Setup for AWS S3¶

Perform following steps to configure Dataserver with AWS-S3:

1. SSH into the instance where Privacera Manager is installed.

2. Open the vars.dataserver.aws.yml file.

   Bash
   1 2	cd ~/privacera/privacera-manager vi config/custom-vars/vars.dataserver.aws.yml

3. Modify the following properties:

   YAML
   1 2 3 4 5	DATASERVER_AWS_PROFILE_PROPERTIES: - PROFILE_NAME: "aws_account1" PROFILE_PROPERTIES: - AUTHN_METHOD: "CUSTOM_IAM" - IAM_ARN: "arn:aws:iam::<account_id>:role/<role_name>"

   Data Plane Mode

   • It is mandatory to set the DATASERVER_D2P_MODE_ENABLE and DATASERVER_AWS_MULTI_ACCOUNT_PROFILE_ENABLE properties to true to enable the DataServer for Data Plane mode.

     YAML

     1 2 3 4 5 6 7 8 9 10 11 12 13 14

     DATASERVER_D2P_MODE_ENABLE: "true" DATASERVER_AWS_MULTI_ACCOUNT_PROFILE_ENABLE: "true" DATASERVER_AWS_PROFILE_NAME_DEFAULT: "aws_account1" DATASERVER_AWS_PROFILE_NAMES: "aws_account1, aws_account2" DATASERVER_AWS_PROFILE_PROPERTIES: - PROFILE_NAME: "aws_account1" PROFILE_PROPERTIES: - AUTHN_METHOD: "CUSTOM_IAM" - IAM_ARN: "arn:aws:iam::<account_id>:role/<role_name>" - PROFILE_NAME: "aws_account2" PROFILE_PROPERTIES: - AUTHN_METHOD: "CUSTOM_IAM" - IAM_ARN: "arn:aws:iam::<account_id>:role/<role_name>" - IAM_ROLE_EXTERNAL_ID: "test1234"

4. Once the properties are configured, run the following commands:

   Bash

   1 2 3 4 5 6 7 8 9 10 11 12

   cd ~/privacera/privacera-manager # step 1 - Set up the environment, which generates the Helm charts. # This step usually takes a few minutes. ./privacera-manager.sh setup # step 2 - install or upgrade the Privacera Manager helm charts ./pm_with_helm.sh [install|upgrade] # step 3 - Perform post-installation steps, which generate the Plugin tarball, # updates Route 53 DNS, etc. ./privacera-manager.sh post-install

Perform following steps to configure Dataserver with AWS-S3 in PrivaceraCloud:

1. In PrivaceraCloud, navigate to Settings -> Applications.
2. On the Applications screen, select S3 application under Available connections.
3. Enter the application Name and Description, then click Save.
4. You will see Privacera Access Management and Data Discovery with toggle buttons.
5. Enable Privacera Access Management by toggling the button.
6. Under the BASIC tab, enter the following:
   • Profile Name: Enter a unique profile name for your application.

   You can set up multiple AWS accounts. You can see the tabs with your application names in the File Explorer.

   • AWS Account Setup:
     • Without IAM Role:
       • AWS Access Key: Enter the Access Key for the AWS account.
       • AWS Secret Key: Enter the Secret Key for the AWS account.
     • With IAM Role:
       • AWS IAM Role: Enter the full ARN of the IAM Role.
7. Click on the Test Connection button to verify the connection.
8. On the ADVANCED tab, you can add custom properties if needed.
9. Click on the Test Connection again to ensure the settings are correct, then click Save.

Perform the following steps to configure DataServer with AWS-S3 in a Runtime Manager deployment:

1. Go to Settings → Runtime Plane, open your runtime plane, and add Dataserver from the Connector tab.
2. On the Basic Info tab, enter a Name for the connector (for example, dataserver-stage), optionally add a Description, then select Continue.
3. Go to Access Control Configs → Connector Configs.
4. In the left panel, select a profile under Common Properties, or select Add Profile to create one. Add one AWS profile per account:
   • Give the profile a unique Profile Name (for example, aws_account1).
   • Set the Auth Method and its fields:
     • Custom IAM Role — enter the IAM Role ARN to assume. For cross-account access, optionally set the External ID.
     • Access Key — enter the Access Key ID and the Secret Access Key.
   • Repeat for each additional account (for example, aws_account2).
5. One profile shows the Default label. To change it, open another profile and select Set as default.
6. Select Save. The Runtime Manager redeploys the connector with the updated profiles.

For the IAM trust that a Custom IAM Role profile needs on a runtime plane, see the Runtime tab in Prerequisites for AWS S3.

Each profile also shows the following fields. Keep the default values unless your setup needs a change.

Field	Default	Description
Region	us-east-1	AWS Region for this profile.
AWS Services	S3	AWS services that this profile handles: S3, Athena, DynamoDB, Glue, Kinesis, or Lambda.
STS Role ARN	Empty	IAM role ARN that DataServer assumes to generate STS tokens for this profile, for the Databricks and signer flows.
STS Duration (seconds)	3600	How long the STS credentials issued for this profile are valid.
STS Expiry Buffer (seconds)	60	How many seconds before expiry DataServer refreshes the STS credentials.
STS Token Signing	true	Lets the signer generate STS tokens for this profile. Boto3 and native AWS SDK clients need it.
S3 Signed URL Expiry (ms)	600000	Expiry time of the S3 signed URLs generated for this profile.
S3 Client Execution Timeout (ms)	60000	Execution timeout of the S3 client for this profile.
S3 Requester Pays	false	Sends requester-pays headers on S3 requests for this profile.
Include User Info in Requests	false	Adds Privacera user information to outgoing AWS requests, for example to CloudWatch.
Ranger S3 Service Name	Empty	Ranger service that authorizes S3 requests for this profile. If empty, DataServer uses the default S3 service, privacera_s3. The named service must already exist.
Databricks Delta IAM Role ARN	Empty	IAM role ARN for the Databricks Delta use case on this profile.

To set a profile property that has no field in the form, open Additional Profile Properties in the profile and select Add property. Enter the key without the dataserver.aws.<profile-name>. prefix; the portal adds the prefix when you save. For example, enter use.regional.endpoint to set dataserver.aws.<profile-name>.use.regional.endpoint.