Create an IAM integration

Suppose you want your CelerData cloud account to have access to your AWS cloud resources (for example, connecting to your data lake built on top of S3 or loading data in bulk from your S3 bucket). In that case, you must establish a trust relationship between your CelerData cloud account and your AWS account.

You can achieve this by using an access key pair, which consists of two parts: an access key ID ("access key" for short) and a secret access key ("secret key" for short). However, using an access key pair is generally not recommended as a best practice by AWS. Since the CelerData services are also built on AWS cloud resources, you can consider a more secure approach: using a cross-account IAM role.

This tutorial walks you through all the steps necessary to set up a trust relationship between your CelerData cloud account and your AWS account by using a cross-account IAM role.

Follow these steps:

1. Sign in to the CelerData Cloud Serverless console.

2. In the left-side navigation pane, choose Integration. Then on the Connect to your applications page click AWS IAM.

   

3. On the Create new IAM integration tab of the AWS IAM page, view the IAM policies in the Step 1 section and the trust policy in the Step 2 section. You will need these when you create IAM policies and configure your IAM role in the next steps.

   

4. Sign in to the AWS IAM console as a user with administrator privileges.

5. In the left-side navigation pane, choose Access management > Policies. Then, create the IAM policies you will need for your operations.

   For the JSON policy documents you need to paste to the Policy editor section, see the IAM policies provided in the CelerData Cloud Serverless console or AWS IAM policies.

   NOTICE

   When you copy and paste the JSON policy document that grants access to AWS S3, remember to replace <bucket_name> with the S3 bucket you want to access.

   For the detailed steps to create IAM policies, see Creating IAM policies.

6. In the left-side navigation pane, choose Access management > Roles. Then, create an IAM role, and attach the IAM policies you created to the IAM role.

7. On the IAM role's details page, click the Trust relationships tab, and then click Edit trust policy in the upper-right corner of the tab.

8. On the Edit trust policy page, paste the trust policy which you can obtain from the Step 2 section on the Create new IAM integration tab of the AWS IAM page in the CelerData Cloud Serverless console. (Remember to set the AWS and sts:ExternalId elements in the trust policy to the Service role ARN and AWS External ID, respectively, which you can obtain from the Homepage of the CelerData Cloud Serverless console.) Then, click Update policy.

   

9. Obtain the ARN of the IAM role you created and save it to a location that you can access later.

10. Return to the CelerData Cloud Serverless console. On the Create new IAM integration tab of the AWS IAM page, paste the IAM role ARN to the field in the Step 3 section. Then, click Create integration.

    

    When the system displays a success message, the integration is successfully created. You can view the created integration on the View all IAM integrations tab of the page.

Then you can use the IAM role ARN and the external ID to access your AWS cloud resources. For example, you can query external data stored on your AWS Cloud by using external catalogs or batch load data from your AWS S3 bucket.