Skip to content

Adding different IAM roles according to the regions #2083

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Nov 2, 2021
Merged

Adding different IAM roles according to the regions #2083

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7d2c8b1
initial commit
hrdamani Nov 1, 2021
dd5e3d2
adding iam code for eu region
hrdamani Nov 1, 2021
3c752c4
editting the titles
hrdamani Nov 1, 2021
4bcbe4a
Update data-lakes-manual-setup.md
stayseesong Nov 2, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 40 additions & 1 deletion src/connections/storage/data-lakes/data-lakes-manual-setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,11 @@ The following steps provide examples of the IAM Role and IAM Policy.

### IAM Role

Create a `segment-data-lake-role` role for Segment to assume. Attach the following trust relationship document to the role:
Create a `segment-data-lake-role` for Segment to assume. The trust relationship document you attach to the role will be different depending on your workspace region.

#### IAM Role for Data Lakes created in US workspaces:

Attach the following trust relationship document to the role to create a `segment-data-lake-role` role for Segment:

```json
{
Expand Down Expand Up @@ -98,6 +102,41 @@ Create a `segment-data-lake-role` role for Segment to assume. Attach the followi
> note ""
> **NOTE:** Replace the `ExternalID` list with the Segment `WorkspaceID` that contains the sources to sync to the Data Lake.

#### IAM Role for Data Lakes created in EU workspaces:

> info ""
> EU workspaces are currently in beta. If you would like to learn more about the beta, please contact your account manager.

Attach the following trust relationship document to the role to create a `segment-data-lake-role` role for Segment.

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::595280932656:role/segment-datalakes-production-access",
]
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": [
"WORKSPACE_ID"
]
}
}
}
]
}
```

> note ""
> **NOTE:** Replace the `ExternalID` list with the Segment `WorkspaceID` that contains the sources to sync to the Data Lake.

### IAM Policy

Add a policy to the role created above to give Segment access to the relevant Glue databases and tables, EMR cluster, and S3.
Expand Down