir1>/*",
                "arn:aws:s3:::<cluster-staging-dir2>/*"
            ]
        },
Because the value for the Resource element is not the wildcard
*
, you can edit the resources in the statement. In this example, you can restrict the Resource element to the S3 resources that define one or more staging locations.
You can provide staging, log, and initialization script locations for multiple
advanced clusters
 to share the same policy content between clusters that use different
advanced configurations
.
To avoid cross-region data-transfer costs, use S3 buckets that are in the same region. To help you manage each bucket, use different buckets for staging locations, log locations, initialization scripts, and data sources.
0 COMMENTS
We’d like to hear from you!