Ranger Prerequisites

1. Dedicated S3 buckets for teams managing Hadoop clusters and operations.
2. Hadoop Cluster Admin User: User with the following AWS IAM Permissions. Admin user’s accessKey and SecretKey will be used to configure the Ranger S3 service.

"Version": "2012-10-17",
 "Statement": [
  {
   "Sid": "AllowReadIAMMetadata",
   "Effect": "Allow",
   "Action": [
    "iam:GetUser",
    "iam:GetGroup",
    "iam:GetRole",
    "iam:ListUsers",
    "iam:ListGroups",
    "iam:ListRoles",
    "iam:ListAttachedUserPolicies",
    "iam:ListAttachedGroupPolicies",
    "iam:GetPolicy",
    "iam:GetPolicyVersion"
   ],
   "Resource": "*"
  },
  {
   "Sid": "AllowS3PolicyUpdate",
   "Effect": "Allow",
   "Action": [
    "s3:ListBucketPolicy",
    "s3:GetBucketPolicy",
    "s3:PutBucketPolicy",
    "s3:DeleteBucketPolicy"
   ],
   "Resource": "arn:aws:s3:::<all-hadoop-team-bucket-name>"
  }
 ]
}

1. Other IAM users belonging to users of one or more teams managing Hadoop clusters and operations with limited IAM Permissions.