Configuring a Rekognition Image policy and role in AWS

This topic explains how to configure an AWS permission and role for allowing access to the Rekognition Image service. After you complete this configuration, you can proceed with the integration into Brightspot as described in Configuring the Rekognition Image integration.

Step 1: Create a custom policy for Rekognition Image

In this step, you create a custom policy that enables specific features offered by AWS Rekognition Image.

1. In the AWS console, click Services > Security, Identity, & Compliance > IAM.
2. In the left rail, click Access management > Policies.
3. Click Create policy.
4. In the Specify permissions widget, click JSON.

5. Delete the existing statements, and paste the following:

   {
     "Version":"2012-10-17",
     "Statement":[
       {
         "Sid":"VisualEditor0",
         "Effect":"Allow",
         "Action":[
           "s3:GetObject",
           "s3:ListBucket",
           "s3:PutObject",
           "rekognition:DetectFaces",
           "rekognition:DetectLabels",
           "rekognition:DetectModerationLabels",
           "rekognition:DetectText",
           "rekognition:RecognizeCelebrities"
         ],
         "Resource":"*"
       }
     ]
   }

6. Click Next.
7. In the Review and create widget, enter a Policy name and Description.
8. Click Create policy.

Step 2: Create a Rekognition Image role

In this step, you create a role associated with a default policy for accessing Rekognition Image.

1. In the AWS console, click Services > Security, Identity, & Compliance > IAM.
2. In the left rail, click Access management > Roles.
3. Click Create role.
4. Under Trusted entity type, select AWS service.
5. From the Service or use case list, filter for Rekognition.
6. Select Rekognition.
7. Click Next.
8. In the Permissions policies widget, under Policy name, ensure AmazonRekognitionServiceRole appears. (This is a standard policy that has more permissions than necessary. In a later step you remove this policy and add the one you created.)
9. Click Next.
10. In the Name, review, and create widget, enter a Role name and Description.
11. Click Create role.

Step 3: Attach the custom policy to the Rekognition Image role

In this step, you attach the Rekognition Image policy to the Rekognition Image role.

1. Back in the Roles widget, click the role you created.
2. Under Permissions policies, do the following:
   
   1. Remove the default policy AmazonRekognitionServiceRole.
   2. Click Add permissions > Attach policies.
   3. Filter for and select the custom policy you created in "Step 1: Create a custom policy for Rekognition Image."
   4. Click Add permissions.

Proceed to the procedure in Configuring the Rekognition Image integration using the role you created. You can then test the integration by generating suggested tags and sections as described in Applying suggested tags to images.