AWS S3¶

Before deploying the Denodo Lakehouse Accelerator (formerly known as Denodo Embedded MPP) on Amazon EKS check Denodo Lakehouse Accelerator AWS Checklist to make sure you have everything you need.

There are two options to deploy a Denodo Lakehouse Accelerator that will access AWS S3 datasets:

1. The recommended one: provide no AWS S3 credentials to the kubectl create secret command.

   Used when the Denodo Lakehouse Accelerator will run in Amazon EKS and will access S3 with one of these three methods:

   1. EKS Pod Identities

      To do this, you must set up the Kubernetes serviceAccount name provided by your EKS administrator in the values.yaml, e.g:

      serviceAccount:
        create: true
        name: "pod-identity-service-account"
        annotations: {}
      

   2. IAM Roles for Service Accounts

      To do this you can associate an IAM role with the serviceAccount through the serviceAccount.annotations in the values.yaml, e.g:

      serviceAccount:
        create: true
        annotations:
          eks.amazonaws.com/role-arn: arn:aws:iam::<awsaccountid>:role/<role>
      

      and the Denodo Lakehouse Accelerator will access S3, using the permissions configured in that IAM role.

   3. IAM EC2 instance profile

2. Provide the AWS S3 access and secret key ID to the kubectl create secret command:

   ENV Variable	Description
   AWS_ACCESS_KEY_ID	AWS access key ID
   AWS_SECRET_ACCESS_KEY	AWS secret key

   kubectl create secret generic mpp-credentials
   --from-literal=METASTORE_DB_PASSWORD=hive
   --from-literal=AWS_ACCESS_KEY_ID=awsaccesskeyid
   --from-literal=AWS_SECRET_ACCESS_KEY=awssecretaccesskey
   

   It’s also necessary to set true the objectStorage.aws.securityCredentials.enabled property in values.yaml

   Run helm install sentence

   helm install lakehouseaccelerator lakehouseaccelerator/