メインコンテンツまでスキップ

Credential Configuration

A credential configuration lets a warehouse read and write your S3 bucket and lets VeloDB Cloud deploy compute in your AWS account. Create the S3 bucket and IAM roles in the AWS console, then register their names and ARNs in the VeloDB Cloud console.

What to prepare​

Create the following AWS resources and enter the matching values in the credential wizard:

Wizard stepWhat VeloDB Cloud needsYou create in the AWS consoleYou enter in the VeloDB Cloud console
Basic InformationStorage for warehouse dataAn S3 bucket in the warehouse regionBucket Name (the bucket name only, not an ARN)
Storage AccessPermission for the warehouse to read and write the bucketA data-access IAM policy and role, with an instance profileInstance Profile ARN (arn:aws:iam::<aws-account-id>:instance-profile/<role-name>)
Infrastructure AccessPermission for VeloDB Cloud to deploy computeA deployment IAM policy and a cross-account role that trusts VeloDB Cloud with an external IDCross-Account Role ARN (arn:aws:iam::<aws-account-id>:role/<role-name>)

Before you start​

  • This procedure applies only to AWS warehouses.
  • Use an AWS account with permission to create an S3 bucket, IAM policies, and IAM roles.
  • Create the S3 bucket in the same AWS region as the warehouse. The credential wizard validates the bucket region.
  • To register a credential in advance, you must be an organization administrator. You can instead add one inline while creating a BYOC warehouse deployed on Custom Infrastructure.

Complete the credential configuration​

The credential wizard and AWS setup have a dependency: the Infrastructure Access step provides the deployment policy, External ID, and Trust Account ID required by the cross-account role. Complete the workflow in this order:

  1. Create the S3 bucket in the warehouse region.
  2. Open the credential wizard and complete Basic Information with the bucket name.
  3. Create the data-access IAM policy and service IAM role. Enter the role's instance profile ARN in Storage Access, then click Continue.
  4. Copy the deployment policy, External ID, and Trust Account ID from Infrastructure Access. Create the deployment IAM policy and cross-account IAM role.
  5. Enter the cross-account role ARN in Infrastructure Access, then click Confirm to save the credential.

Credential wizard reference​

Open the wizard from the Cloud Resources page, or add a credential inline while creating a BYOC warehouse deployed on Custom Infrastructure. The fields below correspond to the workflow above.

  1. Open the Cloud Resources page, click Add New Configuration, and choose Credential Configuration from the dropdown to open Add New Credential Configuration.

  2. Basic Information: identify the credential and the S3 bucket where the warehouse stores data. Create the bucket first (see Create the S3 bucket), then fill in these fields and click Continue:

    • Credential Configuration Name: a name for the credential.
    • Cloud Platform: AWS.
    • Region: the region where you created the bucket. The console validates the bucket against this region, so it must match.
    • Bucket Name: the bucket name only, not an ARN.

    Note:

    Cloud Platform and Region appear only when you create the credential from the Cloud Resources page. When you add a credential inline while creating a warehouse deployed on Custom Infrastructure, both are inherited from the warehouse and hidden, so the credential always uses the warehouse region.

  3. Storage Access: enter the Instance Profile ARN (arn:aws:iam::<aws-account-id>:instance-profile/<role-name>) for the data-access role that the warehouse's EC2 instances assume to read and write your bucket, then click Continue. To create the role and its instance profile, see Create the service IAM role.

  4. Infrastructure Access: enter the Cross-Account Role ARN (arn:aws:iam::<aws-account-id>:role/<role-name>) of the role VeloDB Cloud assumes to deploy compute, then click Confirm to save the credential. This step also shows the External ID and Trust Account ID you need to create the role. To create it, see Create the cross-account IAM role.

AWS resource procedures​

Create these resources in the AWS console if you do not already have them. The deployment policy references the S3 bucket and service role, so follow the sections in this order.

Create an S3 bucket​

Note:

The bucket must be in the same AWS region as the warehouse. Use a dedicated bucket for each warehouse.

  1. Sign in to the AWS S3 Console as an administrator and click Create bucket.
  2. Enter a bucket name (for example, velodb-warehouse-data) and select the target region.
  3. Click Create bucket, then copy the bucket name for the Basic Information step.

For more information, see the AWS documentation for creating a general purpose bucket.

Create the data-access IAM policy​

The warehouse's EC2 instances read and write your S3 bucket through an IAM role they assume. Create its policy first, then the role in Create the service IAM role.

  1. Open the AWS IAM Console and go to Policies → Create policy.
  2. On the JSON tab, paste the data-access policy. The Storage Access step of Add New Credential Configuration shows it ready to copy, with your bucket name filled in.
  3. Click Next, name the policy (for example, VeloDBDataStorageAccess), and click Create policy.

Note:

The Storage Access step pre-fills this policy with your bucket name, so you can paste it directly. If you copy the reference policy below instead, replace <bucket-name> with your S3 bucket from Basic Information.

Data-access IAM policy (full reference)
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::<bucket-name>",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetBucketVersioning",
                "s3:PutBucketCORS",
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "s3:ListBucketMultipartUploads"
            ]
        },
        {
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::<bucket-name>/*",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ]
        },
        {
            "Effect": "Allow",
            "Action": ["sts:AssumeRole"],
            "Resource": "*"
        }
    ]
}

For more information, see the AWS documentation for creating IAM policies.

Create the service IAM role​

  1. In the AWS IAM Console, go to Roles → Create role.

  2. Pick AWS service as the trusted entity type and EC2 as the use case.

  3. Attach the policy you just created.

  4. Name the role (for example, VeloDBDataStorageAccessRole) and create it.

  5. On the role's Trust Relationships tab, replace the trust policy with the following. The AWS principal is this role's own ARN: replace <aws-account-id> with your AWS account ID and <role-name> with the role you created in step 4, or copy the role's ARN from its summary page.

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {
                    "Service": "ec2.amazonaws.com",
                    "AWS": "arn:aws:iam::<aws-account-id>:role/<role-name>"
                },
                "Action": "sts:AssumeRole"
            }
        ]
    }

  6. Copy the Instance Profile ARN (format: arn:aws:iam::<aws-account-id>:instance-profile/<role-name>), paste it into the Instance Profile ARN field in the Storage Access step, and click Continue.

For more information, see the AWS documentation for creating a role for an AWS service.

Create the deployment IAM policy​

VeloDB Cloud deploys and manages compute in your account through a cross-account IAM role it assumes with an external ID. Create its policy first: the policy references the bucket and service role you have created. Then create the role in Create the cross-account IAM role.

Note:

After you complete the Storage Access step, the Infrastructure Access step shows a ready-to-use policy that you can paste directly, without manual substitutions.

  1. In the AWS IAM Console, go to Policies → Create policy.
  2. On the JSON tab, paste the deployment policy. The Infrastructure Access step of Add New Credential Configuration shows it ready to copy, with your account, bucket, and role filled in.
  3. Click Next, name the policy (for example, AllowVeloDBCrossAccountAccess), and click Create policy.

In the console, these values are already filled in. If you paste the reference policy below instead, replace <bucket-name> with the S3 bucket from Basic Information and <role-name> with the service role you created in Create the service IAM role (for example, VeloDBDataStorageAccessRole), and <aws-account-id> with your AWS account ID.

Deployment IAM policy (full reference)
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:TerminateInstances",
                "ec2:StopInstances",
                "ec2:StartInstances",
                "ec2:RebootInstances",
                "ec2:ModifyInstanceAttribute",
                "ec2:ModifyVolume"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*:*:instance/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/resource-created-by": "velodb"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeAddresses",
                "ec2:DescribeNatGateways",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeInstances",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSecurityGroupRules",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeInstanceTypes",
                "ec2:ModifyInstanceAttribute",
                "ec2:DescribeVolumes",
                "ec2:DescribeImages",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribePrefixLists",
                "ec2:DescribeRouteTables",
                "ec2:DescribeTags",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancerAttributes",
                "elasticloadbalancing:DescribeTargetGroupAttributes",
                "elasticloadbalancing:DescribeTags",
                "elasticloadbalancing:DescribeTargetHealth",
                "elasticloadbalancing:DescribeTargetGroups",
                "iam:GetPolicy",
                "iam:GetPolicyVersion"
            ],
            "Resource": ["*"]
        },
        {
            "Effect": "Allow",
            "Action": ["ec2:RunInstances", "ec2:CreateTags"],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:network-interface/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:RequestTag/resource-created-by": "velodb"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": ["ec2:RunInstances"],
            "Resource": [
                "arn:aws:ec2:*:*:image/*",
                "arn:aws:ec2:*:*:security-group/*",
                "arn:aws:ec2:*:*:subnet/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": ["ec2:CreateTags", "ec2:DeleteTags"],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*:*:network-interface/*"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/resource-created-by": "velodb"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticloadbalancing:CreateListener",
                "elasticloadbalancing:CreateLoadBalancer",
                "elasticloadbalancing:CreateTargetGroup"
            ],
            "Resource": [
                "arn:aws:elasticloadbalancing:*:*:targetgroup/*",
                "arn:aws:elasticloadbalancing:*:*:loadbalancer/*",
                "arn:aws:elasticloadbalancing:*:*:listener/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:RequestTag/resource-created-by": "velodb"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticloadbalancing:RegisterTargets",
                "elasticloadbalancing:DeleteLoadBalancer",
                "elasticloadbalancing:ModifyTargetGroupAttributes",
                "elasticloadbalancing:DeregisterTargets",
                "elasticloadbalancing:DeleteTargetGroup",
                "elasticloadbalancing:ModifyLoadBalancerAttributes",
                "elasticloadbalancing:DeleteListener"
            ],
            "Resource": [
                "arn:aws:elasticloadbalancing:*:*:targetgroup/*",
                "arn:aws:elasticloadbalancing:*:*:loadbalancer/*",
                "arn:aws:elasticloadbalancing:*:*:listener/*"
            ],
            "Condition": {
                "StringEquals": {
                    "elasticloadbalancing:ResourceTag/resource-created-by": "velodb"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticloadbalancing:AddTags",
                "elasticloadbalancing:RemoveTags"
            ],
            "Resource": ["arn:aws:elasticloadbalancing:*:*:*"],
            "Condition": {
                "StringEquals": {
                    "elasticloadbalancing:ResourceTag/resource-created-by": "velodb"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetBucketVersioning",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetLifecycleConfiguration",
                "s3:PutLifecycleConfiguration",
                "s3:ListBucket"
            ],
            "Resource": ["arn:aws:s3:::<bucket-name>"]
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:GetInstanceProfile",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:ListRolePolicies",
                "iam:ListAttachedRolePolicies"
            ],
            "Resource": [
                "arn:aws:iam::<aws-account-id>:instance-profile/<role-name>",
                "arn:aws:iam::<aws-account-id>:role/<role-name>"
            ]
        },
        {
            "Effect": "Allow",
            "Action": ["iam:PassRole"],
            "Resource": [
                "arn:aws:iam::<aws-account-id>:role/<role-name>"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "ec2.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": ["iam:CreateServiceLinkedRole"],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
                }
            }
        }
    ]
}

Note:

The reference deployment policy above does not include AWS KMS permissions. If you use customer-managed AWS KMS keys for Transparent Data Encryption (TDE) or Amazon EBS encryption, copy the deployment policy from the console instead: the Infrastructure Access step adds the KMS permissions for the keys you selected. If you do not use encryption keys, the reference policy is sufficient as is.

For more information, see the AWS documentation for creating IAM policies.

Create the cross-account IAM role​

  1. In the AWS IAM Console, go to Roles → Create role.

  2. Trusted Entity Type: Select Custom trust policy.

  3. External ID: paste the External ID shown in the console's Infrastructure Access step. The principal account in the trust policy below is the Trust Account ID the console displays.

  4. Custom trust policy: Paste this trust policy.

     {
         "Version": "2012-10-17",
         "Statement": [
             {
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::757278738533:role/VeloDBDeploymentAssumer"
                 },
                 "Action": "sts:AssumeRole",
                 "Condition": {
                     "StringEquals": {
                         "sts:ExternalId": "<external-id>"
                     }
                 }
             }
         ]
     }

    Substitute the placeholders in this trust policy: replace <external-id> with the External ID shown in the console's Infrastructure Access step. Leave the Principal account (757278738533) as is: it is VeloDB Cloud's Trust Account ID, which the console also displays.

  5. Permissions: attach the deployment policy you created earlier.

  6. Name the role (for example, VeloDBCrossAccountRole) and create it.

  7. Copy the Role ARN, paste it into the Infrastructure Access step as the Cross-Account Role ARN, then click Confirm to save the credential.

For more information, see the AWS documentation for using IAM roles for cross-account access.

Verify the credential configuration​

The credential appears on the Credential Configuration tab of the Cloud Resources page after the console saves it. You can now select it when you create a network configuration or a warehouse deployed on Custom Infrastructure.

See also​