AWS IAM permissions¶

The deploying credentials are the AWS identity that runs terraform apply for qumulo_filesystem_aws. This page lists what that identity, and the roles and keys around it, must be allowed to do.

Service access¶

Service	What the provider manages	When it is needed
IAM	Roles and instance profiles for the cluster nodes and the provisioner	Every cluster. Not needed for a role supplied through `cluster_iam_role_arn` or `provisioner_iam_role_arn`.
EC2	Instances, EBS volumes, and security groups	Every cluster. Security groups are not created when `cluster_security_group_id` and `provisioner_security_group_id` are set.
S3	The cluster's persistent storage buckets	Every cluster

Specific actions¶

Action	When it is needed
`ec2:ModifyInstanceAttribute`	Every cluster, to lift deletion protection from an instance before terminating it
`s3:GetBucketPolicy`	Every cluster, to lift deletion protection from a bucket before deleting it
`s3:PutBucketPolicy`	Every cluster
`tag:GetResources`	Every cluster, to find its S3 buckets by their `Qumulo-Cluster` tag on destroy, on update, and on refresh with `deletion_protection`
`ssm:GetParameter` on `/qumulo/<deployment_unique_name>/bucket-names`, and `kms:Decrypt` on the account's `aws/ssm` key	Every cluster. Every bucket lookup reads the bucket list that clusters built with `aws-terraform-cnq` keep in that SecureString parameter. For a cluster the provider created, the read returns "not found"
`ec2:DescribeSubnets`	Every cluster, to derive each subnet's availability zone
`ec2:DescribeInstanceAttribute`	When `deletion_protection` is set
`logs:DescribeLogGroups`, `logs:CreateLogGroup`, `logs:TagResource`	When `audit_logging = true`
`iam:PassRole` on the supplied role	When `cluster_iam_role_arn` or `provisioner_iam_role_arn` is set

logs:DeleteLogGroup is not required.

Warning

Without tag:GetResources, terraform destroy terminates the instances and then fails, leaving every <random>-<deployment_name>-qps-<N> bucket behind. Running terraform destroy again does not retry the bucket cleanup.

Customer-managed KMS key¶

Principal	Actions on the key	When it is needed
The IAM roles the provider creates	`kms:Encrypt`, `kms:Decrypt`, `kms:GenerateDataKey`, `kms:DescribeKey`	When `kms_key_id` is set

The key must be in the same region as the cluster, or be a multi-region replica in that region.

Cross-account AMIs¶

Grant	Granted by	When it is needed
Launch permission on the AMI	The AMI owner's account	When `ami_id` or `provisioner_ami_id` names an AMI owned by another account
`kms:Decrypt`, `kms:DescribeKey`, `kms:CreateGrant` on the snapshot's key	The key policy in the AMI owner's account	When that AMI's backing snapshot is encrypted

Permissions boundaries¶

When permissions_boundary_arn is set, the provider attaches the same boundary to the cluster node role and the provisioner role. The boundary must allow the S3, EC2, KMS, Secrets Manager, and CloudWatch Logs permissions those roles use, or role creation fails with an IAM error.

Bring-your-own roles¶

A role supplied through cluster_iam_role_arn or provisioner_iam_role_arn must belong to exactly one instance profile. The cluster role's S3 policy must use the wildcard bucket pattern in AWS Bring Your Own IAM Roles.

Import¶

Importing an existing cluster needs further permissions, listed in the import reference.