Required IAM resources

The following table lists the IAM roles and IAM policies that need to be created on AWS, and describes which policies should be assigned to which roles (as presented in the diagram, in some cases policies should be assigned to multiple roles). The policy definitions are provided in IAM policy definitions:

Table 1. IAM roles and policies

Role	Permission policy	Trust policy	Description
LOG_ROLE	aws-cdp-log-policy aws-cdp-backup-policy (Optional)	aws-cdp-ec2-role-trust-policy	This role uses the aws-cdp-log-policy permissions policy to provide Cloudera with access to the specific location called Logs Location Base for logs. If your Backup Location Base is in a separate bucket or folder, you also need to provide the aws-cdp-backup-policy. The trust policy allows the role to be assumed by EC2 instances in the cluster.

The following diagram summarizes the roles, policies, and S3 bucket directories in this example setup.