Credential Configuration
A Credential configuration lets a warehouse read and write your S3 bucket and lets VeloDB Cloud deploy compute in your account. You create it in the console with Create Credential, which walks through three steps, Basic Information, Storage Access, and Infrastructure Access. Prepare the AWS resources each step needs, as described below.
Basic Information
Basic Information identifies the credential and the S3 bucket where the warehouse stores data. Create the bucket first.
Create an S3 bucket
The bucket must be in the same AWS region as the warehouse. We recommend a dedicated bucket for each warehouse.
- Sign in to the AWS S3 Console as an administrator and click Create bucket.
- Enter a bucket name (for example,
velodb-warehouse-data) and select the target region. - Click Create bucket.
- Copy the bucket name. In Basic Information, enter a credential name, the cloud platform, the region, and this bucket name, then click Continue.
Storage Access
Storage Access lets the EC2 instances that run the warehouse read and write your S3 bucket, through an IAM role they assume.
Create the data-access IAM policy
-
Open the AWS IAM Console and go to Policies → Create policy.
-
On the JSON tab, paste the data-access policy. The Storage Access step of Create Credential shows it ready to copy, with your bucket name filled in.
-
Click Next, name the policy (for example,
VeloDBDataStorageAccess), and click Create policy.
The Storage Access step pre-fills this policy with your bucket name, so you can paste it directly. If you copy the reference policy below instead, replace <bucket-name> with your S3 bucket from Basic Information.
Data-access IAM policy (full reference)
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Resource": "arn:aws:s3:::<bucket-name>",
"Action": [
"s3:GetBucketLocation",
"s3:GetBucketVersioning",
"s3:PutBucketCORS",
"s3:ListBucket",
"s3:ListBucketVersions",
"s3:ListBucketMultipartUploads"
]
},
{
"Effect": "Allow",
"Resource": "arn:aws:s3:::<bucket-name>/*",
"Action": [
"s3:GetObject",
"s3:GetObjectVersion",
"s3:PutObject",
"s3:DeleteObject",
"s3:DeleteObjectVersion",
"s3:AbortMultipartUpload",
"s3:ListMultipartUploadParts"
]
},
{
"Effect": "Allow",
"Action": ["sts:AssumeRole"],
"Resource": "*"
}
]
}
Create the service IAM role
-
In IAM, go to Roles → Create role.
-
Pick AWS service as the trusted entity type and EC2 as the use case.
-
Attach the policy you just created.
-
Name the role (for example,
VeloDBDataStorageAccessRole) and create it. -
On the role's Trust Relationships tab, replace the trust policy with the following. The
AWSprincipal is this role's own ARN: replace<aws-account-id>with your AWS account ID and<role-name>with the role you created in step 4, or copy the role's ARN from its summary page.{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com",
"AWS": "arn:aws:iam::<aws-account-id>:role/<role-name>"
},
"Action": "sts:AssumeRole"
}
]
} -
Copy the Instance Profile ARN (format:
arn:aws:iam::<aws-account-id>:instance-profile/<role-name>), paste it into the Storage Access step, and click Continue.
Infrastructure Access
Infrastructure Access lets VeloDB Cloud deploy and manage compute in your account, through a cross-account IAM role it assumes with an external ID. Complete Storage Access first: the deployment policy references your bucket and service role.
Create the deployment IAM policy
After you complete the Storage Access step, the Infrastructure Access step shows a ready-to-use policy that you can paste directly, without manual substitutions.
-
In the IAM console, go to Policies → Create policy.
-
On the JSON tab, paste the deployment policy. The Infrastructure Access step of Create Credential shows it ready to copy, with your account, bucket, and role filled in.
-
Click Next, name the policy (for example,
AllowVeloDBCrossAccountAccess), and click Create policy.
In the console, these values are already filled in. If you paste the reference policy below instead, replace <bucket-name> with the S3 bucket from Basic Information and <role-name> with the service role you created in Storage Access (for example, VeloDBDataStorageAccessRole), and <aws-account-id> with your AWS account ID.
Deployment IAM policy (full reference)
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:TerminateInstances",
"ec2:StopInstances",
"ec2:StartInstances",
"ec2:RebootInstances",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyVolume"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/resource-created-by": "velodb"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeNatGateways",
"ec2:DescribeInternetGateways",
"ec2:DescribeInstances",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstanceTypes",
"ec2:ModifyInstanceAttribute",
"ec2:DescribeVolumes",
"ec2:DescribeImages",
"ec2:DescribeVpcEndpoints",
"ec2:DescribePrefixLists",
"ec2:DescribeRouteTables",
"ec2:DescribeTags",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"elasticloadbalancing:DescribeTags",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:DescribeTargetGroups",
"iam:GetPolicy",
"iam:GetPolicyVersion"
],
"Resource": ["*"]
},
{
"Effect": "Allow",
"Action": ["ec2:RunInstances", "ec2:CreateTags"],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/resource-created-by": "velodb"
}
}
},
{
"Effect": "Allow",
"Action": ["ec2:RunInstances"],
"Resource": [
"arn:aws:ec2:*:*:image/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:subnet/*"
]
},
{
"Effect": "Allow",
"Action": ["ec2:CreateTags", "ec2:DeleteTags"],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/resource-created-by": "velodb"
}
}
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateTargetGroup"
],
"Resource": [
"arn:aws:elasticloadbalancing:*:*:targetgroup/*",
"arn:aws:elasticloadbalancing:*:*:loadbalancer/*",
"arn:aws:elasticloadbalancing:*:*:listener/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/resource-created-by": "velodb"
}
}
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:DeleteListener"
],
"Resource": [
"arn:aws:elasticloadbalancing:*:*:targetgroup/*",
"arn:aws:elasticloadbalancing:*:*:loadbalancer/*",
"arn:aws:elasticloadbalancing:*:*:listener/*"
],
"Condition": {
"StringEquals": {
"elasticloadbalancing:ResourceTag/resource-created-by": "velodb"
}
}
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags"
],
"Resource": ["arn:aws:elasticloadbalancing:*:*:*"],
"Condition": {
"StringEquals": {
"elasticloadbalancing:ResourceTag/resource-created-by": "velodb"
}
}
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetBucketVersioning",
"s3:GetBucketPublicAccessBlock",
"s3:GetLifecycleConfiguration",
"s3:PutLifecycleConfiguration",
"s3:ListBucket"
],
"Resource": ["arn:aws:s3:::<bucket-name>"]
},
{
"Effect": "Allow",
"Action": [
"iam:GetInstanceProfile",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:ListRolePolicies",
"iam:ListAttachedRolePolicies"
],
"Resource": [
"arn:aws:iam::<aws-account-id>:instance-profile/<role-name>",
"arn:aws:iam::<aws-account-id>:role/<role-name>"
]
},
{
"Effect": "Allow",
"Action": ["iam:PassRole"],
"Resource": [
"arn:aws:iam::<aws-account-id>:role/<role-name>"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "ec2.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": ["iam:CreateServiceLinkedRole"],
"Resource": [
"arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing"
],
"Condition": {
"StringEquals": {
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
}
}
}
]
}
The reference deployment policy above does not include AWS KMS permissions. If you use customer-managed AWS KMS keys for Transparent Data Encryption (TDE) or Amazon EBS encryption, copy the deployment policy from the console instead: the Infrastructure Access step adds the KMS permissions for the keys you selected. If you do not use encryption keys, the reference policy is sufficient as is.
Create the cross-account IAM role
-
In IAM, go to Roles → Create role.
-
Trusted Entity Type: Select Custom trust policy.
-
ExternalId: paste the External ID shown in the console's Infrastructure Access step. The principal account in the trust policy below is the Trust Account ID the console displays.
-
Custom trust policy: Paste this trust policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::757278738533:role/VeloDBDeploymentAssumer"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "<external-id>"
}
}
}
]
}Substitute the placeholders in this trust policy: replace
<external-id>with the External ID shown in the console's Infrastructure Access step. Leave thePrincipalaccount (757278738533) as is: it is VeloDB Cloud's Trust Account ID, which the console also displays. -
Permissions: attach the deployment policy you created earlier.
-
Name the role (for example,
VeloDBCrossAccountRole) and create it. -
Copy the Role ARN, paste it into the Infrastructure Access step as the Cross-Account Role ARN, then click Confirm to save the credential.