Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Published by Scroll Versions from space DEV and version next

...

  1. Administrators should complete the first section to set up the product for use. 
  2. After set up is complete, individual users should complete the second section to get started using the product.

Setup Process

Tip

Having difficulties? To speak to a support representative, click the icon in the corner and submit your question.

Steps:

  1. Before you begin. You should prepare your If you are using your own AWS S3 buckets, you should prepare them and their access policies to ensure that 

    D s product
    productaws
     can integrate with them. 

    Info

    NOTE: If you do not have these AWS resources, they can be created for you. Details are below.

    1. Technical setup: Please share the technical setup section with your S3 administrator.
  2. Register. Complete the simple online workflow to license and create your 
    D s product
    productaws
     workspace.
  3. Workspace setup. Before you invite other users to your workspace, you should complete a few setup steps.
  4. Invite users. If you intend to share the workspace with other users, you can invite them from within it. 
  5. Wrangle away! 

...

Hosted on Amazon Web Services, 

D s product
productaws
 is designed to natively interact with all of your AWS datasources, so that you can rapidly transform your data investments in AWS.  

AWS Overview

Below are the AWS objects that are required for setup. 

Tip

Tip: If you do not have immediate access to these assets, some can be created as part of the workflow setup.


AWS objectRequired?Description
AWS accountY

To create these objects are part of the setup process, you must have an AWS account. For more information, see https://aws.amazon.com/.

Valid email addressYTo validate your registration for a new workspace, you must have a valid email address to which the product can deliver the registration email.
Choice: cross-account role access or key-secret accessY

To integrate with your existing S3 resources, you must choose a method of authentication. Choices:

  • cross-account role: This method uses IAM roles to define the permissions used by the product for S3 access.

    Tip

    Tip: This method is recommended.

  • key-secret access: This method uses an IAM access keys to provide S3 access.
IAM policyY

An IAM (Identity and Access Management) policy is an AWS resource used to define the low-level permissions for access to a specific resource. During setup, you can use or create a new IAM policy for the product to use for either access method.

For more information, see "Create policy to grant access to S3 bucket" below.

cross-account role access: IAM roleY

An IAM role contains one or more IAM policies that can be used to define the set of available AWS services and the level of access to them for a user. In this case, the user is the

D s webapp
.

key-secret access: AWS key-secretYAn older AWS access method, the key-secret combination is essentially a username and password combination to one or more S3 buckets.
S3 bucketYS3 (Simplified Storage Service) is a cloud-based file storage system hosted in AWS. An S3 bucket contains your data files and their organizing folders.
S3 bucket: encryptionN

For better security, your S3 bucket may be encrypted, which means that the data is stored inside of S3 in a way that is not human-readable.

Info

NOTE: The product can optionally integrate with encrypted S3 buckets. The following S3 encryption methods are supported: sse-s3 and sse-kms.

Info

NOTE: If your bucket is encrypted with ss3-kms, additional configuration is required. See "Update policy to accommodate SSE-KMS if necessary" below.

For more information on your bucket's encryption, please contact your S3 administrator.

S3 bucket: storage locationN

If needed, you can change the location where results are stored in S3.

Info

NOTE: The product must have write permission to this location. If you are changing the location from the default, please verify with your S3 administrator that the preferred location is enabled for writing through your access method.

Workspace nameYDuring setup, you must create a unique workspace identifier. This identifier cannot contain spaces or special characters.
IAM role: Account IDN

The account ID identifies in the trust policy that

D s item
itemAWS account
can use your IAM role.

Tip

Tip: This identifier is provided to you during registration and setup.

IAM role: External IDN

The external ID identifies in the trust policy that

D s product
productaws
can use your IAM role only on your behalf.

Tip

Tip: This identifier is provided to you during registration and setup.

Technical Setup

The following sections should be provided to your AWS administrator for setting up access to these resources, if required.

...

  1. One of the statements grants access to the trifacta3fac-data-public-datasets bucket, which contains resources used for the onboarding tour.  Replace  bucket.  
  2. Replace <my_default_S3_bucket> with the name of your default S3 bucket.
  3. To grant access to multiple buckets within your account, you can extend the resources list to accommodate the additional buckets.

...

Code Block
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::<my_default_S3_bucket>",
                "arn:aws:s3:::<my_default_S3_bucket>/*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::trifacta3fac-data-public-datasets",
                "arn:aws:s3:::trifacta3fac-data-public-datasets/*"
            ]
        }
    ]
}

Update policy to accommodate SSE-KMS if necessary

If any accessible bucket is encrypted with SSE-KMS, another policy must be deployed. See https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html.

Whitelist the IP address range of the 
D s item
itemService
, if necessary

...

Add policy for Redshift access

If you are connecting to Redshift databases through your workspace, you can enable access by creating a GetClusterCredentials policy. This policy is additive to the the S3 access policies. All of these policies can be captured in a single IAM role. 

Example:

Code Block
{
"Version": "2012-10-17",
  "Statement": [
    {
     "Sid": "GetClusterCredsStatement",
      "Effect": "Allow",
      "Action": [
        "redshift:GetClusterCredentials"
      ],
      "Resource": [
        "arn:aws:redshift:us-west-2:123456789012:dbuser:examplecluster/${redshift:DbUser}",
        "arn:aws:redshift:us-west-2:123456789012:dbname:examplecluster/testdb",
        "arn:aws:redshift:us-west-2:123456789012:dbgroup:examplecluster/common_group"
      ],
        "Condition": {
            "StringEquals": {
           "aws:userid":"AIDIODR4TAW7CSEXAMPLE:${redshift:DbUser}@yourdomain.com"
                            }
                      }
    },
  }
}

For more information on these permissions, see Required AWS Account Permissions.

Whitelist the IP address range of the 
D s item
itemService
, if necessary

If you are enabling any relational source, including Redshift, you must whitelist the IP address range of the 

D s item
itemservice
 in the relevant security groups.  The .  

Info

NOTE: The database to which you are connecting must be available from the

D s item
itemservice
over the public Internet.

The IP address range of the 

D s item
itemservice
 is:

...

After you have completed registration, please login to the applicationthe application. The Home page is displayed.

Info

NOTE: You can now access online documentation through the application. From the left menu bar, select Help menu > Documentation.

...


  1. You can invite other people to join your workspace. 
    1. When users initially join your workspace, they are assigned a non-admin role. Through the Workspace Users page, you can assign roles.
    2. Select User menu > Admin Console > Users. Then, click Invite Users.
    3. For more information, see Workspace Users Page.
  2. The workspace administrators must provide credentials for each workspace member account. See Workspace Users Page. See Workspace Users Page.

Example Flows

When a new workspace is created, the first user is provided a set of example flows. These flows are intended to teach by example and illustrate many recommended practices for building your own flows. For more information on example flows, see Workflow Basics.

Getting Started for Workspace Users

...

The following resources can assist workspace users in getting started with wrangling.

...

Tip

Tip: Check out the product walkthrough available through in-app chat! This tour steps through each phase of ingesting, transforming, and generating results for your data.