4 weeks ago
Hi
3 weeks ago - last edited 3 weeks ago
Hi Abhishek,
100% agree that "the recommended approach would be to modify the CloudFormation stack and re-apply it" as stated by AWS Support.
Here is a template which you can consider re-using to execute.
(Obviously you'll change the bucket, role names etc)
AWSTemplateFormatVersion: 2010-09-09
Resources:
UnityCatalogBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: "{{ TEAM_NAME }}-unity-catalog-{{ ENV }}"
UnityCatalogBucketRole:
Type: AWS::IAM::Role
Properties:
RoleName: "{{ TEAM_NAME }}-unity-catalog-{{ ENV }}"
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
AWS:
- arn:aws:iam::414351767826:role/unity-catalog-prod-UCMasterRole-14S5ZJVKOTYTL
- !Sub arn:aws:iam::${AWS::AccountId}:root
Action: sts:AssumeRole
Condition:
StringEquals:
AWS:PrincipalArn:
- !Sub arn:aws:iam::414351767826:role/unity-catalog-prod-UCMasterRole-14S5ZJVKOTYTL
- !Sub arn:aws:iam::${AWS::AccountId}:role/{{ TEAM_NAME }}-unity-catalog-{{ ENV }}
sts:ExternalId: "01481bf9-fd6f-4318-b9f4-4f3d743ff240"
ManagedPolicyArns:
- !Ref UnityCatalogBucketRolePolicy
UnityCatalogBucketRolePolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
ManagedPolicyName: "{{ TEAM_NAME }}-unity-catalog-{{ ENV }}"
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- s3:GetObject
- s3:PutObject
- s3:DeleteObject
- s3:ListBucket
- s3:GetBucketLocation
Resource:
- !Sub arn:aws:s3:::${UnityCatalogBucket}
- !Sub arn:aws:s3:::${UnityCatalogBucket}/*
- Effect: Allow
Action:
- sts:AssumeRole
Resource:
- !Sub arn:aws:iam::${AWS::AccountId}:role/{{ TEAM_NAME }}-unity-catalog-{{ ENV }}
If you run into issues, then I highly recommend creating a Databricks Support Ticket through the Help Center. https://help.databricks.com/s/ (as recommended by AWS Support).
Hope this helps.
3 weeks ago
@abhishekdas Thank you for your patience. We have been checking internally with a few folks for the best approach! We will keep you posted soon.
3 weeks ago - last edited 3 weeks ago
Hi Abhishek,
100% agree that "the recommended approach would be to modify the CloudFormation stack and re-apply it" as stated by AWS Support.
Here is a template which you can consider re-using to execute.
(Obviously you'll change the bucket, role names etc)
AWSTemplateFormatVersion: 2010-09-09
Resources:
UnityCatalogBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: "{{ TEAM_NAME }}-unity-catalog-{{ ENV }}"
UnityCatalogBucketRole:
Type: AWS::IAM::Role
Properties:
RoleName: "{{ TEAM_NAME }}-unity-catalog-{{ ENV }}"
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
AWS:
- arn:aws:iam::414351767826:role/unity-catalog-prod-UCMasterRole-14S5ZJVKOTYTL
- !Sub arn:aws:iam::${AWS::AccountId}:root
Action: sts:AssumeRole
Condition:
StringEquals:
AWS:PrincipalArn:
- !Sub arn:aws:iam::414351767826:role/unity-catalog-prod-UCMasterRole-14S5ZJVKOTYTL
- !Sub arn:aws:iam::${AWS::AccountId}:role/{{ TEAM_NAME }}-unity-catalog-{{ ENV }}
sts:ExternalId: "01481bf9-fd6f-4318-b9f4-4f3d743ff240"
ManagedPolicyArns:
- !Ref UnityCatalogBucketRolePolicy
UnityCatalogBucketRolePolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
ManagedPolicyName: "{{ TEAM_NAME }}-unity-catalog-{{ ENV }}"
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- s3:GetObject
- s3:PutObject
- s3:DeleteObject
- s3:ListBucket
- s3:GetBucketLocation
Resource:
- !Sub arn:aws:s3:::${UnityCatalogBucket}
- !Sub arn:aws:s3:::${UnityCatalogBucket}/*
- Effect: Allow
Action:
- sts:AssumeRole
Resource:
- !Sub arn:aws:iam::${AWS::AccountId}:role/{{ TEAM_NAME }}-unity-catalog-{{ ENV }}
If you run into issues, then I highly recommend creating a Databricks Support Ticket through the Help Center. https://help.databricks.com/s/ (as recommended by AWS Support).
Hope this helps.
3 weeks ago
Thank you for the response @MoJaMa - we will try it out tomorrow and post an update here.
Join a Regional User Group to connect with local Databricks users. Events will be happening in your city, and you won’t want to miss the chance to attend and share knowledge.
If there isn’t a group near you, start one and help create a community that brings people together.
Request a New Group