You need to create IAM roles and policies in the host AWS environment before you can set up an elastic runtime environment.
To set up the host environment, complete the following tasks:
Step 1. Create a cluster installer policy
Create an IAM policy for the cluster installer role. This policy contains the permissions that allow the cluster to interact with an elastic runtime environment.
Step 2. Create a cluster installer role
Create an IAM role for the cluster installer.
Step 3. Attach the cluster installer role to the master node
After creating the cluster installer role, attach it to the master node to make it available to the EC2 instance.
Step 4. Create a worker node policy
Create an IAM policy for the worker node. The worker node policy contains the permissions that allow worker nodes to operate within an elastic runtime environment.
Step 5. Create a worker node role
Create an IAM role for the worker node.
Step 6. Deploy VM
Deploy a VM in your AWS environment.
Step 1. Create a cluster installer policy
Create an IAM policy for the cluster installer role and give it a name such as cluster_installer_policy. The cluster installer policy contains the permissions that allow the cluster to interact with an elastic runtime environment.
Create the policy using the following JSON document. Be sure to replace the "{{text}}" placeholders with the actual information. For example, replace {{account-id}} with your actual AWS account ID; for example: 123456789012.
You can download the JSON file from the Elastic runtime environment IAM policy JSON files Knowledge article.
For more information about IAM policies, refer to the AWS documentation.
Tip: Following security best practices, use the least privileges principle wherever possible. For example, the JSON template shows "Resource": "*" for the IAM policy. However use "*" only where absolutely required. Consider restricting by region or resource.
In AWS, create an IAM role for the cluster installer and give it a name such as cluster_installer_role.
When creating the cluster installer role, select the following options:
Trusted entity type
Use Case
AWS
EC2
AWS automatically creates an instance profile with the same name as the role.
For instructions about creating an IAM role, refer to the AWS documentation. AWS provides several ways to create an IAM role, such as using the AWS Management Console or the AWS CLI.
Step 3. Attach the cluster installer role to the master node
After you've created the cluster installer role, attach it to the master node to make it available to the EC2 instance.
On your master node, specify the cluster installer role in the following location:
1In the EC2 console, select Instances and then launch an instance.
2Expand Advanced details.
3In the IAM instance profile field, select your cluster installer role.
Step 4. Create a worker node policy
Create an IAM policy for the worker node role and give it a name such as worker_node_policy. The worker node policy contains the permissions that allow worker nodes to operate within an elastic runtime environment.
You can download the JSON file from the Elastic runtime environment IAM policy JSON files Knowledge article.
For more information about IAM policies, refer to the AWS documentation.
In AWS, create an IAM role for the worker node and give it a name such as worker_node_role.
The worker node role provides AWS permissions required for the node to interact with core AWS services such as EC2, Auto Scaling, EFS, and Secrets Manager.
When creating the worker node role, select the following options:
Trusted entity type
Use Case
AWS
EC2
AWS automatically creates an instance profile with the same name as the role.
For instructions about creating an IAM role, refer to the AWS documentation. AWS provides several ways to create an IAM role, such as using the AWS Management Console or the AWS CLI.
Tip: Note the name of this worker node role. You'll need to enter this value into the Worker Instance Profile field of your elastic runtime environment environment configuration. For more information, see Environment configuration.