{"type":"doc","content":[{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This policies are required by Lakehouse Optimizer App being deployed on an AWS EC2 instance running on same AWS account where monitored Databricks Workspaces belong to.","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Instance Profile IAM Role (of the LHO Application VM) with at least the following policies assigned:","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"BplmAWSCostReader\",\n \"Effect\": \"Allow\",\n \"Action\": \"ce:GetCostAndUsage\",\n \"Resource\": \"*\"\n }\n ]\n}\n","type":"text"}]},{"type":"paragraph","content":[{"text":"Allow Read of created secret","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"You will need to update this policy definition with your aws account ID and secret name.","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"BplmSecretsReader\",\n \"Effect\": \"Allow\",\n \"Action\": \"secretsmanager:GetSecretValue\",\n \"Resource\": \"arn:aws:secretsmanager:*:{AWS Account ID}:secret:{SecretNameHere}*\"\n }\n ]\n}\n","type":"text"}]},{"type":"paragraph","content":[{"text":"Allow management of DynamoDB and Simple Queue Service","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"You will need to update this policy definition with your aws account ID.","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"BplmDynamoPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"dynamodb:CreateTable\",\n \"dynamodb:UpdateTable\",\n \"dynamodb:UpdateTimeToLive\",\n \"dynamodb:DescribeTable\",\n \"dynamodb:Scan\",\n \"dynamodb:Query\",\n \"dynamodb:BatchGetItem\"\n ],\n \"Resource\": [\n \"arn:aws:dynamodb:*:{AWS Account ID}:table/*bplm*\"\n ]\n },\n {\n \"Sid\": \"BplmSqsPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"sqs:DeleteMessage\",\n \"sqs:GetQueueUrl\",\n \"sqs:ReceiveMessage\",\n \"sqs:CreateQueue\"\n ],\n \"Resource\": [\n \"arn:aws:sqs:*:{AWS Account ID}:*bplm*\"\n ]\n }\n ]\n}\n","type":"text"}]},{"type":"paragraph","content":[{"text":"Allow s3 bucket tag get\\set used for reporting workspace storage cost","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"BplmS3TaggingWkspStorageCostPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:GetBucketTagging\",\n \"s3:PutBucketTagging\"\n ],\n \"Resource\": \"arn:aws:s3:::*\"\n }\n ]\n}\n","type":"text"}]},{"type":"paragraph","content":[{"text":"Allow EC2 tag management for reporting workspace Nat Gateway costs","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"You will need to update this policy definition with your aws account ID.","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"BplmNatGatewayTaggingPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"ec2:DeleteTags\",\n \"ec2:CreateTags\"\n ],\n \"Resource\": [\n \"arn:aws:ec2:*:{AWS Account ID}:natgateway/*\",\n \"arn:aws:ec2:*:{AWS Account ID}:natgateway/*\",\n \"arn:aws:ec2:*:{AWS Account ID}:vpc/*\",\n \"arn:aws:ec2:*:{AWS Account ID}:internet-gateway/*\",\n \"arn:aws:ec2:*:{AWS Account ID}:elastic-ip/*\",\n \"arn:aws:ec2:*:{AWS Account ID}:route-table/*\",\n \"arn:aws:ec2:*:{AWS Account ID}:vpc-endpoint/*\"\n ]\n },\n {\n \"Sid\": \"BplmNatGatewayVpcsTaggingPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"ec2:DescribeVpcs\",\n \"ec2:DescribeNatGateways\",\n \"ec2:DescribeVpcEndpoints\",\n \"ec2:DescribeAddresses\",\n \"ec2:DescribeInternetGateways\",\n \"ec2:DescribeRouteTables\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Delivered billable usage logs:","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"BplmBillableUsageS3ReadFiles\",\n \"Effect\": \"Allow\",\n \"Action\": \"s3:GetObject\",\n \"Resource\": \"arn:aws:s3::://*\"\n },\n {\n \"Sid\": \"BplmBillableUsageS3ListBuckets\"\n \"Effect\": \"Allow\",\n \"Action\": \"s3:ListBucket\",\n \"Resource\": \"arn:aws:s3:::\",\n \"Condition\": {\n \"StringLike\": {\n \"s3:prefix\": \"/*\"\n }\n }\n },\n {\n \"Sid\": \"BplmDecryptS3WithKMS\",\n \"Effect\": \"Allow\",\n \"Action\": \"kms:Decrypt\",\n \"Resource\": \"*\"\n }\n ]\n}\n","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"One could use \"Resource\": \"arn:aws:kms:{KMS key region}:{AWS Account ID}:key/{SSE KMS key for s3 bucket}\" to narrow down the BplmDecryptS3WithKMS permission only for specific key","type":"text"}]}]},{"type":"paragraph","content":[{"text":"CostAndUsage Report 1.0 for cloud costs:","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"CostAndUsageS3GetObject\",\n \"Effect\": \"Allow\",\n \"Action\": \"s3:GetObject\",\n \"Resource\": \"arn:aws:s3::://*\"\n },\n {\n \"Sid\": \"CostAndUsageS3ListBucket\"\n \"Effect\": \"Allow\",\n \"Action\": \"s3:ListBucket\",\n \"Resource\": \"arn:aws:s3:::\",\n \"Condition\": {\n \"StringLike\": {\n \"s3:prefix\": \"/*\"\n }\n }\n }\n ]\n}\n","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Final template for IAM Role for Lakehouse Optimizer App EC2 VM","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This is just aggregated version from the aforementioned templates","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"BplmAWSCostReader\",\n \"Effect\": \"Allow\",\n \"Action\": \"ce:GetCostAndUsage\",\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"BplmSecretsReader\",\n \"Effect\": \"Allow\",\n \"Action\": \"secretsmanager:GetSecretValue\",\n \"Resource\": \"arn:aws:secretsmanager:*:{AWS Account ID}:secret:{SecretNameHere}*\"\n },\n {\n \"Sid\": \"BplmDynamoPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"dynamodb:CreateTable\",\n \"dynamodb:UpdateTable\",\n \"dynamodb:UpdateTimeToLive\",\n \"dynamodb:DescribeTable\",\n \"dynamodb:Scan\",\n \"dynamodb:Query\"\n ],\n \"Resource\": [\n \"arn:aws:dynamodb:*:{AWS Account ID}:table/*bplm*\"\n ]\n },\n {\n \"Sid\": \"BplmSqsPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"sqs:DeleteMessage\",\n \"sqs:GetQueueUrl\",\n \"sqs:ReceiveMessage\",\n \"sqs:CreateQueue\"\n ],\n \"Resource\": [\n \"arn:aws:sqs:*:{AWS Account ID}:*bplm*\"\n ]\n },\n {\n \"Sid\": \"BplmS3TaggingWkspStorageCostPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:GetBucketTagging\",\n \"s3:PutBucketTagging\"\n ],\n \"Resource\": \"arn:aws:s3:::*\"\n },\n {\n \"Sid\": \"BplmNatGatewayTaggingPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"ec2:DeleteTags\",\n \"ec2:CreateTags\"\n ],\n \"Resource\": \"arn:aws:ec2:*:{AWS Account ID}:natgateway/*\"\n },\n {\n \"Sid\": \"BplmNatGatewayVpcsTaggingPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"ec2:DescribeVpcs\",\n \"ec2:DescribeNatGateways\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"BplmBillableUsageS3ReadFiles\",\n \"Effect\": \"Allow\",\n \"Action\": \"s3:GetObject\",\n \"Resource\": \"arn:aws:s3::://*\"\n },\n {\n \"Sid\": \"BplmBillableUsageS3ListBuckets\",\n \"Effect\": \"Allow\",\n \"Action\": \"s3:ListBucket\",\n \"Resource\": \"arn:aws:s3:::\",\n \"Condition\": {\n \"StringLike\": {\n \"s3:prefix\": \"/*\"\n }\n }\n },\n {\n \"Sid\": \"BplmDecryptS3WithKMS\",\n \"Effect\": \"Allow\",\n \"Action\": \"kms:Decrypt\",\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"CostAndUsageS3GetObject\",\n \"Effect\": \"Allow\",\n \"Action\": \"s3:GetObject\",\n \"Resource\": \"arn:aws:s3::://*\"\n },\n {\n \"Sid\": \"CostAndUsageS3ListBucket\"\n \"Effect\": \"Allow\",\n \"Action\": \"s3:ListBucket\",\n \"Resource\": \"arn:aws:s3:::\",\n \"Condition\": {\n \"StringLike\": {\n \"s3:prefix\": \"/*\"\n }\n }\n }\n ]\n}","type":"text"}]}],"version":1}

Browser not supported