Configure AWS Per-User Authentication

For  Designer Cloud Enterprise Edition, you can configure AWS authentication on a per-user basis, using temporary credentials for superior security. 

Enable

The following parameters must be set:

"aws.readFromConfigurationService": false,

"aws.mode": "user",

To authenticate to AWS services from the Designer Cloud Powered by Trifacta platform using an IAM role:

"aws.ec2InstanceRoleForAssumeRole": true,

Configure Per-User Authentication using IAM Role

Please complete the following general steps.

Steps:

1. Instance role: Create an IAM role and link it to the EC2 instance where the Alteryx node is hosted. Include the following IAM policy: 

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": "sts:AssumeRole",
               "Resource": "arn:aws:iam::*:role/*"
           }
       ]
   } 

2. User role: Create another IAM role and provides required access to the S3 buckets. Example:
   
   

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "MyBucketAndObjectPermissions",
               "Action": [
                   "s3:GetBucketLocation",
                   "s3:ListBucket",
                   "s3:DeleteObject",
                   "s3:GetObject",
                   "s3:PutObject"
               ],
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:s3:::<my_s3_bucket>",
                   "arn:aws:s3:::<my_s3_bucket>/*"
               ]
           },
           {
               "Sid": "TrifactaPublicDatasets",
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:ListBucket"
               ],
               "Resource": [
                   "arn:aws:s3:::trifacta-public-datasets/*",
                   "arn:aws:s3:::trifacta-public-datasets"
               ]
           }
       ]
   }

   where:
   <my_s3_bucket> is the name of your bucket.

3. Under the user role definition, edit the Trust relationship. Add the instance role to Principal:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": [
           "arn:aws:iam::       awsAccountId:role/instanceRole"
           ]
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }

   
   

   1. For more information, see Insert Trust Relationship in AWS IAM Role.

   2. For more granular control over the Trust relationship, see https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html.

4. AWS Glue: If you are integrating with AWS Glue, additional permissions must be set. For more information, see Enable AWS Glue Access.

5. Log in the Designer Cloud Powered by Trifacta platform as a Alteryx admin.

6. Click the link to specify storage settings. Populate the values for:
   1. IAM role
   2. Role ARN
   3. S3 Bucket Name

7. Save your changes.

User Access

After per-user authentication has been enabled, each user must provide or be provided the credentials and S3 bucket to use. Users can insert a default S3 bucket and credentials to use in their profiles. See Configure Your Access to S3.