Ranger Prerequisites

1. Dedicated S3 buckets for teams managing Hadoop clusters and operations.
2. Hadoop Cluster Admin User: User with the following AWS IAM Permissions. Admin user’s accessKey and SecretKey will be used to configure the Ranger S3 service.

"Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "AllowReadIAMMetadata",
 "Effect": "Allow",
 "Action": [
 "iam:GetUser",
 "iam:GetGroup",
 "iam:GetRole",
 "iam:ListUsers",
 "iam:ListGroups",
 "iam:ListRoles",
 "iam:ListAttachedUserPolicies",
 "iam:ListAttachedGroupPolicies",
 "iam:GetPolicy",
 "iam:GetPolicyVersion"
 ],
 "Resource": "*"
 },
 {
 "Sid": "AllowS3PolicyUpdate",
 "Effect": "Allow",
 "Action": [
 "s3:ListBucketPolicy",
 "s3:GetBucketPolicy",
 "s3:PutBucketPolicy",
 "s3:DeleteBucketPolicy"
 ],
 "Resource": "arn:aws:s3:::<all-hadoop-team-bucket-name>"
 }
 ]
}

1. Other IAM users belonging to users of one or more teams managing Hadoop clusters and operations with limited IAM Permissions.