Advanced Clusters

Back Next

Reuse a log access policy

If you create user-defined master and worker roles, you can reuse the policy content that is generated for the CCS and required for the worker role.

The policy content includes access to the log location that the Secure Agent needs. For more information about user-defined master and worker roles, see Create user-defined master and worker roles.

To reuse the policy, complete the following tasks:

Edit the trust relationship of the worker role and specify the following policy to trust the IAM role

agent_role

{ 
   "Version":"2012-10-17",
   "Statement":[ 
      { 
         "Effect":"Allow",
         "Principal":{ 
            "AWS":[ 
               "arn:aws:iam::{{account-id}}:role/<agent_role>"
            ],
            "Service":"ec2.amazonaws.com"
         },
         "Action":"sts:AssumeRole"
      }
   ]
}

Edit the trust relationship of the IAM role

agent_role

and specify the following policy to trust the worker role:

{ 
   "Version":"2012-10-17",
   "Statement":[ 
      { 
         "Effect":"Allow",
         "Principal":{ 
            "AWS":[ 
               "arn:aws:iam::{{account-id}}:role/<worker role>"
            ],
            "Service":"ec2.amazonaws.com"
         },
         "Action":"sts:AssumeRole"
      }
   ]
}

Rename Saved Search

Table of Contents

Advanced Clusters

Advanced Clusters

Reuse a log access policy

Reuse a log access policy