Enabling S3 Storage Using IAM Roles

IBM Aspera on Demand can use S3 storage for a node transfer user by specifying the storage in the user docroot. Use this user to transfer files to and from your S3 storage. To avoid specifying S3 storage credentials in a docroot, you can use your AWS Identity and Access Management (IAM) roles to set docroots to S3 storage.

The steps below assume the following:

You have purchased and booted up your Aspera On Demand product.
You have created an S3 bucket.
You have permissions to create IAM roles or change the policies of your IAM.
You know how to SSH as root to your Aspera On Demand instance.

Create a policy for your IAM role.

Log into AWS Management Console as admin and create a new IAM role that has access to your S3 storage.
Go to Services > IAM > Policies. Click Create Policy.
Click Select for Create Your Own Policy.

Name the policy: "s3_node_access". Enter the following policy into the Policy Document to allow all actions on all S3 resources.

{
  "Statement": [
    {
      "Sid": "Stmt1360956435483",
      "Action": [
        "s3:*"
      ],
      "Effect": "Allow",
      "Resource": [
        "*"
      ]
    }
  ]
}

Click Create Policy.

Create your IAM role.

Go to Services > IAM > Roles. Click Create New Role.
Enter "s3_access" and click Next Step.
On the Select Role Type panel, choose AWS Service Roles, and click Select for the Amazon EC2 role type.
Select the "s3_node_access" policy. Click Next Step. Then click Create Role.
Launch an AMI using the IAM role that has access to S3 storage.

Connect to your server through SSH, elevate to the root user, and set the S3 docroot using the asconfigurator tool.

# ssh -i identity_file -p 33001 ec2-user@ec2_host_ip
# sudo su -
# asconfigurator -x "set_user_data;user_name,xfer;absolute,S3://s3.amazonaws.com/s3-bucket-name

Restart the Aspera NodeD service.
```
# service asperanoded restart
```
Test your configuration. Perform a test transfer using an Aspera client to the account configured with the S3 docroot. For information on starting a transfer, see Starting a Simple Transfer.