Customizing Minimal policy

The following reduced policy definition can optionally be used to register a hybrid environment and create Cloudera Data Hub clusters.

Customize the scope of iam:PassRole

Cloudera utilizes the iam:PassRole as part of the cloud identity federation setup process via IDBroker on AWS. The default policy uses * as the resource scope for this action.

{
     "Effect": "Allow
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "*"
}

However, the scope can be reduced to just a few roles. Edit the following sample code and replace the * with the ARNs of the following roles used for the environment:

LOG_ROLE

You choose the name for these roles when you set up Cloudera as part of the Minimal Setup for Cloud Storage.

After updating according to the minimal setup for cloud storage, the iam:PassRole policy excerpt should like similar to the following:

{
      "Effect": "Allow
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [

               "arn:aws:iam::$ACCOUNTID:role/LOG_ROLE",

           ]
}

If you have already created the Log role and you don’t know the name of the role, you can obtain them following the steps described in Obtaining role name.

Further permissions reduction (optional)

You can reduce these policies even further by pre-creating some resources:

If you use your own security groups, then the following actions can be removed from the policy:

ec2:CreateSecurityGroup
ec2:AuthorizeSecurityGroupIngress
ec2:RevokeSecurityGroupEgress
ec2:AuthorizeSecurityGroupEgress

If you use private IPs or set up Cluster Connectivity Manager to communicate with the Cloudera Control Plane, then the following actions can be removed from the policy:

ec2:CreateSecurityGroup
ec2:AuthorizeSecurityGroupIngress
ec2:RevokeSecurityGroupEgress
ec2:AuthorizeSecurityGroupEgress

If you use private IPs or set up Cluster Connectivity Manager to communicate with the Cloudera Control Plane, then the following actions can be removed from the policy:

ec2:AllocateAddress
ec2:ReleaseAddress