{"type":"doc","content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"AWS CostExplorer","type":"text"}]},{"type":"paragraph","content":[{"text":"LHO Application IAM Role will assume an IAM Role in the Databricks Workspace AWS Account with a permission policy to access Cost Explorer data in that AWS Account Id:","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"IAM_Role_Cost_Explorer permission policy:","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"AllowGetCostAndUsages\",\n \"Effect\": \"Allow\",\n \"Action\": \"ce:GetCostAndUsage\",\n \"Resource\": \"*\"\n }\n ]\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Trust policy for the ","type":"text"},{"text":"IAM_Role_Cost_Explorer","type":"text","marks":[{"type":"strong"}]},{"text":" that allows the LHO Application IAM Role in the app-host AWS Account to assume the cost explorer role:","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam:::role/\"\n },\n \"Action\": \"sts:AssumeRole\",\n }\n ]\n}","type":"text"}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Permissions for cost-tagging NAT and S3","type":"text"}]},{"type":"paragraph","content":[{"text":"In order to obtain workspace storage and network costs, the LHO should be provided permissions to tag S3 bucket and NAT Gateway associated with the Databricks workspace:","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"IAM_Role_Cost_Tag_For_S3_And_NAT permission policy:","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"BplmS3TaggingWkspStorageCostPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:GetBucketTagging\",\n \"s3:PutBucketTagging\"\n ],\n \"Resource\": \"arn:aws:s3:::*\"\n },\n {\n \"Sid\": \"BplmNatGatewayTaggingPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"ec2:DeleteTags\",\n \"ec2:CreateTags\"\n ],\n \"Resource\": [\n \"arn:aws:ec2:*::natgateway/*\",\n \"arn:aws:ec2:*::natgateway/*\",\n \"arn:aws:ec2:*::vpc/*\",\n \"arn:aws:ec2:*::internet-gateway/*\",\n \"arn:aws:ec2:*::elastic-ip/*\",\n \"arn:aws:ec2:*::route-table/*\",\n \"arn:aws:ec2:*::vpc-endpoint/*\"\n ]\n },\n {\n \"Sid\": \"BplmNatGatewayVpcsTaggingPolicy\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"ec2:DescribeVpcs\",\n \"ec2:DescribeNatGateways\",\n \"ec2:DescribeVpcEndpoints\",\n \"ec2:DescribeAddresses\",\n \"ec2:DescribeInternetGateways\",\n \"ec2:DescribeRouteTables\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Trust policy for the ","type":"text"},{"text":"IAM_Role_Cost_Tag_For_S3_And_NAT","type":"text","marks":[{"type":"strong"}]},{"text":" that allows the LHO Application IAM Role in the app-host AWS Account to assume the role:","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam:::role/\"\n },\n \"Action\": \"sts:AssumeRole\",\n }\n ]\n}","type":"text"}]},{"type":"paragraph"},{"type":"paragraph"},{"type":"heading","attrs":{"level":4},"content":[{"text":"LHO application IAM Role permission policy:","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"AssumeCostExplorerRole\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Resource\": \"arn:aws:iam:::role/\"\n },\n {\n \"Sid\": \"AssumeS3AndNatTagRole\",\n \"Effect\": \"Allow\",\n \"Action\": \"sts:AssumeRole\",\n \"Resource\": \"arn:aws:iam:::role/\"\n }\n ]\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"And in the Lakehouse Optimizer .env config file provide the source role name for cost explorer and tags. ","type":"text"}]},{"type":"codeBlock","content":[{"text":"CROSS_ACCOUNT_ASSUME_IAM_ROLE_COST_EXPLORER_APP=arn:aws:iam:::role/\nCROSS_ACCOUNT_ASSUME_IAM_ROLE_TAG_WORKSPACE_RESOURCE_APP=arn:aws:iam:::role/","type":"text"}]},{"type":"paragraph","content":[{"text":"In case of multiple AWS accounts hosting cloud resources for Databricks workspaces, you need to provide a comma-separated list of roles, one role for each AWS account.","type":"text"}]}],"version":1}

Browser not supported