AWS S3¶

Before deploying the Denodo Embedded MPP on Amazon EKS check Denodo Embedded MPP AWS Checklist to make sure you have everything you need.

There are two options to deploy a Denodo Embedded MPP that will access AWS S3 datasets:

1. The recommended one: provide no AWS S3 credentials to the kubectl create secret command.

   Used when the Denodo Embedded MPP will run in Amazon EKS and will access S3 with one of these three methods:

   1. EKS Pod Identities

      To do this, you must set up the Kubernetes serviceAccount name provided by your EKS administrator in the values.yaml, e.g:

      serviceAccount:
        create: true
        name: "pod-identity-service-account"
        annotations: {}
      

   2. IAM Roles for Service Accounts

      To do this you can associate an IAM role with the serviceAccount through the serviceAccount.annotations in the values.yaml, e.g:

      serviceAccount:
        create: true
        annotations:
          eks.amazonaws.com/role-arn: arn:aws:iam::<awsaccountid>:role/<role>
      

      and the Denodo Embedded MPP will access S3, using the permissions configured in that IAM role.

   3. IAM EC2 instance profile

2. Provide the AWS S3 access and secret key ID to the kubectl create secret command:

   ENV Variable	Description
   AWS_ACCESS_KEY_ID	AWS access key ID
   AWS_SECRET_ACCESS_KEY	AWS secret key

   kubectl create secret generic mpp-credentials
   --from-literal=METASTORE_DB_PASSWORD=hive
   --from-literal=AWS_ACCESS_KEY_ID=awsaccesskeyid
   --from-literal=AWS_SECRET_ACCESS_KEY=awssecretaccesskey
   

   It’s also necessary to set true the objectStorage.aws.securityCredentials.enabled property in values.yaml

   Run helm install sentence

   helm install prestocluster prestocluster/