IAM policy definitions for the minimal cloud storage setup

Use the following IAM policy definitions when defining IAM policies for the minimal cloud storage setup described in the parent topic.

While creating these IAM policies, make sure to replace the following with actual values:

${ARN_PARTITION}: Replace this with "aws". Or, if you are using one of China's regions, replace it with "aws-cn". See Amazon Resource Names (ARNs).
${AWS_ACCOUNT_ID}: Replace this with your AWS account ID.
${DATALAKE_BUCKET}: Replace this with the name of your S3 bucket. For example, my-bucket.
${LOGS_BUCKET}: Replace this with the name of your S3 bucket for logs. For example, my-bucket.
${LOGS_LOCATION_BASE}: Replace this with the path to your S3 location for logs. For example, my-bucket/my-dl.
${BACKUP_BUCKET}: Replace this with the name of your S3 bucket for backups. For example, my-bucket.
${BACKUP_LOCATION_BASE}: Replace this with the path to your S3 location for backups. This location is used for both FreeIPA backups. For example, my-bucket/my-dl.

aws-cdp-log-policy

See aws-cdp-log-policy.json.

aws-cdp-backup-policy

See aws-cdp-backup-policy.json.

aws-cdp-bucket-access-policy

See aws-cdp-bucket-access-policy.json.

aws-cdp-ec2-role-trust-policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}