Step 6. Create a storage role

Create a storage role on AWS

If the self-service cluster is on AWS, create an IAM role that can access the staging and log locations and associate it with the Kubernetes user-managed service account.

On Amazon EKS, you can add the storage role to the instance profiles of the cluster nodes, or you can attach the role to the service account that you assign to Informatica.

Tip: For instructions about creating an IAM role, refer to the AWS documentation. AWS provides several ways to create an IAM role, such as using the AWS Management Console or the AWS CLI.

1In AWS, create an IAM role named storage_role.

2Create the following IAM policy with the name storage_policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetEncryptionConfiguration",
"s3:ListBucket",
"s3:PutObject",
"s3:GetObjectAcl",
"s3:GetObject",
"s3:DeleteObject",
"s3:PutObjectAcl"
],
"Resource": [
"arn:aws:s3:::<cluster staging dir1>/*",
"arn:aws:s3:::<cluster logging dir1>/*"
]
}
]
}

Replace <cluster staging dir1> and <cluster logging dir1> with your staging and log locations, respectively. To accommodate S3 locations that change frequently, you can use wildcard characters. For more information, refer to the AWS documentation.

3Attach the IAM policy storage_policy to the IAM role storage_role.

4Configure the trust relationship for the storage role to include the Secure Agent role that's attached to the Secure Agent machine.

Because the Secure Agent needs to assume the storage role, the storage role needs to trust the Secure Agent.

Edit the trust relationship of the IAM role storage_role and specify the following IAM policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
},
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::{{account-id}}:role/agent_role"
},
"Action": "sts:AssumeRole",
}
]
}

Note: The value in the Principal element is the ARN of the Secure Agent role.

Optionally, you can configure an external ID to allow only the Secure Agent to assume the storage role.

For example, you can configure the external ID "123" using the following policy:

Create a storage role on Microsoft Azure

If the self-service cluster is on Microsoft Azure, create a managed identity with a storage role that can access the staging and log locations and associate it with the Secure Agent machine.

Tip: For detailed instructions about creating a managed identity, refer to the Microsoft Azure documentation.

1In Azure, create a managed identity named storage_identity.

You can use an existing system-assigned managed identity or you can create a user-assigned managed identity. If you create a user-assigned managed identity, disable the system-assigned managed identity.

2Create a custom role named storage_role with the following role definition:

{
"properties":{
"roleName":"storage_role",
"description":"",
"assignableScopes":[
"/subscriptions/<subscription ID>/resourceGroups/<storage resource group>"
],
"permissions":[
{
"actions":[
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Storage/storageAccounts/write",
"Microsoft.Storage/storageAccounts/listKeys/action"
],
"notActions":[

],
"dataActions":[

],
"notDataActions":[

]
}
]
}
}

3Assign the custom role storage_role to the managed identity named storage_identity.

4Assign the managed identity storage_identity to the Secure Agent machine.