Prepare S3 file system for Edge

1. Go to AWS Identity and Access Management.
2. Create the programmatic user that you want to use to connect to AWS.
   1. During the user creation process, attach the permission policy: AWSGlueServiceRole.
      
   2. After user creation, open the user details and create an inline policy.
      
   3. Add the following JSON content for the inline policy:
      Copy

      {
          "Version": "2012-10-17",
          "Statement": 
          [
              {
                  "Sid": "VisualEditor0",
                  "Effect": "Allow",
                  "Action": "iam:PassRole",
                  "Resource": "*"
              }
          ]
      }

   4. Use the following name for the inline policy: pass_role.
      

   When you create the AWS connection in Collibra, you need the programmatic user credentials and access keys. For information on access keys, go to the IAM documentation.
   

3. Create an IAM role. You will need to use this IAM role when you add a capability in Collibra.
   
   1. During the role creation process, add permission policy: AWSGlueServiceRole.
      
   2. (Optional) If you also want to access a private S3 bucket, add an additional permission policy: AmazonS3ReadOnlyAccess.
      
   3. Open the newly created role, and in Trust relationships, check that glue.amazonaws.com is added as a trust policy. This should have been added automatically based on the permission policy AWSGlueServiceRole.
      
      
4. If you have enabled Data Lake Formation, complete additional steps.
   
   Show step-by-step instructions

   1. Register the Data Lake locations and create an IAM role for Lake Formation.
      To add or update data, Lake Formation needs read/write access to the Amazon S3 path that you want to integrate.
      1. Navigate to AWS Lake Formation → Administration → Data lake locations.
      2. Click Register location.
      3. Select the IAM role for Lake Formation "AWSServiceRoleForLakeFormationDataAccess" and add the S3 location that you want to integrate.
         This IAM role needs the following permission policies:
         • AWS managed policy: LakeFormationDataAccessServiceRolePolicy
         • inline policy: LakeFormationDAtaAccessPolicyForS3
      4. Click Register Location.
   2. Add the programmatic user as a Data Lake administrator.
      To perform this step, go to AWS Lake Formation → Administration → Administrative roles and tasks and add the user as Data Lake administrator.
   3. Give your IAM role permission to access specific storage locations.
      1. Go to AWS Lake Formation → Permissions → Data locations.
      2. Click Grant.
      3. Select the IAM role you created and add the S3 location that you want to integrate.

         
         

      4. Click Grant.

Note EC2 has been validated only for bundled K3s installations of Edge.

If you use K3s-bundled Edge on an AWS EC2 instance that is configured with role-based authentication, you can connect to Amazon S3 without an access key ID and secret access key. Use the following steps to configure role-based Amazon S3 access control.

1. Go to AWS Identity and Access Management.
2. Create an IAM role. You will need to use this IAM role when you add a capability in Collibra.
   1. During the role creation process, add the permission policy: AWSGlueServiceRole.
      
   2. (Optional) If you also want to access a private S3 bucket, add an additional permission policy: AmazonS3ReadOnlyAccess.
   3. Open the newly created role, and in Trust relationships, check that glue.amazonaws.com is added as a trust policy. This should have been added automatically based on the permission policy AWSGlueServiceRole.
      
      
   4. After the creation, open the user details and click Add permissions to create an inline policy.
      
      
   5. Use the following JSON content for the inline policy:
      Copy

      {
          "Version": "2012-10-17",
          "Statement": 
          [
              {
                  "Sid": "VisualEditor0",
                  "Effect": "Allow",
                  "Action": "iam:PassRole",
                  "Resource": "*"
              }
          ]
      }

   6. Use the following name for the inline policy: pass_role.
3. In the Amazon EC2 console, attach the IAM role you created to the Amazon EC2 instance.
   • Only if the credentials in the Amazon EC2 instance cannot be used to authenticate, you can create a credentials file instead and save it in the user_home/.aws/ folder. The credentials file should look like this:

     [default]
     aws_access_key_id = <access key ID>
     aws_secret_access_key = <secret access key>

     For more information, see the AWS developer guide.

     Warning Do not use a credentials file unless absolutely necessary.