Cloudera Docs

Creating a cross-account access IAM role

To allow Cloudera to create resources in your AWS account, you create a cross-account access IAM role in your AWS account and grant Cloudera access to the role as a trusted principal by specifying a specific AWS account and an external ID.

The policy for the cross-account access IAM role must have the permissions enumerated in the documentation linked below. In addition, the IAM role must reference the specific AWS account ID and external ID provided in the Cloudera Management Console.

  1. Log in to the AWS Management Console.
  2. Select Policies on the IAM console and click Create policy.
    Figure 1. Create Policy
    IAM user interface, indicating Policies tab and Create policy button
    1. Select the JSON tab and paste the Cross-account Access Policy to the Policy editor.
      Figure 2. Paste Cross-account Access Policy
      IAM user interface, Specify permissions page, indicating JSON tab
    2. Click Next.
    3. Enter a name for your policy in the Name field of the Review policy page.
      Figure 3. Enter policy name
      Name field on the Review policy page
    4. Click Create policy when finished.
  3. Select Roles on the IAM console and click Create role.
    Figure 4. Create role
    IAM user interface, Roles page, indicating Create role button
  4. Select AWS account as Trusted Entity type.
  5. Check another AWS account and provide the following information:
    1. Copy and paste your Account ID provided in Cloudera to the Accound ID field.
    2. Check Require external ID under Options.
    3. Copy and paste the External ID from Cloudera to the External ID field.
    Figure 5. Select Trusted Entity
    AWS user interface, Select trusted entity page, indicating AWS account and roles
  6. Click Next.
  7. Search for the previously created policy, and add the permission to the role by checking the box.
    Figure 6. Add permissions
    IAM user interface, Add permissions page, indicating role permission policies
  8. Click Next.
  9. Enter a role name in the Role name field.
    Figure 7. Name the role
    IAM user interface, Name, review and create page, indicating the role name field
  10. Click Create role to finish the role creation process.
  11. Search for the created role, and obtain the IAM Role ARN. You will need it to create a role-based credential.
    Figure 8. Locate the IAM role ARN
    IAM user interface, Credential Role page, indicating role ARN