Amazon Security

To assume another role, Transformer must use an Amazon Web Services library for Apache Hadoop 2.8.0 or later.

To enable Transformer to assume a role, you first must create the trust policy in AWS that allows the role to be assumed. Then, you configure the required stage properties in Control Hub.

In AWS, create and attach a trust policy to the role to be assumed. The policy must allow other principals - IAM roles or users - to assume the role.

The trust policy that you create for the role to be assumed depends on whether you want to allow Amazon S3 stages or EMR or EMR Serverless pipelines to assume the role with or without restrictions:

Trust policy to assume the role with no restrictions

Create and attach a trust policy to the role to be assumed that allows another IAM role or user to assume the role.

For example, if using instance profile authentication, you might create the following policy where:

• <account_id> is the ID of your AWS account.
• <role_name> is the name of the role permitted to assume this role. Enter the name of the role included in the instance profile associated with the Amazon EC2 instance where the execution engine - Data Collector or Transformer - runs.

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Sid": "",
     "Effect": "Allow",
     "Principal": {
       "AWS": "arn:aws:iam::<account_id>:role/<role_name>"
     },
     "Action": [
       "sts:AssumeRole"
     ]
   }
 ]
}

If using AWS access keys authentication, create a similar trust policy. However, for the principal, specify the ARN of the IAM user permitted to assume this role. Enter the name of the IAM user that owns the access keys used to authenticate with AWS. For example:

...
"Principal": {
       "AWS": "arn:aws:iam::<account_id>:user/<user_name>"
},
...

Trust policy to assume a role using session tags to restrict role access

Create and attach a trust policy to the role to be assumed that allows the IAM role or user to assume the role, uses session tags, and restricts the session tag values to specific StreamSets user accounts.

For example, if using instance profile authentication, you might create the following policy where:

• <account_id> is the ID of your AWS account.
• <role_name> is the name of the role permitted to assume this role. Enter the name of the role included in the instance profile associated with the Amazon EC2 instance where the execution engine - Data Collector or Transformer - runs.
• <user1> and <user2> are Data Collector, Transformer, or Control Hub user accounts allowed to assume this role. To specify a Control Hub user account, use the required naming convention: <user ID>@<organization ID>. For example, joe@MyCompany.

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Sid": "",
     "Effect": "Allow",
     "Principal": {
       "AWS": "arn:aws:iam::<account_id>:role/<role_name>"
     },
     "Action": [
       "sts:AssumeRole",
       "sts:TagSession"
     ],
     "Condition": {
       "StringEquals": {
         "aws:RequestTag/streamsets/principal": ["<user1>", "<user2>"]
       },
        "Null": {
          "aws:RequestTag/streamsets/principal": "false"
        }
     }
   }
 ]
}

If using AWS access keys authentication, create a similar trust policy. However, for the principal, specify the ARN of the IAM user permitted to assume this role. Enter the name of the IAM user that owns the access keys used to authenticate with AWS. For example:

...
"Principal": {
       "AWS": "arn:aws:iam::<account_id>:user/<user_name>"
},
...

For more information about creating an IAM trust policy, see the AWS IAM documentation.