Giters

cloudera-labs / cloudera.exe

cloudera.exe -- an Ansible collection enabling runlevel management of CDP Public Cloud deployments as well as numerous utilities for deployments.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Missing Log Location Base access policy in IDBroker Role

anuragpatro opened this issue · comments

commented

As per Minimal setup for cloud storage, the IDBROKER_ROLE requires two policies:

  • aws-cdp-idbroker-assume-role-policy
  • aws-cdp-log-policy

Current cloudera-deploy AWS setup here shows that the IDBroker_role only has the IDBroker Assume Role Policy and is lacking the CDP Log policy hence failing validations in cdpctl, specifically describing the actions under the aws-cdp-log-policy.

  • IdBroker role has the necessary S3 logs location actions. ❌
  • IdBroker role has the necessary S3 bucket actions. ❌