Integrations
Integrations
Breadcrumbs

AWS IAM

Introduction

This plugin is used in coordination with the storage technology plugins connected to AWS IAM to provision the groups that represent the DSAs, and it additionally manages the memberships that represent users' acceptance of the DSAs.

Services available in the plugin

  • Create and associate permissions to groups: Create groups with users, associate permissions to the bucket access group and to parts of it.

  • Add user to groups: Add users to existing groups.

  • Remove users from groups: Remove users from groups.

  • Remove access: Modify the group's policies to remove access to a particular resource.

  • Delete groups: Delete previously created groups, deleting the policy created for it.

Integration model

Active governance of access permissions

In general terms, the DSAs (Data Sharing Agreements) managed in Anjana Data are represented as groups in AWS IAM, and the users signing each agreement are managed as members of those groups. In this way, group membership materializes effective access to the data resources governed by the DSA.

Anjana Data Platform automatically creates, updates, and deletes these groups, including or excluding users according to the adherence and withdrawal processes defined in the platform. This ensures that the permissions assigned in AWS always remain aligned with the governance and validation status of the agreements.

The groups created by Anjana Data Platform follow this naming convention:

<configurable prefix>_<DSA logical name>_v<DSA version number>

Where:

  • <configurable prefix>: prefix defined by the organization to identify the groups managed by Anjana Data Platform. It is configured in the plugin's YAML.

  • <DSA logical name>: functional name of the agreement as it appears in Anjana.

  • v<DSA version number>: DSA version number, which allows distinguishing between active and historical versions.

The provisioning of these groups and the management of their members is carried out through the AWS SDK interface, which Anjana Data Platform uses to automate the lifecycle of the groups and ensure their consistency with the governance model.

Required credentials

Active permission governance

For active governance, a service credential with the following IAM permissions is needed:

  • AddUserToGroup: Add users to groups.

  • AttachGroupPolicy: Associate access policies with groups.

  • CreateGroup: Create groups.

  • CreatePolicy: Create access policies.

  • CreatePolicyVersion: Creates a new version of a policy.

  • DeleteGroup: Delete groups.

  • DeletePolicy: Deletes a policy.

  • DeletePolicyVersion: Deletes a version of a policy.

  • DeleteGroupPolicy: Deletes the policies of a group.

  • DetachGroupPolicy: Detach the managed policies from a group.

  • GetGroup: Retrieve groups

  • GetPolicy: Retrieve policies.

  • GetPolicyVersion: Retrieves a version of a policy.

  • GetUser: List and retrieve users.

  • ListAttachedGroupPolicies: Lists and retrieves the managed policies of a group.

  • ListGroupPolicies: Lists and retrieves the policies of a group.

  • ListPolicyVersions: Lists the versions of a policy.

  • RemoveUserFromGroup: Remove users from groups.

In addition, it will need the following S3 permissions:

  • ListAllMyBuckets: Retrieve the list of available buckets

  • GetObject: Retrieve file information (assign on specific buckets)

  • ListBucket: List objects within a bucket (assign on specific buckets)

  • GetBucketLocation: List the region of a bucket (assign on specific buckets)

The available services use the following permissions:

  • Create and associate permissions to groups: AddUserToGroup, AttachGroupPolicy, CreateGroup, CreatePolicy, GetGroup and GetUser.

  • Add user to groups: AddUserToGroup, GetGroup and GetUser.

  • Remove users from groups: GetGroup, GetUser and RemoveUserFromGroup.

  • Remove access: CreatePolicyVersion, DeletePolicyVersion, GetGroup, GetPolicyVersion and ListPolicyVersions.

  • Delete groups: DeleteGroup, DeleteGroupPolicy, DeletePolicy, DetachGroupPolicy, GetGroup, ListAttachedGroupPolicies, ListGroupPolicies and RemoveUserFromGroup.


Restrictions

The prefix for the groups (and the DSA name itself) cannot contain spaces, and the only allowed characters are alphanumeric characters and _=,.@- ; if the prefix has a value and is not valid, the plugin will not start and will generate a log with the error.

Given the maximum length of policies, it is not recommended to govern more than 100 datasets within the same DSA.

Due to AWS limitations, a user cannot be adherent to and/or be an owner of (the sum of both) more than X DSAs. The specific number of DSAs depends on the AWS quota: IAM Quotas