Sample IAM Policies

When a Connection has IAM authentication turned on, the Graph Explorer proxy server signs its requests with the AWS identity of its host, such as an ECS task role or an EC2 instance profile. That identity needs a Neptune data-access policy, or Neptune refuses every signed request. These samples give you a starting point for that policy.

Important

These policies are examples, not a recommended production configuration. Review them against your own security requirements before you attach one.

Choose a policy

Start with read-only unless users need to change data from the query editor.

Graph Explorer has no built-in authentication, and every user of a deployment shares the proxy server’s identity. With the read-write policy, anyone who can reach the deployment can change or delete data in the database. See Permissions.

• Read-only runs read queries and reads the graph summary, which schema sync uses. It also allows query cancellation. On Neptune Database, when Graph Explorer stops waiting for a Gremlin or SPARQL query, such as when you close the tab, the query stops on the database too.
  • Neptune Database
  • Neptune Analytics
• Read-write adds writing and deleting data to the read-only policy, so queries in the query editor can change the graph.
  • Neptune Database
  • Neptune Analytics

For the actions in each policy, see IAM actions for data access and the read-only policy example in the Neptune User Guide.

Placeholders

Replace each placeholder, including its square brackets, before you attach the policy.

• [AWS_PARTITION]: aws for most regions, aws-cn for China regions, or aws-us-gov for AWS GovCloud (US)
• [AWS_REGION]: the region of your database
• [AWS_ACCOUNT_ID]: the account that owns your database
• [NEPTUNE_CLUSTER_RESOURCE_ID]: the cluster resource ID of your Neptune cluster, shown on its Configuration tab and starting with cluster-. This is not the cluster identifier.
• [NEPTUNE_GRAPH_RESOURCE_ID]: the graph identifier of your Neptune Analytics graph, starting with g-

If Neptune still refuses requests after you attach the policy, see Requests Refused by Neptune.

Resource scope

Each sample names a single database in Resource. To let the deployment reach another database, add its ARN rather than widening the ARN with wildcards.

The /* at the end of the Neptune Database ARN is part of the format Neptune requires for data-access resources, arn:aws:neptune-db:{region}:{account-id}:{cluster-resource-id}/*. It covers the data in the one cluster that the resource ID names, not other clusters. See IAM resource types for accessing data.

SageMaker notebooks

The sample policies for SageMaker notebooks are separate and grant every database action, because the notebook role is shared with other tools on the instance. See Minimum Database Permissions.