Skip to main content
Refer to Manage Environment Ops Authing▸, when using the AutoMQ Cloud BYOC product, the AutoMQ service provider needs the user to provide the appropriate ops authorization. This document explains how to configure delegated ops authorization in AWS S3.
When installing the AutoMQ console in an AWS environment, operational authorization is usually completed automatically by default.
  • If your version is >= 8.0: manual authorization is usually not required.
  • If your version is < 8.0: manual authorization must be performed according to the guidelines in this document.

​
AWS Environment Authorization

The AWS S3 console provides the Bucket Policy authorization feature. The operation steps are referenced in the document below.

​
Console Operation Steps

Log in to the cloud account that owns the Ops Bucket or a sub-account with authorization capabilities, and go to the S3 Console:
  1. Go to the Bucket list page and find the target Bucket. The user visits the S3 console, clicks on Bucket List on the left navigation bar, and enters the list page. Search for the Ops Bucket configured for the current environment and click on the details.
  1. Go to the Permissions menu and find the Bucket Policy. Click Edit to open the authorization form.
  1. Fill in Authorization Information and Create a Bucket Authorization Policy. Follow the instructions below to fill in the necessary authorization information, click OK, and complete the creation of the authorization policy.
    • Authorized Resource: Select the specified Ops Bucket.
    • Authorized User: Refer to Overview▸, and fill in the AutoMQ service provider cloud account ID “381492316447”.
    • Authorized Operation: Refer to the policy below.

​
Optional: restrict access to cluster configuration

Logs stored in the AutoMQ Ops Bucket also include cluster configuration information. To prevent AutoMQ from accessing configuration objects under automq/config/ and automq/config-template/, use the policy below. This policy keeps read and list access for the Ops Bucket, limits s3:PutObject to automq/metadata/ and automq/license/, and adds an explicit Deny for reads from the two configuration prefixes. Replace every occurrence of {Ops Bucket Name} with your environment’s Ops Bucket name. Use the statements below in place of the original AutoMQ Allow statement. Remove any existing broader s3:PutObject Allow. Retain unrelated Bucket Policy statements.
Bucket listing permissions remain unchanged, so object names under the configuration prefixes may still appear in listing results. The s3:PutObject permission applies only to objects under automq/metadata/ and automq/license/.