Cloudera Docs

Creating the IAM roles and establishing trust relationships: LOG_ROLE

You can create the LOG_ROLE IAM roles from the IAM console or AWS CLI.

Review the minimal setup for cloud storage outlined above and make sure that you understand which policies you need to attach to which roles.

  1. Go to the IAM console in the AWS web interface.
  2. Select Roles from the navigation pane.
  3. Click Create Role.
  4. Under Select type of trusted entity, select AWS service.
  5. Under Choose a use case, select EC2.
    Figure 1. Select AWS use case
    AWS user interface, Create role page, indicating trusted entity and use case selection
  6. Click Next.
  7. Attach the permissions policies required for the role that you are creating. Make sure to attach all required policies.
  8. Click Next.
  9. Add tags if required by your organization.
  10. Click Next.
  11. Provide a name and an optional description for your role. Verify that you have attached all required permissions policies.
  12. Click Create role. This creates an IAM role and instance profile.
  13. Click the role to see its details.
  14. Verify that the Instance Profile ARN is present.
    Figure 2. Verify Instance Profule ARN presence
    AWS user interface, Roles tab indicating Role ARN, Role description, Instance profile ARNs, Path, and Creation time
  15. Click the Trust relationships tab.
  16. Click Edit trust relationship.
    Figure 3. Edit trust relationship
    AWS user interface, Roles tab indicating role summary, trust relationships, and Edit trust relationship button
  17. Verify that the JSON declaring a trust policy is the same as described in the minimal setup. If it isn't, replace it with the correct trust policy definition.
  18. Click Update trust policy.