Creating AWS Identity and Access Management (IAM) Policies

In AWS, IAM files are used to create policies that control access to resources in a VPC. IAM roles allow EC2 instances to make API requests without the need to use or distribute AWS credentials (accessKey and secretAccessKey).

For more information about IAM, see the following topics in the AWS documentation:
Use the AWS Policy Generator to create the IAM file, keeping in mind the following requirements:
  • For EC2, Cloudera Director requires permissions for the following methods:
    • CreateTags
    • DescribeAvailabilityZones
    • DescribeImages
    • DescribeInstanceStatus
    • DescribeInstances
    • DescribeKeyPairs
    • DescribePlacementGroups
    • DescribeRegions
    • DescribeSecurityGroups
    • DescribeNetworkAcls
    • DescribeSubnets
    • DescribeInstanceAttribute
    • RunInstances
    • TerminateInstances
  • To use EBS volumes, the following additional EC2 permissions are required:
    • CreateVolume
    • DescribeVolumes
    • AttachVolume
    • DeleteVolume
    • ModifyInstanceAttribute
  • To use spot instances, the following additional EC2 permissions are required:
    • RequestSpotInstances
    • CancelSpotInstanceRequests
    • DescribeSpotInstanceRequests
  • When working with EBS volumes, in order to use a custom key stored in KMS for EBS encryption, Cloudera Director also requires the following KMS permission:
    • DescribeKey
  • To use the importKeyPairIfMissing property, Cloudera Director requires the following EC2 permission:
    • ImportKeyPair
  • To validate the templates used for EC2 instance creation, Cloudera Director requires permissions for the following IAM methods:
    • GetInstanceProfile
    • PassRole
  • To create RDS database servers for persistence on demand, Cloudera Director requires permissions for the following methods:
    • CreateDBInstance
    • DeleteDBInstance
    • DescribeDBInstances
    • DescribeDBEngineVersions
    • DescribeDBSubnetGroups

Example IAM Policy

The following example IAM policy shows the format to use with Cloudera Director. Your Amazon Resource Name (ARN) will be different. For more information on ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS documentation.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "directorEc2",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeImages",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeInstances",
                "ec2:DescribeKeyPairs",
                "ec2:DescribePlacementGroups",
                "ec2:DescribeRegions",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeSubnets",
                "ec2:DescribeInstanceAttribute",
                "ec2:RunInstances",
                "ec2:TerminateInstances",
                "ec2:CreateVolume",
                "ec2:DescribeVolumes",
                "ec2:AttachVolume",
                "ec2:DeleteVolume",
                "ec2:ModifyInstanceAttribute",
                "ec2:ImportKeyPair",
                "ec2:RequestSpotInstances",
                "ec2:CancelSpotInstanceRequests",
                "ec2:DescribeSpotInstanceRequests"
            ],
            "Resource": "*"
        },
        {
            "Sid": "directorKms",
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey"
            ],
            "Resource": "*"
        },
        {
            "Sid": "directorIam",
            "Effect": "Allow",
            "Action": [
                "iam:GetInstanceProfile",
                "iam:PassRole"
            ],
            "Resource": "*"
        },
        {
            "Sid": "directorRds",
            "Effect": "Allow",
            "Action": [
                "rds:CreateDBInstance",
                "rds:DeleteDBInstance",
                "rds:DescribeDBInstances",
                "rds:DescribeDBEngineVersions"
            ],
            "Resource": "*"
        }
    ]
}