IAM policy definitions for the minimal cloud storage setup

Note that:

• The policy definitions refer to roles by using the convention presented in the table in the parent topic. If the IAM roles that you created use different names, you should update these names in the policy definitions below.
• The policy definitions refer to the example S3 subdirectories presented in the parent topic. If the S3 bucket sub-directories that you created use different names, you should update these names in the policy definitions below.

While creating these IAM policies, make sure to replace the following with actual values:

• ${ARN_PARTITION} - Replace this with "aws". Or, if you are using one of China regions, replace it with "aws-cn". See Amazon Resource Names (ARNs).
• ${AWS_ACCOUNT_ID} - Replace this with your our AWS account ID.
• ${DATALAKE_BUCKET} - Replace this with the name of your S3 bucket. For example my-bucket.
• ${STORAGE_LOCATION_BASE} - Replace this with the path to your Data Lake directory in the S3 bucket specified as ${DATALAKE_BUCKET}/SOME_PATH. For example my-bucket/my-dl.
• ${LOGS_BUCKET} - Replace this with the name of your S3 bucket for logs. For example my-bucket.
• ${LOGS_LOCATION_BASE} - Replace this with the path to your S3 location for logs. For example my-bucket/my-dl.
• ${BACKUP_BUCKET} - Replace this with the name of your S3 bucket for backups. For example my-bucket.
• ${BACKUP_LOCATION_BASE} - Replace this with the path to your S3 location for backups. This location is used for both FreeIPA and Data Lake backups. For example my-bucket/my-dl.