---
title: "Creating the IAM, Policy and Role for the Portal"
slug: "creating-the-iam-policy-and-role-for-the-portal-4"
tags: ["8.2", "Portal"]
updated: 2026-06-10T09:14:09Z
published: 2026-06-10T09:14:09Z
canonical: "kb.ctera.com/creating-the-iam-policy-and-role-for-the-portal-4"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Creating the IAM, Policy and Role for the Portal

To set up the Amazon EC2 instance, go through the following sections in order. If you are using Amazon EC2 for the first time, sign up for an Amazon Web Services (AWS) account. Optionally, you can also sign up for an AWS Identity and Access Management (IAM) user account. Amazon recommends using IAM to control access to your EC2 instances, as well as other AWS resources.

## Obtaining the Latest CTERA Portal Amazon Machine Image (AMI)

**To obtain the latest AMI:**

- Contact CTERA Support, and request the latest Amazon Machine Image (AMI).

CTERA Support will then share their latest AMI with your account.
  - Provide CTERA Support with your Amazon account number.
  - Provide CTERA Support with the AWS region where you are planning to install the CTERA Portal instance.

## Setting CTERA Portal Resource Access in IAM

Running CTERA Portal on AWS requires an Amazon Identity Access Management (IAM) user account with sufficient privileges for accessing AWS EC2 and S3 resources.

**To set CTERA Portal resource access in IAM:**

1. From your Amazon Web Services account, sign in to the AWS Management Console and select **Services**.
2. Under the **Security, Identity, & Compliance** service, select **IAM**.
3. In the navigation pane, click **Access management > Policies**.  

The **Policies** window is displayed.
4. Click **Create policy**.  

The **Create policy** window is displayed.
5. Select the **JSON** tab and paste the the policy document into the **Policy Document** area. An example policy document:

```
{"Version": "2012-10-17",
      "Statement": [{
        "Effect": "Allow",
        "Action": [
            "ec2:AttachVolume",
            "ec2:DescribeVolumes",
            "ec2:DetachVolume",
            "ec2:CreateSnapshot",
            "ec2:DeleteSnapshot",
            "ec2:DescribeSnapshots",
            "s3:CreateBucket",
            "s3:GetBucketObjectLockConfiguration"
            "s3:ListBucket",
            "s3:GetObject",
            "s3:PutObject",
            "s3:PutObjectRetention",
            "s3:DeleteObject",
            "s3:GetBucketLocation",
            "s3:ListAllMyBuckets"
            "cloudwatch:GetMetricStatistics",
            "cloudwatch:ListMetrics",
            "cloudwatch:GetMetricData"
        ],
        "Resource": [
            "*"
        ]
    }]
}
```

**Note**

If you intend to support WORM propagation, for existing or new buckets, the IAM must include permissions to enable configure object locking; the `s3:GetBucketObjectLockConfiguration` permission and the `s3:PutObjectRetention` permission to propagate file retention to the objects. For new buckets, the IAM must include permissions to enable versioning, `s3:PutBucketVersioning` and `s3:PutBucketObjectLockConfiguration` permissions to configure object lock. For details about WORM propagation, see [Object Lock Support: WORM Propagation](/v1/docs/managing-storage-nodes-6#Object-Lock-Support-WORM-Propagation).
6. Click **Next** through the wizard until you can enter a name for the policy and enter a name and click **Create policy**.
7. In the navigation pane, click **Access management > Roles**.  

The **Roles** window is displayed.
8. Click **Create role**.  

The **Create role** window is displayed.
9. Under the **AWS service** option, under **Use Case**, choose **EC2** and click **Next**.
10. Select both the policy created and the **AmazonSSMFullAccess** policy.
**Note**

You can search for this policy and then select it.
11. Click **Next**.
12. Enter a name for the role and, optionally, click **Add new tag** to add a tag for the role.  

**Key** – A name for the tag.  

**Value - optional** – The policy name from step 7.
13. Click **Create role**.