BYOC Template Technical Reference

This reference describes the AWS resources created by the CloudFormation and Terraform templates provided during BYOC setup. Both template formats create identical resources in your AWS account. All parameter values are pre-populated based on what you entered during the setup wizard.

Resources Created

Resource Type Purpose
S3 Bucket aws_s3_bucket / AWS::S3::Bucket Stores cluster backups with public access fully blocked and a 7-day lifecycle expiration rule
S3 Public Access Block aws_s3_bucket_public_access_block Blocks all public access to the backup bucket
S3 Lifecycle Configuration aws_s3_bucket_lifecycle_configuration Expires objects and noncurrent versions after 7 days
EC2 Key Pair aws_key_pair / AWS::EC2::KeyPair Imports Instaclustr’s SSH public key for operational access to managed nodes (conditional — see note below)
IAM Role aws_iam_role / AWS::IAM::Role Cross-account role that Instaclustr assumes to provision and manage your infrastructure
IAM Policy aws_iam_policy / AWS::IAM::Policy Defines the permissions granted to the IAM role
IAM Policy Attachment aws_iam_role_policy_attachment Attaches the provisioning policy to the IAM role

Multiple BYOC provider accounts in the same AWS account/region: The EC2 key pair name is derived from your Instaclustr account ID, so it is the same for every provider account you configure. If you are deploying a second or subsequent stack in the same AWS account and region, set CreateKeyPair to false (CloudFormation) or create_key_pair = false (Terraform) — the key pair only needs to be created once per AWS account/region.

S3 Bucket Configuration

Setting Value
Public access Fully blocked — BlockPublicAcls, BlockPublicPolicy, IgnorePublicAcls, RestrictPublicBuckets all set to true
Object expiration 7 days
Noncurrent version expiration 7 days

IAM Role Trust Policy

The IAM role trusts two principals from the Instaclustr AWS account (123456789098), both protected by an external ID condition:

The ExternalId is your Instaclustr account ID (UUID), pre-populated in the downloaded template. This prevents confused-deputy attacks — no other AWS account can assume this role, even if they know the role ARN.

IAM Policy Permissions

The policy (InstaclustrProvisioningPolicy) grants the following permissions:

EC2 — Full access

Sid Action Resource Purpose
AllowEC2 ec2:* * Provision, manage, and terminate cluster nodes, volumes, security groups, and networking

S3 — Scoped to backup buckets

Sid Action Resource Purpose
AllowS3 s3:* Your backup bucket and its objects Full access to your designated backup bucket
AllowS3WithProvisioning s3:* arn:aws:s3:::instaclustr-* Access to Instaclustr-managed provisioning buckets
DenyS3DeleteObjects Deny s3:DeleteObject, s3:DeleteObjectVersion,

s3:DeleteStorageLensConfiguration

 arn:aws:s3:::* Prevents deletion of backup data across all buckets

The explicit Deny on S3 delete operations overrides the s3:* Allow above. Backup data cannot be removed by the provisioning role.

IAM — Instance profiles and role management

Sid Actions Purpose
IAM CreateInstanceProfile, CreateRole, AttachRolePolicy, PutRolePolicy,

AddRoleToInstanceProfile, PassRole, DetachRolePolicy, DeleteRolePolicy,

DeleteInstanceProfile, DeleteRole, CreatePolicy, DeletePolicy, GetRole,

GetInstanceProfile, GetPolicy, GetPolicyVersion, GetRolePolicy,

ListInstanceProfilesForRole, ListInstanceProfiles, ListAttachedRolePolicies,

ListRolePolicies, ListRoles, ListRoleTags, TagRole, UntagRole,

RemoveRoleFromInstanceProfile, SimulatePrincipalPolicy

 Create and manage IAM roles and instance profiles for cluster nodes
ServiceLinkedRole iam:CreateServiceLinkedRole (scoped to elasticloadbalancing.amazonaws.com) Create the ELB service-linked role if it does not already exist

CloudWatch — Full access

Sid Action Resource Purpose
AllowCloudwatch cloudwatch:* * Publish and read cluster metrics and alarms

Elastic Load Balancing

Sid Actions Resource Purpose
AllowELB CreateLoadBalancer, DeleteLoadBalancer, DescribeLoadBalancers,

ModifyLoadBalancerAttributes, SetSubnets, CreateTargetGroup,

DeleteTargetGroup, DescribeTargetGroups, RegisterTargets, CreateListener,

DeleteListener, DescribeListeners, AddTags

 * Provision and manage load balancers for cluster endpoints

FSx

Sid Action Resource Purpose
AllowFSx All FSx actions except fsx:DeleteBackup arn:aws:fsx:*:*:* Provision and manage FSx file systems where applicable

Route 53 — DNS management

Sid Actions Resource Purpose
AllowRoute53 AssociateVPCWithHostedZone, ChangeResourceRecordSets,

ChangeTagsForResource, CreateHostedZone,

CreateVPCAssociationAuthorization, DeleteHostedZone,

DeleteVPCAssociationAuthorization, DisassociateVPCFromHostedZone,

GetChange, GetHostedZone, ListHostedZones, ListHostedZonesByName,

ListHostedZonesByVPC, ListResourceRecordSets, ListTagsForResource,

ListTagsForResources, ListVPCAssociationAuthorizations,

UpdateHostedZoneComment, UpdateHostedZoneFeatures

 * Manage private hosted zones and DNS records for cluster connectivity

CloudFormation Parameters

Parameter Description Default
BucketName S3 backup bucket name (from setup form)
IAMRoleName Cross-account IAM role name instaclustr-<account-id>
ExternalID Your Instaclustr account ID (UUID) used in the trust policy condition (auto-populated)
AdditionalIAMUserARN Additional principal ARN for the trust policy arn:aws:iam::494770124270:root
InstaclustrSSHPublicKey Instaclustr’s SSH public key material (auto-populated)
InstaclustrKeyPairName EC2 key pair name <instaclustr-account-id>
CreateKeyPair Whether to create the EC2 key pair true
LifecycleRuleName Name for the S3 lifecycle rule s3-lifecycle-rule

CloudFormation Outputs

Output Description
BucketName Name of the S3 backup bucket
BucketArn ARN of the S3 backup bucket
IAMRoleName Name of the IAM role
IAMRoleArn ARN of the IAM role — use this when completing validation in the Instaclustr Console
KeyPairName Name of the EC2 key pair
ExternalID External ID used in the trust policy
InstaclustrAccountID Your Instaclustr account ID

Terraform Variables

The downloaded main.tf has the following variables. The placeholders marked @@...@@ are pre-filled by the setup wizard — you should not need to edit them manually.

Variable Description Default / Placeholder
bucket_name S3 backup bucket name @@S3_BACKUP_BUCKET_NAME@@ (pre-filled)
iam_role_name IAM role name @@IAM_ROLE_NAME@@ (pre-filled)
external_id Your Instaclustr account ID (UUID) used in the trust policy (pre-filled)
additional_iam_user_arn Additional principal ARN for the trust policy arn:aws:iam::494770124270:root
instaclustr_ssh_public_key Instaclustr’s SSH public key material (pre-filled)
key_pair_name EC2 key pair name — derived from your Instaclustr account ID (pre-filled)
create_key_pair Whether to create the EC2 key pair true
lifecycle_rule_name Name for the S3 lifecycle rule s3-lifecycle-rule

Before running terraform apply, set your AWS region and profile:

Option 1 — edit the provider block in main.tf directly – @@AWS_REGION@@ and @@AWS_PROFILE@@ are pre-filled by the wizard

Option 2 — override via environment variables

Terraform requires AWS provider ~> 6.0 and Terraform >= 1.0.

Terraform Outputs

After terraform apply completes, the following outputs are available:

Output Description
bucket_name Name of the S3 backup bucket
bucket_arn ARN of the S3 backup bucket
iam_role_name Name of the IAM role
iam_role_arn ARN of the IAM role — use this when completing validation in the Instaclustr Console
key_pair_name Name of the EC2 key pair
external_id External ID used in the trust policy
instaclustr_account_id Your Instaclustr account ID (same as external_id)

Security Considerations

Concern How it is addressed
Cross-account access Role trusts only arn:aws:iam::494770124270:role/InstaclustrProvisioning with an external ID condition — prevents confused-deputy attacks
Backup deletion protection Explicit Deny on s3:DeleteObject and s3:DeleteObjectVersion — backup data cannot be removed by the provisioning role
Public access to backups S3 bucket has all four public access block settings enabled
Backup retention 7-day lifecycle rule auto-expires objects and noncurrent versions to manage storage costs
Data residency All data remains in your AWS account — backups never leave your S3 bucket
Audit trail All actions performed by the Instaclustr role are logged in AWS CloudTrail

Modifying the Template

Do not modify the IAM policy permissions or role trust policy unless instructed by Instaclustr Support. Removing required permissions will cause cluster provisioning or ongoing operations to fail.

If you have specific security or compliance requirements — for example, restricting EC2 actions to specific VPCs or subnets — contact support to discuss before making changes.

Cleaning Up

If you no longer need the BYOC connection:

  1. Terminate all clusters using this provider account in the Instaclustr Console
  2. Delete the provider account under Account Settings → BYOC
  3. Delete the AWS resources:

CloudFormation:

Terraform:

Deleting the S3 bucket will permanently delete all cluster backups. Ensure you have retained any data you need before proceeding.