URI:	/content/informaticadita-com/en_us/cloud-common-services/administrator/current-version/_advanced-clusters_administrator_current-version_ditamap/setting_up_amazon_web_services/step_7_create_iam_roles/configure_the_trust_relationship_for_the_cluster_operator_role_to_include_t/_jcr_content/header/menupage.nocache.html/informaticadita-com/components/content/menu-hover
STATUS:	404
MESSAGE:	Not Found
SERVLET:	org.apache.felix.http.base.internal.dispatch.DispatcherServlet-3dc2f56e

URI:	/content/informaticadita-com/en_us/cloud-common-services/administrator/current-version/_advanced-clusters_administrator_current-version_ditamap/setting_up_amazon_web_services/step_7_create_iam_roles/configure_the_trust_relationship_for_the_cluster_operator_role_to_include_t/_jcr_content/navigation-bar/breadcrumb/timestamp.nocache.html/informaticadita-com/components/content/timestamp
STATUS:	404
MESSAGE:	Not Found
SERVLET:	org.apache.felix.http.base.internal.dispatch.DispatcherServlet-3dc2f56e

Advanced Clusters

Back Next

Configure the trust relationship for the cluster operator role to include the Secure Agent role

Because the Secure Agent needs to assume the cluster operator role, the cluster operator role needs to trust the Secure Agent.

Edit the trust relationship of the IAM role

cluster_operator_role

and specify the following policy:

{
      "Version": "2012-10-17",
      "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            },
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::{{account-id}}:role/agent_role"
              },
              "Action": "sts:AssumeRole",
            }
        ]
    }

The value in the Principal element is the ARN of the Secure Agent role.

Optionally, you can configure an external ID to limit the entities that can assume the cluster operator role. Every time that the Secure Agent attempts to assume the cluster operator role, it must specify the external ID.

For example, you can configure the external ID "123" using the following policy:

{
      "Version": "2012-10-17",
      "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            },
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::{{account-id}}:role/agent_role"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalId": "123"
                }
              }
            }
        ]
  }

HTTP ERROR 404 Not Found

Table of Contents

Advanced Clusters

Advanced Clusters

Configure the trust relationship for the cluster operator role to include the Secure Agent role

Configure the trust relationship for the cluster operator role to include the Secure Agent role

HTTP ERROR 404 Not Found

Rename Saved Search

Table of Contents

Advanced Clusters

Advanced Clusters

Configure the trust relationship for the cluster operator role to include the Secure Agent role

Configure the trust relationship for the cluster operator role to include the Secure Agent role