Skip to content

Commit 1f4e809

Browse files
Ryan Astonmarkzegarelli
Ryan Aston
and
markzegarelli
authored
Update data-lakes-manual-setup.md (#4756)
Consolidated IAM role setup for US and EU Co-authored-by: markzegarelli <[email protected]>
1 parent 376282b commit 1f4e809

File tree

1 file changed

+2
-39
lines changed

1 file changed

+2
-39
lines changed

src/connections/storage/data-lakes/data-lakes-manual-setup.md

+2-39
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ The following steps provide examples of the IAM Role and IAM Policy.
9191

9292
Create a `segment-data-lake-role` for Segment to assume. The trust relationship document you attach to the role will be different depending on your workspace region.
9393

94-
#### IAM role for Data Lakes created in US workspaces:
94+
#### IAM role for Data Lakes:
9595

9696
Attach the following trust relationship document to the role to create a `segment-data-lake-role` role for Segment:
9797

@@ -104,9 +104,7 @@ Attach the following trust relationship document to the role to create a `segmen
104104
"Effect": "Allow",
105105
"Principal": {
106106
"AWS": [
107-
"arn:aws:iam::294048959147:role/customer-datalakes-prod-admin",
108-
"arn:aws:iam::294048959147:role/datalakes-aws-worker",
109-
"arn:aws:iam::294048959147:role/datalakes-customer-service"
107+
"arn:aws:iam::595280932656:role/segment-datalakes-production-access"
110108
]
111109
},
112110
"Action": "sts:AssumeRole",
@@ -125,41 +123,6 @@ Attach the following trust relationship document to the role to create a `segmen
125123
> note ""
126124
> Replace the `ExternalID` list with the Segment `WorkspaceID` that contains the sources to sync to the Data Lake.
127125
128-
#### IAM role for Data Lakes created in EU workspaces:
129-
130-
> info ""
131-
> EU workspaces are currently in beta. If you would like to learn more about the beta, please contact your account manager.
132-
133-
Attach the following trust relationship document to the role to create a `segment-data-lake-role` role for Segment.
134-
135-
```json
136-
{
137-
"Version": "2012-10-17",
138-
"Statement": [
139-
{
140-
"Sid": "",
141-
"Effect": "Allow",
142-
"Principal": {
143-
"AWS": [
144-
"arn:aws:iam::595280932656:role/segment-datalakes-production-access",
145-
]
146-
},
147-
"Action": "sts:AssumeRole",
148-
"Condition": {
149-
"StringEquals": {
150-
"sts:ExternalId": [
151-
"WORKSPACE_ID"
152-
]
153-
}
154-
}
155-
}
156-
]
157-
}
158-
```
159-
160-
> note ""
161-
> **NOTE:** Replace the `ExternalID` list with the Segment `WorkspaceID` that contains the sources to sync to the Data Lake.
162-
163126
### IAM policy
164127

165128
Add a policy to the role created above to give Segment access to the relevant Glue databases and tables, EMR cluster, and S3.

0 commit comments

Comments
 (0)