AWS 中的 App Builder

本指南将引导您在 AWS 中设置 App Builder，以实现自动数据分析和洞察获取。请按以下步骤操作，以高效配置并优化您的设置。

先决条件

如创建 VPC 部分所述，已配置专用于 Alteryx One 的 VPC。
如步骤 2：配置 IAM 中所述，已创建好服务账户，并为该服务账户附加了基础 IAM 策略。
如步骤 7：触发私有数据处理预配中所述，已成功触发 PDP 预配。

账户设置

步骤 1：配置 IAM

步骤 1a：创建 App Builder IAM 策略

注意

AAC_AppBuilder_SA_Policy 是一个示例策略名称。您可以为策略选择任何名称，但该名称必须以 AAC_AppBuilder 开头。

您需要创建自定义 IAM 策略。将其命名为 AAC_AppBuilder_SA_Policy 并附加以下策略文档。我们建议使用 JSON 选项卡而不是可视化编辑器。Alteryx One 需要一些 * 权限才能运行。在创建策略时，预计会出现一些安全警告。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/*",
            "Condition": {
                "StringEqualsIfExists": {
                    "iam:PassedToService": [
                        "ec2.amazonaws.com",
                        "ec2.amazonaws.com.cn"
                    ]
                }
            }
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "eks:*",
                "iam:CreateServiceLinkedRole",
                "kms:CreateGrant",
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:Encrypt",
                "kms:GetKeyPolicy",
                "kms:GetKeyRotationStatus",
                "kms:ListGrants",
                "kms:ListResourceTags",
                "kms:ListRetirableGrants",
                "kms:PutKeyPolicy",
                "kms:RetireGrant",
                "kms:RevokeGrant",
                "kms:ScheduleKeyDeletion",
                "kms:TagResource",
                "kms:UntagResource"
            ],
            "Resource": [
                "arn:aws:eks:*:*:addon/*/*/*",
                "arn:aws:eks:*:*:cluster/*",
                "arn:aws:eks:*:*:nodegroup/*/*/*",
                "arn:aws:eks:*:*:identityproviderconfig/*/*/*/*",
                "arn:aws:eks:*:*:access-entry/*/*/*",
                "arn:aws:kms:*:*:key/*",
                "arn:aws:iam::*:role/*"
            ]
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:CreateOpenIDConnectProvider",
                "iam:CreatePolicy",
                "iam:CreatePolicyVersion",
                "iam:CreateRole",
                "iam:DeleteOpenIDConnectProvider",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:DetachRolePolicy",
                "iam:GetOpenIDConnectProvider",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:GetUser",
                "iam:GetUserPolicy",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedUserPolicies",
                "iam:ListGroupsForUser",
                "iam:ListInstanceProfilesForRole",
                "iam:ListPolicyTags",
                "iam:ListPolicyVersions",
                "iam:ListRolePolicies",
                "iam:PassRole",
                "iam:PutRolePolicy",
                "iam:TagOpenIDConnectProvider",
                "iam:TagPolicy",
                "iam:TagRole",
                "iam:UntagOpenIDConnectProvider",
                "iam:UntagPolicy",
                "iam:UntagRole",
                "iam:UpdateOpenIDConnectProviderThumbprint",
                "iam:UpdateRole",
                "iam:UpdateAssumeRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::*:policy/*",
                "arn:aws:iam::*:oidc-provider/*",
                "arn:aws:iam::*:user/*",
                "arn:aws:iam::*:role/*"
            ]
        },
        {
            "Sid": "VisualEditor3",
            "Effect": "Allow",
            "Action": [
                "autoscaling:*",
                "ec2:*",
                "eks:CreateCluster",
                "eks:ListClusters",
                "eks:DescribeAddonVersions",
                "elasticloadbalancing:*",
                "iam:GetAccountName",
                "iam:ListAccountAliases",
                "iam:ListRoles",
                "iam:CreateInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:GetInstanceProfile",
                "iam:TagInstanceProfile",
                "iam:UntagInstanceProfile", 
                "iam:RemoveRoleFromInstanceProfile", 
                "iam:AddRoleToInstanceProfile", 
                "kms:CreateKey",
                "logs:CreateLogGroup",
                "logs:DeleteLogGroup",
                "logs:DescribeLogGroups",
                "logs:ListTagsLogGroup",
                "logs:PutRetentionPolicy",
                "logs:TagResource",
                "logs:UntagResource",
                "logs:TagLogGroup",
                "logs:UntagLogGroup",
                "logs:ListTagsForResource",
                "networkmanager:Describe*",
                "networkmanager:Get*",
                "networkmanager:List*",
                "s3:CreateBucket",
                "s3:DeleteBucket",
                "s3:DeleteBucketPolicy",
                "s3:DeleteBucketWebsite",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:DeleteObjectVersionTagging",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketAcl",
                "s3:GetBucketCORS",
                "s3:GetBucketLocation",
                "s3:GetBucketLogging",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetBucketOwnershipControls",
                "s3:GetBucketPolicy",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketRequestPayment",
                "s3:GetBucketTagging",
                "s3:GetBucketVersioning",
                "s3:GetBucketWebsite",
                "s3:GetEncryptionConfiguration",
                "s3:GetLifecycleConfiguration",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionAttributes",
                "s3:GetObjectVersionForReplication",
                "s3:GetObjectVersionTagging",
                "s3:GetObjectVersionTorrent",
                "s3:GetReplicationConfiguration",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "s3:PutAccelerateConfiguration",
                "s3:PutBucketAcl",
                "s3:PutBucketCORS",
                "s3:PutBucketLogging",
                "s3:PutBucketObjectLockConfiguration",
                "s3:PutBucketOwnershipControls",
                "s3:PutBucketPolicy",
                "s3:PutBucketPublicAccessBlock",
                "s3:PutBucketRequestPayment",
                "s3:PutBucketTagging",
                "s3:PutBucketVersioning",
                "s3:PutBucketWebsite",
                "s3:PutEncryptionConfiguration",
                "s3:PutLifecycleConfiguration",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionAcl",
                "s3:PutObjectVersionTagging",
                "sts:GetCallerIdentity",
                "memorydb:CreateSubnetGroup",
                "memorydb:CreateUser",
                "memorydb:CreateAcl",
                "memorydb:CreateCluster",
                "memorydb:TagResource",
                "memorydb:DescribeSubnetGroups",
                "memorydb:DescribeUsers",
                "memorydb:DescribeACLs",
                "memorydb:DescribeClusters",
                "memorydb:ListTags",
                "memorydb:DeleteUser",
                "memorydb:DeleteSubnetGroup",
                "memorydb:DeleteAcl",
                "memorydb:DeleteCluster",
                "memorydb:UpdateAcl",
                "memorydb:UpdateCluster",
                "memorydb:UpdateSubnetGroup",
                "memorydb:UpdateUser"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor4",
            "Effect": "Allow",
            "Action": "secretsmanager:*",
            "Resource": "arn:aws:secretsmanager:*:*:secret:*"
        }
    ]
}

步骤 1b：为 IAM 策略添加标签

为步骤 1a 中创建的自定义 IAM 策略添加标签。

标记名称	Value
AACResource	aac_sa_custom_policy

步骤1c：附加 IAM 策略

将 IAM 策略 AAC_AppBuilder_SA_Policy 附加到在为私有数据设置 AWS 账户和 VPC 页面上创建的 aac_automation_sa 服务账户。

步骤 2：配置子网

注意

Designer Cloud 与 Machine Learning、Auto Insights 和 App Builder 共享子网配置。如果您要部署多个此类应用程序，则只需配置子网一次。

在私有数据处理环境中，Designer Cloud 最多需要 3 个子网组。每个子网组包含 3 个独立的子网，每个子网位于不同的可用区。

eks_control 组（必填）：EKS 控制平面使用此子网接受传入的作业执行请求。
eks_node 组（必填）：EKS 集群使用此子网来执行 Alteryx 软件作业（例如连接、转换、处理和发布）。
public 组（必填）：此组不运行任何服务，但 eks_node 组使用它来实现集群的出站流量。
private 组（必填）：此组运行私有数据处理专用的服务。

步骤 2a：在 VPC 中创建子网

在 aac_vpc VPC 中配置子网。

根据以下示例创建并标记子网。您可以调整 CIDR 和子网值以适应您的网络架构。

大地址空间旨在容纳完全扩展的集群。如果需要，您可以选择较小的地址空间，但在处理负载较重的情况下，可能会遇到扩展问题。

重要

您必须使用标记名称和标记值标记子网，如表中所述。

CIDR	子网名称	子网	AZ	标记名称	标签值	注意
10.64.0.0/18	eks_node	10.64.0.0/21	AZa	AACSubnet	eks_node
	eks_node	10.64.8.0/21	AZb	AACSubnet	eks_node
	eks_node	10.64.16.0/21	AZc	AACSubnet	eks_node
		10.64.24.0/21				SPARE
		10.64.32.0/19				SPARE（可配置为稍后进行蓝/绿升级）
10.10.0.0/21	eks_control	10.10.0.0/27	AZa	AACSubnet	eks_control
	eks_control	10.10.0.32/27	AZb	AACSubnet	eks_control
	eks_control	10.10.0.64/27	AZc	AACSubnet	eks_control
		10.10.0.96/27				SPARE
	public	10.10.0.128/27	AZa	AACSubnet	public
	public	10.10.0.160/27	AZb	AACSubnet	public
	public	10.10.0.192/27	AZc	AACSubnet	public
		10.10.0.224/27				SPARE
	private	10.10.1.0/25	AZa	AACSubnet	private
	private	10.10.1.128/25	AZb	AACSubnet	private
	private	10.10.2.0/25	AZc	AACSubnet	private
		10.10.1.128/25				SPARE

步骤 2b：子网路由表

为子网创建路由表。子网的路由表条目如下所示：

注意

您的 <gateway id> 可为每个 AZ 创建的区域性 NAT 网关或中转网关，具体取决于网络架构。若使用 NAT 网关，请为每个 AZ 的公有子网分别创建一个 NAT 网关。

子网名称	路由目标	目标	备注
eks_node	/18 CIDR 地址段 /21 CIDR 地址段 <s3 prefix id> 0.0.0.0/0	本地本地 <vpce endpoint id> <gateway id>	为所有 3 个 AZ 子网路由表配置相同的路由。
eks_control	/18 CIDR 地址段 /21 CIDR 地址段 <s3 prefix id> 0.0.0.0/0	本地本地 <vpce endpoint id> <gateway id>	为所有 3 个 AZ 子网路由表配置相同的路由。
public	/18 CIDR 地址段 /21 CIDR 地址段 0.0.0.0/0	本地本地 <gateway id>	为所有 3 个 AZ 子网路由表配置相同的路由。
private	/18 CIDR 地址段 /21 CIDR 地址段 <s3 prefix id> 0.0.0.0/0	local local <vpce endpoint id> <gateway id>	为所有 3 个 AZ 子网路由表配置相同的路由。 0.0.0.0/0 应传出到公用网络。

私有数据处理

小心

在设置私有数据处理后更改或移除任何 Alteryx One 配置的公有云资源可能会导致不一致。这些不一致可能会导致作业执行期间或取消私有数据处理设置时出错。

步骤 1：触发 App Builder 部署

App Builder 的预配会从 Alteryx One 中的管理控制台触发。您需要工作区内的“工作区管理员”权限才能查看它。

从 Alteryx One 登录页面中，单击右上方包含您姓名首字母缩写的圆圈图标。从菜单中选择管理控制台。
从左侧导航菜单中选择私有数据处理。
选中 Auto Insights 复选框，然后选择保存。

选择更新会触发 AWS 账户中集群和资源的部署。这将运行一系列验证检查，以确认 AWS 账户的配置是否正确。

初始验证检查完成后，预配将开始执行。屏幕上的消息框将定期刷新，并显示最新的状态更新。

注意

配置过程大约需要 35–40 分钟才能完成。

预配完成后，您可以通过 AWS 控制台查看已创建的资源（例如 EC2 实例和节点组）。切勿自行修改它们，这一点非常重要。手动更改可能会导致私有数据处理环境的功能出现问题。

Step 2: Update KMS Key Policy

Once the Private Data Processing is successfully created, a custom role named credential-service-role is established in the account to enable the Kubernetes credential service account to access private data credentials from the key vault. Additionally, update the policy of the KMS Key, which was created in 为私有数据设置 AWS 账户和 VPC - Step 5: Create a Symmetric Key for Secure Vault, to grant the custom role credential-service-role with the necessary permissions.

Go to Key Management Services and select the key created in 为私有数据设置 AWS 账户和 VPC - Step 5: Create a Symmetric Key for Secure Vault.
Select Key Policy and select Edit.

Delete the default permission and update with below mentioned permissions:

{
  "Version": "2012-10-17",
  "Id": "key-consolepolicy-3",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account id>:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow use of the key",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account id>:role/credential-service-role"
      },
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    }
  ]
}

注意

<accountId> - AWS account number where private data processing environment handling has been provisioned.

Select Save Changes.

本节内容如下: