Cloudera Docs

AWS IAM restricted roles and policies for compute and Cloudera AI

AWS IAM write permissions are used by the Cloudera AI compute infrastructure to create and delete roles and instance profiles.

Some customers may not be willing to provide IAM write permissions in the role’s policy. Instead, customers can set up static pre-created roles and instance profiles defined and used by the Cloudera AI compute infrastructure to provision clusters.

The two main tasks are:

  1. Create roles and an instance profile.
  2. Create restricted IAM policies for use by the compute infrastructure.

After these two tasks are completed, you can create the cross-account credential, if needed.

Customer Managed Encryption Key (CMEK) guidance for restricted security policies:

If your enterprise security policies disallow automatic key creation (kms:CreateKey), you must:

  1. Pre-create a customer-governed KMS key (CMEK) in AWS.

  2. Associate this CMEK at the Cloudera environment level prior to initiating Cloudera AI Inference service cluster creation.

  3. Ensure the cross-account IAM role includes adequate KMS permissions to describe, attach, and tag the pre-created CMEK during EKS cluster provisioning.

Hardcoded naming schema for pre-created IAM roles

If the LIFTIE_USE_PRECREATED_IAM_RESOURCES entitlement is enabled for your tenant to use pre-created IAM roles, you must use the exact hardcoded role names specified below:

  • EKS Master Role:cdp-eks-master-role

  • Liftie Instance Profile Role:cdp-liftie-instance-profile

Instance profile S3 permissions for Cloudera AI Registry storage

The cdp-liftie-instance-profile role must be granted explicit S3 read access targeting the Cloudera AI Registry S3 storage path.

  • Required Action:s3:GetObject

  • Required Policy Attachment:
    {
    "Sid": "AllowModelRegistryS3ReadAccess",
    "Effect": "Allow",
    "Action": [
        "s3:GetObject"
    ],
    "Resource": [
        "arn:aws:s3:::<cdp-data-bucket>/datalake/modelregistry/*"
    ]
}