Advanced Clusters

Back Next

Step 10.1. Create policies for the Secure Agent and worker roles

Create policies to allow the Secure Agent and worker roles to access Amazon data sources in an

advanced job

. Create and distribute the policies based on the worker role type.

If you create a user-defined worker role, you can provide access to the data sources in one of the following ways:

Create a new managed policy: To create a new managed policy, complete the following tasks:

Create the policy that the connector requires. Name the policy
data_source_access_policy
. For information about connector requirements, see the help for the appropriate connector.
Attach the policy
data_source_access_policy
to both the Secure Agent role and worker role.
Reuse the IAM policy staging_log_access_worker_policy: To reuse the IAM policy
staging_log_access_worker_policy
that is attached to the worker role, complete the following tasks:

Specify the data sources in the Resource elements.

For example, the Resource element in the following statement specifies the staging and log locations:

{ "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObjectAcl", "s3:GetObject", "s3:DeleteObject", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::<cluster-staging-dir1>/*", "arn:aws:s3:::<cluster-logging-dir1>/*" ] }

Below
"arn:aws:s3:::<cluster-logging-dir1>/*"
, add the data sources.

Add the Secure Agent role to the trust relationship of the worker role.
Add the worker role to the trust relationship of the Secure Agent role.

If you use the default worker role, complete the following tasks:

Create the policy that the connector requires. Name the policy

data_source_access_policy

. For information about connector requirements, see the help for the appropriate connector.

Attach the policy

data_source_access_policy

to the Secure Agent role. The Secure Agent will automatically pass the policy to the worker role.