Managed Deployment

Overview

Ryft offers a fully managed deployment model, for customers who want the fastest and simplest onboarding experience. In this model, Ryft hosts and operates your deployment, provisioned and fully managed on your behalf.

Step 1: Obtain your Execution Role & External ID

Reach out to the Ryft team to begin your setup. We’ll provide you with a unique IAM role & External ID used to establish secure cross-account access via IAM.

Step 2: Create the Data Plane Role

Create an IAM role in your AWS account:

CloudFormation
Terraform
Manual

The easiest way to get started is using our provided CloudFormation template. Click here to launch the CloudFormation stack and deploy the required IAM role into your AWS account.

Alternatively, you can create the role manually:

Login to your AWS account
Navigate to IAM -> Roles
Click Create Role
Give the role a name, e.g - Ryft-DataPlaneRole
Click Next: Permissions
Click Attach existing policies

Attach the following policies:

Glue Catalog Access

{
    "Sid": "RyftGlueDataPlaneAccess",
    "Effect": "Allow",
    "Action": [
        "glue:GetTable",
        "glue:GetTables",
        "glue:GetDatabases",
        "glue:GetDatabase",
        "glue:UpdateTable",
        "glue:CreateTable",
        "glue:DeleteTable"
    ],
    "Resource": [
        "arn:aws:glue:<region>:<account_id>:catalog",
        "arn:aws:glue:<region>:<account_id>:database/*",
        "arn:aws:glue:<region>:<account_id>:table/*"
    ]
}

Note: Replace <region> and <account_id> with your AWS region and account ID.

S3 Bucket Access

{
    "Sid": "AllowRyftExecutionRoleAccess",
    "Effect": "Allow",
    "Action":[
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetObjectVersion",
        "s3:GetObjectTagging",
        "s3:PutObjectTagging"
    ],
    "Resource": [
        "arn:aws:s3:::<lakehouse-bucket-name>/*",
        "arn:aws:s3:::<lakehouse-bucket-name>"
    ]
}

Important: Replace <lakehouse-bucket-name> with your actual S3 bucket name.

Step 3: Create the Control Plane Role

If you did not yet integrate the Ryft control plane with your lakehouse account, make sure to create it by following the steps here.

Step 4: Finalize integration

Once the IAM roles are created, share the ARNs of the roles with your Ryft representative to finalize the setup.

Support

If you run into any issues during setup, contact your Ryft support team.

This article contains instructions for setting up the Managed deployment type.
For a general overview of the Ryft architecture and deployment models, refer to System Architecture.

Getting Started

Integrations

Lakehouse Management

Administration

Managed Deployment

Overview

Step 1: Obtain your Execution Role & External ID

Step 2: Create the Data Plane Role

Glue Catalog Access

S3 Bucket Access

Step 3: Create the Control Plane Role

Step 4: Finalize integration

Support

Getting Started

Integrations

Lakehouse Management

Administration

​Overview

​Step 1: Obtain your Execution Role & External ID

​Step 2: Create the Data Plane Role

​Glue Catalog Access

​S3 Bucket Access

​Step 3: Create the Control Plane Role

​Step 4: Finalize integration

​Support

Overview

Step 1: Obtain your Execution Role & External ID

Step 2: Create the Data Plane Role

Glue Catalog Access

S3 Bucket Access

Step 3: Create the Control Plane Role

Step 4: Finalize integration

Support