Configuring available AWS roles for a workspace

For authentication to a PostgreSQL, MySQL, or Amazon Redshift server connection, you can choose to use an IAM role instead of a password. The Data Agent can also use IAM roles to connect to Amazon S3 or Kafka.

You configure the available roles from the AWS Roles section of the workspace settings page.

AWS Roles section of the workspace settings page

Adding a role

To add an AWS role:

1. Click Add AWS Role.

Add AWS role panel to add a role to the list

1. In the Name field, provide the name of the role.
2. In the Role ARN field, provide the ARN of the role.
3. In the Region field, provide the AWS Region for the role.
4. Optionally, in the Note field, provide a description of how the role is intended to be used.
5. Note that before you can test or use the role, you must configure the role trust policy in AWS. To test the role, click Test Role.
6. To save the role, click Save.

Configuring the trust policy for the role

The role's trust policy must allow the Fabricate's principal to call sts:AssumeRole with a condition that requires sts:ExternalId to equal the external ID.

Here is an example trust policy. The role creation panel also provides access to an example policy. To display the example policy, click Show trust policy. To copy the example policy, click Copy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<Fabricate assumer role ARN>"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<external ID>"
        }
      }
    }
  ]
}

In the policy:

• Replace <Fabricate assumer role ARN> with the ARN for the assumer role.

  • On Fabricate Cloud, the example policy automatically populates the assumer role ARN.
  • On a self-hosted instance, the assumer role ARN is the value of the environment variable FABRICATE_AWS_ASSUMER_ROLE_ARN. You obtain the value from your Fabricate administrator.
• Replace <external ID> with the external identifier that Fabricate generates and displays in the External ID field.

Editing a role

To edit the role configuration:

1. Click the edit icon for the role.
2. Update the role configuration.
3. Click Save.

Deleting a role

You cannot delete a role that is currently used by a server connection.

To delete a role, click its delete icon.