IAM role authentication
When Dataphin runs on an Amazon EC2 instance, you can enable IAM role authentication to access Amazon S3 using the IAM role attached to the instance. You can also use an IAM role proxy to call AWS Secrets Manager (ASM) to automatically retrieve database credentials. This eliminates the need to manually enter an AccessKey or credentials for data sources and compute sources.
Limitations
Before you enable this feature, ensure that your Dataphin instance runs in an Amazon EC2 environment and that all EC2 instances where Dataphin is deployed are attached to the same IAM role with permissions to access the target resources.
IAM role authentication is disabled by default. After you enable this feature, you can select IAM role proxy as the authentication method for data sources and compute sources.
Permissions
Only accounts with the metadata warehouse tenant super administrator or system administrator role can enable or disable IAM role authentication.
Procedure
Log on to the metadata warehouse tenant with a metadata warehouse tenant super administrator or system administrator account.
On the Dataphin homepage, choose management center > system settings from the top menu bar.
In the left navigation pane, choose system O&M > IAM role authentication.
On the IAM role authentication page, click Edit to enable IAM role authentication. After this feature is enabled, the IAM role field displays the IAM role attached to the current deployment instance, which is retrieved automatically. Ensure that this role has the required permissions for the corresponding AWS services.
Click Save.
Related documents
After you enable IAM role authentication, you can select IAM role proxy as the authentication method to access Amazon S3 in the following scenarios:
Creating an Amazon S3 data source. For details, see Create an Amazon S3 data source.
Setting the file system for checkpoint storage to S3 when creating a Flink compute source. For details, see Create a Flink compute source.