Chapter 6. About IAM resources
Red Hat OpenShift Service on AWS uses the AWS Security Token Service (STS) to provide temporary, limited-permission credentials for your cluster. This means that before you deploy your cluster, you must create the following AWS Identity Access Management (IAM) resources:
- Specific account-wide IAM roles and policies that provide the STS permissions required for Red Hat OpenShift Service on AWS support, installation, and compute functionality. This includes account-wide Operator policies.
- Cluster-specific Operator IAM roles that permit the Red Hat OpenShift Service on AWS cluster Operators to run core OpenShift functionality.
- An OpenID Connect (OIDC) provider that the cluster Operators use to authenticate.
If you deploy and manage your cluster using OpenShift Cluster Manager, you must create the following additional resources:
- An OpenShift Cluster Manager IAM role to complete the installation on your cluster.
- A user role without any permissions to verify your AWS account identity.
This document provides reference information about the IAM resources that you must deploy when you create a ROSA with HCP cluster. It also includes the aws CLI commands that are generated when you use manual mode with the rosa create command.
6.1. OpenShift Cluster Manager roles and permissions
If you create Red Hat OpenShift Service on AWS clusters by using OpenShift Cluster Manager, you must have the following AWS Identity and Access Management (IAM) roles linked to your AWS account to create and manage the clusters.
These AWS IAM roles are as follows:
-
The Red Hat OpenShift Service on AWS user role (
user-role) is an AWS role used by Red Hat to verify the customer’s AWS identity. This role has no additional permissions, and the role has a trust relationship with the Red Hat installer account. An
ocm-roleresource grants the required permissions for installation of Red Hat OpenShift Service on AWS clusters in OpenShift Cluster Manager. You can apply basic or administrative permissions to theocm-roleresource. If you create an administrativeocm-roleresource, OpenShift Cluster Manager can create the needed AWS Operator roles and OpenID Connect (OIDC) provider. This IAM role also creates a trust relationship with the Red Hat installer account.NoteThe
ocm-roleIAM resource refers to the combination of the IAM role and the necessary policies created with it.
You must create this user role as well as an administrative ocm-role resource, if you want to use the auto mode in OpenShift Cluster Manager to create your Operator role policies and OIDC provider.
6.1.1. Understanding the OpenShift Cluster Manager role
Creating Red Hat OpenShift Service on AWS clusters in OpenShift Cluster Manager requires an ocm-role Identity and Access Management (IAM) role. The standard ocm-role IAM role permissions let you perform cluster maintenance within OpenShift Cluster Manager.
To automatically create the Operator roles and OpenID Connect (OIDC) provider, you must add the --admin option to the rosa create command. This command creates an ocm-role resource with additional permissions needed for administrative tasks. If you do not need to use OpenShift Cluster Manager, the --no-console profile creates an ocm-role IAM role with the minimum required permissions to create and manage clusters by using the CLI.
This elevated IAM role allows OpenShift Cluster Manager to automatically create the cluster-specific Operator roles and OIDC provider during cluster creation. For more information about this automatic role and policy creation, see the "Methods of account-wide role creation" link in Additional resources.
6.1.1.1. Understanding the user role
In addition to an ocm-role IAM role, you must create a user role so that Red Hat OpenShift Service on AWS can verify your AWS identity. This role has no permissions, and it is only used to create a trust relationship between the installer account and your ocm-role resources.
The following tables show the associated basic and administrative permissions for the ocm-role resource.
| Resource | Description |
|---|---|
|
| This permission allows the basic role to retrieve information about the specified OpenID Connect (OIDC) provider. |
|
| This permission allows the basic role to retrieve any information for a specified role. Some of the data returned include the role’s path, GUID, ARN, and the role’s trust policy that grants permission to assume the role. |
|
| This permission allows the basic role to list the roles within a path prefix. |
|
| This permission allows the basic role to list the tags on a specified role. |
|
| This permission allows the basic role to return information about all of the enabled regions on your account. |
|
| This permission allows the basic role to return information about all of your route tables. |
|
| This permission allows the basic role to return information about all of your subnets. |
|
| This permission allows the basic role to return information about all of your virtual private clouds (VPCs). |
|
| This permission allows the basic role to retrieve temporary security credentials to access AWS resources that are beyond its normal permissions. |
|
| This permission allows the basic role to retrieve temporary security credentials for users authenticated their account with a web identity provider. |
| Resource | Description |
|---|---|
|
| This permission allows the admin role to attach a specified policy to the desired IAM role. |
|
| This permission creates a resource that describes an identity provider, which supports OpenID Connect (OIDC). When you create an OIDC provider with this permission, this provider establishes a trust relationship between the provider and AWS. |
|
| This permission allows the admin role to create a role for your AWS account. |
|
| This permission allows the admin role to list any policies associated with your AWS account. |
|
| This permission allows the admin role to list any tags on a designated policy. |
|
| This permission allows the admin role to change the permissions boundary for a user based on a specified policy. |
|
| This permission allows the admin role to add tags to an IAM role. |
6.1.2. Create an ocm-role IAM role
Create the ocm-role Identity and Access Management (IAM) roles by using the ROSA command-line interface (CLI) (rosa) to grant OpenShift Cluster Manager the permissions needed to install and manage your Red Hat OpenShift Service on AWS clusters.
If you want to create and manage clusters by using only the rosa CLI and the OpenShift CLI (oc), you can use the --no-console profile for the ocm-role IAM resource. For more information about the ocm-role IAM resource permissions profile, see the Additional resources.
You must create the ocm-role IAM role before you can create your Red Hat OpenShift Service on AWS cluster.
Prerequisites
- You have an AWS account.
- You have Red Hat Organization Administrator privileges in the OpenShift Cluster Manager organization.
- You have the permissions required to install AWS account-wide roles.
-
You have installed and configured the latest
rosaCLI,rosa, on your installation host.
Procedure
Run one of the following commands to create the required
ocm-roleIAM resource:ImportantThe process to change your
ocm-roleIAM resource profile requires you to unlink and delete the currentocm-roleIAM resource and create a new one with the required profile.To create an
ocm-roleIAM role with standard privileges, run the following command:$ rosa create ocm-roleTo create an
ocm-roleIAM role with admin privileges, run the following command:ImportantThe admin profile supports "auto" mode configuration for Red Hat OpenShift Service on AWS clusters which provisions OIDC Configuration and Operator roles automatically. To achieve this automatic flow, the profile has a wider set of permissions than the standard profile.
$ rosa create ocm-role --adminThis command allows you to create the role by specifying specific attributes. The following example output shows the "auto mode" selected, which lets the
rosaCLI (rosa) create your Operator roles and policies. See "Methods of account-wide role creation" for more information. The following example shows what your creation flow might look like.I: Creating ocm role ? Role prefix: ManagedOpenShift ? Enable admin capabilities for the OCM role (optional): No ? Permissions boundary ARN (optional): ? Role Path (optional): ? Role creation mode: auto I: Creating role using 'arn:aws:iam::<ARN>:user/<UserName>' ? Create the 'ManagedOpenShift-OCM-Role-182' role? Yes I: Created role 'ManagedOpenShift-OCM-Role-182' with ARN 'arn:aws:iam::<ARN>:role/ManagedOpenShift-OCM-Role-182' I: Linking OCM role ? OCM Role ARN: arn:aws:iam::<ARN>:role/ManagedOpenShift-OCM-Role-182 ? Link the 'arn:aws:iam::<ARN>:role/ManagedOpenShift-OCM-Role-182' role with organization '<AWS ARN>'? Yes I: Successfully linked role-arn 'arn:aws:iam::<ARN>:role/ManagedOpenShift-OCM-Role-182' with organization account '<AWS ARN>'where:
Role prefix-
A prefix value for all of the created AWS resources. In this example,
ManagedOpenShiftprepends all of the AWS resources. Enable admin capabilities for the OCM role (optional)Choose if you want this role to have the additional admin permissions.
NoteYou do not see this prompt if you used the
--adminoption.Permissions boundary ARN (optional)- The Amazon Resource Name (ARN) of the policy to set permission boundaries.
Role Path (optional)- Specify an IAM path for the user name.
Role creation mode-
Choose the method to create your AWS roles. By using
auto, therosaCLI generates and links the roles and policies. In theautomode, you receive some different prompts to create the AWS roles. Create the 'ManagedOpenShift-OCM-Role-182' role?-
The
automethod asks if you want to create a specificocm-roleby using your prefix. OCM Role ARN- Confirm that you want to associate your IAM role with your OpenShift Cluster Manager.
Link the 'arn:aws:iam::<ARN>:role/ManagedOpenShift-OCM-Role-182' role with organization '<AWS ARN>'?- Links the created role with your AWS organization.
To create an
ocm-roleIAM role with the minimum required privileges, run the following command:NoteWhile the
no-consoleprofile offers the minimum permissions policy that can still create Red Hat OpenShift Service on AWS clusters, the permissions are insufficient if you want to use OpenShift Cluster Manager for cluster creation.$ rosa create ocm-role --no-console
6.2. Account-wide IAM role and policy reference
Red Hat OpenShift Service on AWS deployments that use the AWS Security Token Service (STS) require account-wide Identity and Access Management (IAM) roles and policies, including the Operator policies. JSON files define these policies.
The account-wide roles and policies are specific to a OpenShift Container Platform release version, and are compatible with earlier versions. You can minimize the required STS resources by reusing the account-wide roles and policies for multiple clusters of the same minor version, regardless of their patch version.
6.2.1. Methods of account-wide role creation
You can create account-wide roles by using the ROSA command-line interface (CLI) (rosa), or the OpenShift Cluster Manager guided installation. You can create the roles manually or by using an automatic process that uses predefined names for these roles and policies.
- Manual ocm-role resource creation
- You can use the manual creation method if you have the necessary CLI access to create these roles on your system. You can run this option in your desired CLI tool or from OpenShift Cluster Manager. After you start the manual creation process, the CLI presents a series of commands for you to run that create the roles and link them to the needed policies.
- Automatic ocm-role resource creation
After you created an
ocm-roleresource with administrative permissions, you can use the automatic creation method from OpenShift Cluster Manager. Selecting this method creates the roles and policies that use the default names.If you use the Red Hat OpenShift Service on AWS guided installation on OpenShift Cluster Manager, you must have created an
ocm-roleresource with administrative permissions in the first step of the guided cluster installation.
6.2.2. Account-wide IAM roles and policies reference
Red Hat OpenShift Service on AWS clusters that use Security Token Service (STS) require the following account-wide Identity and Access Management (IAM) roles and policies. Review roles and policies descriptions and the example JSON files that define each policy.
| Resource | Description |
|---|---|
| This policy streamlines permission setup by packaging necessary access rights, giving entities appropriate control over the Red Hat OpenShift Service on AWS subscription while preventing excessive permissions. |
| Resource | Description |
|---|---|
|
| An IAM role used by the Red Hat OpenShift Service on AWS installer. |
| An IAM policy that provides the Red Hat OpenShift Service on AWS installer with the permissions required to complete cluster installation tasks. | |
|
| Grants the Red Hat installer temporary permission to act within your AWS account for the sole purpose of setting up a Red Hat OpenShift Service on AWS cluster. |
Example sts_hcp_installer_permission_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadPermissions",
"Effect": "Allow",
"Action": [
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInternetGateways",
"ec2:DescribeInstances",
"ec2:DescribeInstanceTypes",
"ec2:DescribeRegions",
"ec2:DescribeReservedInstancesOfferings",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSubnets",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcs",
"ec2:DescribeInstanceTypeOfferings",
"ec2:DescribeCapacityReservations",
"elasticloadbalancing:DescribeAccountLimits",
"elasticloadbalancing:DescribeLoadBalancers",
"iam:GetOpenIDConnectProvider",
"iam:GetRole",
"route53:GetHostedZone",
"route53:ListHostedZones",
"route53:ListHostedZonesByName",
"route53:ListResourceRecordSets",
"route53:GetAccountLimit",
"servicequotas:GetServiceQuota"
],
"Resource": "*"
},
{
"Sid": "PassRoleToEC2",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:*:iam::*:role/*-ROSA-Worker-Role"
],
"Effect": "Allow",
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ec2.amazonaws.com"
]
}
}
},
{
"Sid": "ManageInstanceProfiles",
"Effect": "Allow",
"Action": [
"iam:AddRoleToInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:GetInstanceProfile"
],
"Resource": [
"arn:aws:iam::*:instance-profile/rosa-service-managed-*"
]
},
{
"Sid": "CreateInstanceProfiles",
"Effect": "Allow",
"Action": [
"iam:CreateInstanceProfile",
"iam:TagInstanceProfile"
],
"Resource": [
"arn:aws:iam::*:instance-profile/rosa-service-managed-*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "GetSecretValue",
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "Route53ManageRecords",
"Effect": "Allow",
"Action": [
"route53:ChangeResourceRecordSets"
],
"Resource": "*",
"Condition": {
"ForAllValues:StringLike": {
"route53:ChangeResourceRecordSetsNormalizedRecordNames": [
"*.openshiftapps.com",
"*.devshift.org",
"*.hypershift.local",
"*.openshiftusgov.com",
"*.devshiftusgov.com"
]
}
}
},
{
"Sid": "Route53Manage",
"Effect": "Allow",
"Action": [
"route53:ChangeTagsForResource",
"route53:CreateHostedZone",
"route53:DeleteHostedZone"
],
"Resource": "*"
},
{
"Sid": "CreateTags",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"RunInstances"
]
}
}
},
{
"Sid": "RunInstancesNoCondition",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:snapshot/*"
]
},
{
"Sid": "RunInstancesRestrictedRequestTag",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "RunInstancesRedHatOwnedAMIs",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:image/*"
],
"Condition": {
"StringEquals": {
"ec2:Owner": [
"531415883065",
"251351625822",
"210686502322"
]
}
}
},
{
"Sid": "ManageInstancesRestrictedResourceTag",
"Effect": "Allow",
"Action": [
"ec2:TerminateInstances",
"ec2:GetConsoleOutput"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateGrantRestrictedResourceTag",
"Effect": "Allow",
"Action": [
"kms:CreateGrant"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
},
"StringLike": {
"kms:ViaService": "ec2.*.amazonaws.com"
},
"Bool": {
"kms:GrantIsForAWSResource": true
}
}
},
{
"Sid": "ManagedKMSRestrictedResourceTag",
"Effect": "Allow",
"Action": [
"kms:DescribeKey",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
}
}
},
{
"Sid": "CreateSecurityGroups",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group*/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "DeleteSecurityGroup",
"Effect": "Allow",
"Action": [
"ec2:DeleteSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "SecurityGroupIngressEgress",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress"
],
"Resource": [
"arn:aws:ec2:*:*:security-group*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateSecurityGroupsVPCNoCondition",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:vpc/*"
]
},
{
"Sid": "CreateTagsRestrictedActions",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateSecurityGroup"
]
}
}
},
{
"Sid": "CreateTagsK8sSubnet",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*"
],
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": [
"kubernetes.io/cluster/*"
]
}
}
},
{
"Sid": "DeleteTagsK8sSubnet",
"Effect": "Allow",
"Action": [
"ec2:DeleteTags"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*"
],
"Condition": {
"Null": {
"aws:TagKeys": "false"
},
"ForAllValues:StringLike": {
"aws:TagKeys": [
"kubernetes.io/cluster/*"
]
}
}
},
{
"Sid": "ListPoliciesAttachedToRoles",
"Effect": "Allow",
"Action": [
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies"
],
"Resource": "arn:aws:iam::*:role/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
}
]
}Example sts_hcp_installer_trust_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::710019948333:role/RH-Managed-OpenShift-Installer"
},
"Action": "sts:AssumeRole"
}
]
}| Resource | Description |
|---|---|
|
| An IAM role used by the compute instances. |
| An IAM policy that provides the Red Hat OpenShift Service on AWS compute instances with the permissions required to manage their components. | |
|
| Allows essential software on your worker nodes to securely connect and talk to the cluster’s control plane, which is managed remotely by Red Hat. |
Example sts_hcp_worker_instance_permission_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "EC2DescribeInstancesRegions",
"Effect": "Allow",
"Action": ["ec2:DescribeInstances", "ec2:DescribeRegions"],
"Resource": "*"
},
{
"Sid": "ECRGetAuthorizationToken",
"Effect": "Allow",
"Action": ["ecr:GetAuthorizationToken"],
"Resource": "*"
},
{
"Sid": "ECRReadOnlyAccessRedHatManaged",
"Effect": "Allow",
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:GetRepositoryPolicy",
"ecr:DescribeRepositories",
"ecr:ListImages",
"ecr:DescribeImages",
"ecr:BatchGetImage",
"ecr:ListTagsForResource"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
}
]
}Example sts_hcp_worker_instance_trust_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}| Resource | Description |
|---|---|
|
| An IAM role used by the Red Hat Site Reliability Engineering (SRE) support team. |
| An IAM policy that provides the Red Hat SRE support team with the permissions required to support Red Hat OpenShift Service on AWS clusters. | |
|
| Provides a secure mechanism for authorized Red Hat Site Reliability Engineers (SREs) to perform diagnostic and support functions on the cluster. |
Example sts_hcp_support_permission_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadPermissions",
"Effect": "Allow",
"Action": [
"ec2:DescribeAvailabilityZones",
"ec2:DescribeRegions",
"sts:DecodeAuthorizationMessage"
],
"Resource": "*"
},
{
"Sid": "Route53",
"Effect": "Allow",
"Action": [
"route53:GetHostedZone",
"route53:GetHostedZoneCount",
"route53:ListHostedZones",
"route53:ListHostedZonesByName",
"route53:ListResourceRecordSets"
],
"Resource": [
"*"
]
},
{
"Sid": "DecribeIAMRoles",
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:ListRoles"
],
"Resource": [
"*"
]
},
{
"Sid": "EC2DescribeInstance",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeReservedInstances",
"ec2:DescribeScheduledInstances"
],
"Resource": [
"*"
]
},
{
"Sid": "VPCNetwork",
"Effect": "Allow",
"Action": [
"ec2:DescribeDhcpOptions",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeSubnets",
"ec2:DescribeRouteTables"
],
"Resource": [
"*"
]
},
{
"Sid": "Cloudtrail",
"Effect": "Allow",
"Action": [
"cloudtrail:DescribeTrails",
"cloudtrail:LookupEvents"
],
"Resource": [
"*"
]
},
{
"Sid": "Cloudwatch",
"Effect": "Allow",
"Action": [
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics"
],
"Resource": [
"*"
]
},
{
"Sid": "DescribeVolumes",
"Effect": "Allow",
"Action": [
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications",
"ec2:DescribeVolumeStatus"
],
"Resource": [
"*"
]
},
{
"Sid": "DescribeLoadBalancers",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:DescribeAccountLimits",
"elasticloadbalancing:DescribeInstanceHealth",
"elasticloadbalancing:DescribeListenerCertificates",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeLoadBalancerPolicies",
"elasticloadbalancing:DescribeLoadBalancerPolicyTypes",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeRules",
"elasticloadbalancing:DescribeSSLPolicies",
"elasticloadbalancing:DescribeTags",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth"
],
"Resource": [
"*"
]
},
{
"Sid": "DescribeVPC",
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcEndpointConnections",
"ec2:DescribeVpcEndpoints"
],
"Resource": [
"*"
]
},
{
"Sid": "DescribeSecurityGroups",
"Effect": "Allow",
"Action": [
"ec2:DescribeSecurityGroupReferences",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeStaleSecurityGroups"
],
"Resource": "*"
},
{
"Sid": "DescribeAddressesAttribute",
"Effect": "Allow",
"Action": "ec2:DescribeAddressesAttribute",
"Resource": "arn:aws:ec2:*:*:elastic-ip/*"
},
{
"Sid": "DescribeInstance",
"Effect": "Allow",
"Action": [
"iam:GetInstanceProfile"
],
"Resource": "arn:aws:iam::*:instance-profile/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "DescribeSpotFleetInstances",
"Effect": "Allow",
"Action": "ec2:DescribeSpotFleetInstances",
"Resource": "arn:aws:ec2:*:*:spot-fleet-request/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "DescribeVolumeAttribute",
"Effect": "Allow",
"Action": "ec2:DescribeVolumeAttribute",
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "ManageInstanceLifecycle",
"Effect": "Allow",
"Action": [
"ec2:RebootInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
}
]
}Example sts_hcp_support_trust_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::710019948333:role/RH-Technical-Support-15234082"
},
"Action": "sts:AssumeRole"
}
]
}| Resource | Description |
|---|---|
|
| An IAM policy that grants permissions to the kube controller to manage Amazon EC2, Elastic Load Balancing, and AWS KMS resources. |
Example openshift-hcp_kube-controller-manager-credentials-policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadPermissions",
"Effect": "Allow",
"Action": [
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstances",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:DescribeLoadBalancerPolicies"
],
"Resource": [
"*"
]
},
{
"Sid": "KMSDescribeKey",
"Effect": "Allow",
"Action": [
"kms:DescribeKey"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
}
}
},
{
"Sid": "LoadBalanacerManagement",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:ConfigureHealthCheck",
"elasticloadbalancing:CreateLoadBalancerPolicy",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
"elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer"
],
"Resource": [
"*"
]
},
{
"Sid": "CreateTargetGroup",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:CreateTargetGroup"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "LoadBalanacerManagementResourceTag",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
"elasticloadbalancing:SetSecurityGroups",
"elasticloadbalancing:CreateLoadBalancerListeners",
"elasticloadbalancing:DeleteLoadBalancerListeners",
"elasticloadbalancing:AttachLoadBalancerToSubnets",
"elasticloadbalancing:DetachLoadBalancerFromSubnets",
"elasticloadbalancing:ModifyListener",
"elasticloadbalancing:SetLoadBalancerPoliciesOfListener"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateListeners",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:CreateListener"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true",
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateSecurityGroup",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateSecurityGroupVpc",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:vpc/*"
]
},
{
"Sid": "CreateLoadBalancer",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:CreateLoadBalancer"
],
"Resource": [
"arn:aws:elasticloadbalancing:*:*:loadbalancer/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "ModifySecurityGroup",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupIngress",
"ec2:DeleteSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateTagsSecurityGroups",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": "CreateSecurityGroup"
}
}
},
{
"Sid" : "ManageTargetGroup",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:DeregisterTargets"
],
"Resource" : [
"arn:aws:elasticloadbalancing:*:*:targetgroup/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/red-hat-managed" : "true"
}
}
}
]
}| Resource | Description |
|---|---|
|
| An IAM policy that grants required permissions to the Control Plane Operator to manage Amazon EC2 and Route 53 resources. |
Example openshift_hcp_control_plane_operator_credentials_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadPermissions",
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcs",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"route53:ListHostedZones"
],
"Resource": "*"
},
{
"Sid": "CreateSecurityGroups",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group*/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "DeleteSecurityGroup",
"Effect": "Allow",
"Action": [
"ec2:DeleteSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "SecurityGroupIngressEgress",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress"
],
"Resource": [
"arn:aws:ec2:*:*:security-group*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateSecurityGroupsVPCNoCondition",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:vpc/*"
]
},
{
"Sid": "ListResourceRecordSets",
"Effect": "Allow",
"Action": [
"route53:ListResourceRecordSets"
],
"Resource": [
"*"
]
},
{
"Sid": "ChangeResourceRecordSetsRestrictedRecordNames",
"Effect": "Allow",
"Action": [
"route53:ChangeResourceRecordSets"
],
"Resource": [
"*"
],
"Condition": {
"ForAllValues:StringLike": {
"route53:ChangeResourceRecordSetsNormalizedRecordNames": [
"*.hypershift.local"
]
}
}
},
{
"Sid": "VPCEndpointWithCondition",
"Effect": "Allow",
"Action": [
"ec2:CreateVpcEndpoint"
],
"Resource": [
"arn:aws:ec2:*:*:vpc-endpoint/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "VPCEndpointResourceTagCondition",
"Effect": "Allow",
"Action": [
"ec2:CreateVpcEndpoint"
],
"Resource": [
"arn:aws:ec2:*:*:security-group*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "VPCEndpointNoCondition",
"Effect": "Allow",
"Action": [
"ec2:CreateVpcEndpoint"
],
"Resource": [
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:route-table/*"
]
},
{
"Sid": "ManageVPCEndpointWithCondition",
"Effect": "Allow",
"Action": [
"ec2:ModifyVpcEndpoint",
"ec2:DeleteVpcEndpoints"
],
"Resource": [
"arn:aws:ec2:*:*:vpc-endpoint/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "ModifyVPCEndpointNoCondition",
"Effect": "Allow",
"Action": [
"ec2:ModifyVpcEndpoint"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*"
]
},
{
"Sid": "CreateTagsRestrictedActions",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:vpc-endpoint/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVpcEndpoint",
"CreateSecurityGroup"
]
}
}
},
{
"Sid": "AddDeleteTagsRedHatManagedSecurityGroups",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
},
"ForAllValues:StringNotEquals": {
"aws:TagKeys": [
"red-hat-managed"
]
},
"Null": {
"aws:TagKeys": "false"
}
}
}
]
}| Resource | Description |
|---|---|
|
| An IAM policy that grants required permissions to the NodePool controller to describe, run, and terminate Amazon EC2 instances managed as worker nodes. This policy also grants permissions to allow for disk encryption of the worker node root volume using AWS KMS keys, and to tag the elastic network interface that is attached to the worker node. |
Example openshift_hcp_capa_controller_manager_credentials_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadPermissions",
"Action": [
"ec2:DescribeDhcpOptions",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInternetGateways",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeNetworkInterfaceAttribute",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Sid": "CreateServiceLinkedRole",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Effect": "Allow",
"Resource": [
"arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing"
],
"Condition": {
"StringLike": {
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
}
}
},
{
"Sid": "PassWorkerRole",
"Action": [
"iam:PassRole"
],
"Effect": "Allow",
"Resource": [
"arn:*:iam::*:role/*-ROSA-Worker-Role"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ec2.amazonaws.com"
]
}
}
},
{
"Sid": "AuthorizeSecurityGroupIngressRestrictedResourceTag",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:security-group-rule/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "NetworkInterfaces",
"Effect": "Allow",
"Action": [
"ec2:ModifyNetworkInterfaceAttribute"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "NetworkInterfacesNoCondition",
"Effect": "Allow",
"Action": [
"ec2:ModifyNetworkInterfaceAttribute"
],
"Resource": [
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:vpc/*"
]
},
{
"Sid": "TerminateInstances",
"Effect": "Allow",
"Action": [
"ec2:TerminateInstances"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateTags",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"RunInstances"
]
}
}
},
{
"Sid": "CreateTagsCAPAControllerReconcileNetworkInterface",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateTagsCAPAControllerReconcileInstance",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateTagsCAPAControllerReconcileVolume",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "RunInstancesRequest",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "RunInstancesNoCondition",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:capacity-reservation/*"
]
},
{
"Sid": "RunInstancesRedHatAMI",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:image/*"
],
"Condition": {
"StringEquals": {
"ec2:Owner": [
"531415883065",
"251351625822"
]
}
}
},
{
"Sid": "NodePoolSQSActions",
"Effect": "Allow",
"Action": [
"sqs:DeleteMessage",
"sqs:ReceiveMessage"
],
"Resource": [
"arn:aws:sqs:*:*:*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
}
}
},
{
"Sid": "ManagedKMSRestrictedResourceTag",
"Effect": "Allow",
"Action": [
"kms:DescribeKey",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:ResourceTag/red-hat": "true"
}
}
},
{
"Sid": "CreateGrantRestricted",
"Effect": "Allow",
"Action": [
"kms:CreateGrant"
],
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": true
},
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
},
"StringLike": {
"kms:ViaService": "ec2.*.amazonaws.com"
}
}
}
]
}| Resource | Description |
|---|---|
|
| An IAM policy that grants required permissions to the Image Registry Operator to provision and manage resources for the Red Hat OpenShift Service on AWS in-cluster image registry and dependent services, including S3. This is required so that the operator can install and maintain the internal registry of a Red Hat OpenShift Service on AWS cluster. |
Example openshift_hcp_image_registry_operator_permission_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ListBuckets",
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:ListBucketMultipartUploads"
],
"Resource": "*"
},
{
"Sid": "AllowSpecificBucketActions",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:GetBucketTagging",
"s3:GetBucketPublicAccessBlock",
"s3:GetEncryptionConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetBucketLocation",
"s3:PutBucketPublicAccessBlock",
"s3:PutBucketTagging",
"s3:PutEncryptionConfiguration",
"s3:PutLifecycleConfiguration"
],
"Resource": [
"arn:aws:s3:::*-image-registry-${aws:RequestedRegion}-*",
"arn:aws:s3:::*-image-registry-${aws:RequestedRegion}?",
"arn:aws:s3:::*-image-registry-${aws:RequestedRegion}"
]
},
{
"Sid": "AllowSpecificObjectActions",
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:GetObject",
"s3:ListMultipartUploadParts",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*-image-registry-${aws:RequestedRegion}-*/*",
"arn:aws:s3:::*-image-registry-${aws:RequestedRegion}?/*",
"arn:aws:s3:::*-image-registry-${aws:RequestedRegion}/*"
]
}
]
}| Resource | Description |
|---|---|
|
| An IAM policy that grants necessary permissions to the Amazon EBS CSI Driver Operator to install and maintain the Amazon EBS CSI driver on a Red Hat OpenShift Service on AWS cluster. |
Example openshift_hcp_cluster_csi_driver_ebs_operator_cloud_credentials_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadOnlyDescribeOperations",
"Effect": "Allow",
"Action": [
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstances",
"ec2:DescribeInstanceTypes",
"ec2:DescribeSnapshots",
"ec2:DescribeTags",
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications",
"ec2:DescribeVolumeStatus"
],
"Resource": "*"
},
{
"Sid": "CreateAndCopyVolumesWithManagedTag",
"Effect": "Allow",
"Action": [
"ec2:CreateVolume",
"ec2:CopyVolumes"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CopyManagedVolumes",
"Effect": "Allow",
"Action": [
"ec2:CopyVolumes"
],
"Resource": "arn:aws:ec2:*:*:volume/vol-*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CopyUserBroughtVolumes",
"Effect": "Allow",
"Action": [
"ec2:CopyVolumes"
],
"Resource": "arn:aws:ec2:*:*:volume/vol-*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
}
}
},
{
"Sid": "CreateSnapshotsWithManagedTag",
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateSnapshotsFromManagedVolumes",
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateSnapshotsFromUserBroughtVolumes",
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
}
}
},
{
"Sid": "ManageManagedVolumes",
"Effect": "Allow",
"Action": [
"ec2:ModifyVolume",
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:DeleteVolume"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "ManageUserBroughtVolumes",
"Effect": "Allow",
"Action": [
"ec2:ModifyVolume",
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:DeleteVolume"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
}
}
},
{
"Sid": "CreateVolumesFromAndEnableFSROnManagedSnapshots",
"Effect": "Allow",
"Action": [
"ec2:CreateVolume",
"ec2:EnableFastSnapshotRestores"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "CreateVolumesFromAndEnableFSROnUserBroughtSnapshots",
"Effect": "Allow",
"Action": [
"ec2:CreateVolume",
"ec2:EnableFastSnapshotRestores"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
}
}
},
{
"Sid": "AttachDetachVolumesToManagedInstances",
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:DetachVolume"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "DeleteAndLockManagedSnapshots",
"Effect": "Allow",
"Action": [
"ec2:DeleteSnapshot",
"ec2:LockSnapshot"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
},
{
"Sid": "DeleteAndLockUserBroughtSnapshots",
"Effect": "Allow",
"Action": [
"ec2:DeleteSnapshot",
"ec2:LockSnapshot"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
}
}
},
{
"Sid": "TagResourcesOnCreation",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateVolume",
"CreateSnapshot",
"CopyVolumes"
]
}
}
},
{
"Sid": "ModifyTagsOnManagedVolumes",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
},
"Null": {
"aws:TagKeys": "false"
},
"ForAllValues:StringNotEquals": {
"aws:TagKeys": [
"red-hat-managed",
"ebs.csi.aws.com/cluster",
"kubernetes.io/created-for/pvc/name"
]
}
}
},
{
"Sid": "ModifyTagsOnUserBroughtVolumes",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
},
"Null": {
"aws:TagKeys": "false"
},
"ForAllValues:StringNotEquals": {
"aws:TagKeys": [
"red-hat-managed",
"red-hat",
"ebs.csi.aws.com/cluster",
"kubernetes.io/created-for/pvc/name"
]
}
}
},
{
"Sid": "KMSEncryptedVolumes",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKeyWithoutPlaintext",
"kms:ReEncryptFrom",
"kms:ReEncryptTo"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
},
"StringLike": {
"kms:ViaService": "ec2.*.amazonaws.com"
},
"Null": {
"kms:EncryptionContextKeys": false
},
"ForAllValues:StringEquals": {
"kms:EncryptionContextKeys": [
"aws:ebs:id"
]
}
}
},
{
"Sid": "KMSCreateGrant",
"Effect": "Allow",
"Action": [
"kms:CreateGrant"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": true
},
"StringLike": {
"kms:ViaService": "ec2.*.amazonaws.com"
},
"StringEquals": {
"kms:GrantConstraintType": "EncryptionContextSubset",
"aws:ResourceTag/red-hat": "true"
},
"Null": {
"kms:EncryptionContextKeys": false
},
"ForAllValues:StringEquals": {
"kms:GrantOperations": [
"Decrypt",
"GenerateDataKeyWithoutPlaintext",
"ReEncryptFrom",
"ReEncryptTo"
],
"kms:EncryptionContextKeys": [
"aws:ebs:id"
]
}
}
},
{
"Sid": "DescribeKMSKeysForEBSVolumeEncryption",
"Effect": "Allow",
"Action": "kms:DescribeKey",
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
},
"StringLike": {
"kms:ViaService": "ec2.*.amazonaws.com"
}
}
}
]
}| Resource | Description |
|---|---|
|
| An IAM policy that grants necessary permissions to the Cloud Network Config Operator to manage cloud network configuration on a Red Hat OpenShift Service on AWS cluster. |
Example openshift_hcp_cloud_network_config_cloud_credentials_permission_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypes",
"ec2:DescribeSubnets",
"ec2:DescribeNetworkInterfaces"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:UnassignPrivateIpAddresses",
"ec2:AssignPrivateIpAddresses",
"ec2:UnassignIpv6Addresses",
"ec2:AssignIpv6Addresses"
],
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat-managed": "true"
}
}
}
]
}| Resource | Description |
|---|---|
|
| An IAM policy that provides the Red Hat OpenShift Service on AWS Ingress Operator with the permissions required to manage external access to a cluster. |
Example openshift_hcp_cluster_ingress_operator_cloud_credentials_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:DescribeLoadBalancers",
"route53:ListHostedZones",
"tag:GetResources"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"route53:ChangeResourceRecordSets"
],
"Resource": "*",
"Condition": {
"ForAllValues:StringLike": {
"route53:ChangeResourceRecordSetsNormalizedRecordNames": [
"*.openshiftapps.com",
"*.devshift.org",
"*.openshiftusgov.com",
"*.devshiftusgov.com"
]
}
}
}
]
}| Resource | Description |
|---|---|
|
| An IAM policy that grants required permissions to the built-in AWS Encryption Provider to manage AWS KMS keys that support etcd data encryption. This policy allows Amazon EC2 to use KMS keys that the AWS Encryption Provider provides to encrypt and decrypt etcd data. |
Example openshift_hcp_kms_provider_credential_policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VolumeEncryption",
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:DescribeKey"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/red-hat": "true"
}
}
}
]
}6.2.3. Account-wide IAM role and policy AWS CLI reference
The following aws CLI commands are generated when you run the rosa create account-roles command. You can run the command in either manual or automatic mode.
6.2.3.1. Using manual mode for account role creation
The manual role creation mode generates the aws commands for you to review and run. The following command starts that process, where <openshift_version> refers to your version of Red Hat OpenShift Service on AWS, such as 4.
$ rosa create account-roles --mode manual
The provided command examples include the ManagedOpenShift prefix. The ManagedOpenShift prefix is the default value, if you do not specify a custom prefix by using the --prefix option.
Command output
aws iam create-role \
--role-name ManagedOpenShift-Installer-Role \
--assume-role-policy-document file://sts_installer_trust_policy.json \
--tags Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value=ManagedOpenShift Key=rosa_role_type,Value=installer
aws iam put-role-policy \
--role-name ManagedOpenShift-Installer-Role \
--policy-name ManagedOpenShift-Installer-Role-Policy \
--policy-document file://sts_installer_permission_policy.json
aws iam create-role \
--role-name ManagedOpenShift-ControlPlane-Role \
--assume-role-policy-document file://sts_instance_controlplane_trust_policy.json \
--tags Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value=ManagedOpenShift Key=rosa_role_type,Value=instance_controlplane
aws iam put-role-policy \
--role-name ManagedOpenShift-ControlPlane-Role \
--policy-name ManagedOpenShift-ControlPlane-Role-Policy \
--policy-document file://sts_instance_controlplane_permission_policy.json
aws iam create-role \
--role-name ManagedOpenShift-Worker-Role \
--assume-role-policy-document file://sts_instance_worker_trust_policy.json \
--tags Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value=ManagedOpenShift Key=rosa_role_type,Value=instance_worker
aws iam put-role-policy \
--role-name ManagedOpenShift-Worker-Role \
--policy-name ManagedOpenShift-Worker-Role-Policy \
--policy-document file://sts_instance_worker_permission_policy.json
aws iam create-role \
--role-name ManagedOpenShift-Support-Role \
--assume-role-policy-document file://sts_support_trust_policy.json \
--tags Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value=ManagedOpenShift Key=rosa_role_type,Value=support
aws iam put-role-policy \
--role-name ManagedOpenShift-Support-Role \
--policy-name ManagedOpenShift-Support-Role-Policy \
--policy-document file://sts_support_permission_policy.json
aws iam create-policy \
--policy-name ManagedOpenShift-openshift-ingress-operator-cloud-credentials \
--policy-document file://openshift_ingress_operator_cloud_credentials_policy.json \
--tags Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value=ManagedOpenShift Key=operator_namespace,Value=openshift-ingress-operator Key=operator_name,Value=cloud-credentials
aws iam create-policy \
--policy-name ManagedOpenShift-openshift-cluster-csi-drivers-ebs-cloud-credent \
--policy-document file://openshift_cluster_csi_drivers_ebs_cloud_credentials_policy.json \
--tags Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value=ManagedOpenShift Key=operator_namespace,Value=openshift-cluster-csi-drivers Key=operator_name,Value=ebs-cloud-credentials
aws iam create-policy \
--policy-name ManagedOpenShift-openshift-machine-api-aws-cloud-credentials \
--policy-document file://openshift_machine_api_aws_cloud_credentials_policy.json \
--tags Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value=ManagedOpenShift Key=operator_namespace,Value=openshift-machine-api Key=operator_name,Value=aws-cloud-credentials
aws iam create-policy \
--policy-name ManagedOpenShift-openshift-cloud-credential-operator-cloud-crede \
--policy-document file://openshift_cloud_credential_operator_cloud_credential_operator_iam_ro_creds_policy.json \
--tags Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value=ManagedOpenShift Key=operator_namespace,Value=openshift-cloud-credential-operator Key=operator_name,Value=cloud-credential-operator-iam-ro-creds
aws iam create-policy \
--policy-name ManagedOpenShift-openshift-image-registry-installer-cloud-creden \
--policy-document file://openshift_image_registry_installer_cloud_credentials_policy.json \
--tags Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value=ManagedOpenShift Key=operator_namespace,Value=openshift-image-registry Key=operator_name,Value=installer-cloud-credentials6.2.3.2. Using auto mode for role creation
When you add the --mode auto argument, the Red Hat OpenShift Service on AWS (ROSA) CLI, rosa, creates your roles and policies. The following command starts that process:
$ rosa create account-roles --mode auto
The provided command examples include the ManagedOpenShift prefix. The ManagedOpenShift prefix is the default value, if you do not specify a custom prefix by using the --prefix option.
Command output
I: Creating roles using 'arn:aws:iam::<ARN>:user/<UserID>'
? Create the 'ManagedOpenShift-Installer-Role' role? Yes
I: Created role 'ManagedOpenShift-Installer-Role' with ARN 'arn:aws:iam::<ARN>:role/ManagedOpenShift-Installer-Role'
? Create the 'ManagedOpenShift-ControlPlane-Role' role? Yes
I: Created role 'ManagedOpenShift-ControlPlane-Role' with ARN 'arn:aws:iam::<ARN>:role/ManagedOpenShift-ControlPlane-Role'
? Create the 'ManagedOpenShift-Worker-Role' role? Yes
I: Created role 'ManagedOpenShift-Worker-Role' with ARN 'arn:aws:iam::<ARN>:role/ManagedOpenShift-Worker-Role'
? Create the 'ManagedOpenShift-Support-Role' role? Yes
I: Created role 'ManagedOpenShift-Support-Role' with ARN 'arn:aws:iam::<ARN>:role/ManagedOpenShift-Support-Role'
? Create the operator policies? Yes
I: Created policy with ARN 'arn:aws:iam::<ARN>:policy/ManagedOpenShift-openshift-machine-api-aws-cloud-credentials'
I: Created policy with ARN 'arn:aws:iam::<ARN>:policy/ManagedOpenShift-openshift-cloud-credential-operator-cloud-crede'
I: Created policy with ARN 'arn:aws:iam::<ARN>:policy/ManagedOpenShift-openshift-image-registry-installer-cloud-creden'
I: Created policy with ARN 'arn:aws:iam::<ARN>:policy/ManagedOpenShift-openshift-ingress-operator-cloud-credentials'
I: Created policy with ARN 'arn:aws:iam::<ARN>:policy/ManagedOpenShift-openshift-cluster-csi-drivers-ebs-cloud-credent'
I: Created policy with ARN 'arn:aws:iam::<ARN>:policy/ManagedOpenShift-openshift-cloud-network-config-controller-cloud'
I: To create a cluster with these roles, run the following command:
rosa create cluster --sts6.3. Cluster-specific Operator IAM role reference
Use Operator roles to authenticate to your AWS resources through an OpenID Connect (OIDC) provider, and obtain temporary permissions for cluster operations. Securing these permissions helps you successfully manage capabilities such as back-end storage, cloud ingress controllers, and external cluster access.
When you create the Operator roles, the account-wide Operator policies for the matching cluster version are attached to the roles. AWS managed Operator policies are versioned in AWS IAM. The latest version of an AWS managed policy is always used, so you do not need to manage or schedule upgrades for AWS managed policies used by Red Hat OpenShift Service on AWS.
If more than one matching policy is available in your account for an Operator role, an interactive list of options is provided when you create the role.
| Role name | AWS Managed policy name | Role description |
|---|---|---|
|
|
| An IAM role required by the cloud network config controller to manage cloud network credentials for a cluster. |
|
|
| An IAM role required by the Red Hat OpenShift Service on AWS Image Registry Operator to manage the OpenShift image registry storage in AWS S3 for a cluster. |
|
|
| An IAM role required for OpenShift management on hosted control planes (HCP) clusters. |
|
|
| An IAM role required for node management on HCP clusters. |
|
|
| An IAM role required for control plane management on HCP clusters. |
|
|
| An IAM role required for OpenShift management on HCP clusters. |
|
|
| An IAM role required by the Red Hat OpenShift Service on AWS Ingress Operator to manage external access to a cluster. |
|
|
| An IAM role required by Red Hat OpenShift Service on AWS to manage back-end storage through the Container Storage Interface (CSI). |
6.3.1. Operator IAM role AWS CLI reference
In manual mode, you can review and modify the generated commands before running them, giving you full control over the Identity and Access Management (IAM) resources created in your AWS account.
Running the following rosa command generates the aws CLI commands that create your Operator IAM roles:
$ rosa create operator-roles --mode manual --cluster <cluster_name>
When using manual mode, the aws commands are printed to the terminal for your review. After reviewing the aws commands, you must run them manually. Alternatively, you can specify --mode auto with the rosa create command to run the aws commands immediately.
Command output
aws iam create-role \
--role-name <cluster_name>-<hash>-openshift-cluster-csi-drivers-ebs-cloud-credent \
--assume-role-policy-document file://operator_cluster_csi_drivers_ebs_cloud_credentials_policy.json \
--tags Key=rosa_cluster_id,Value=<id> Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value= Key=operator_namespace,Value=openshift-cluster-csi-drivers Key=operator_name,Value=ebs-cloud-credentials
aws iam attach-role-policy \
--role-name <cluster_name>-<hash>-openshift-cluster-csi-drivers-ebs-cloud-credent \
--policy-arn arn:aws:iam::<aws_account_id>:policy/ManagedOpenShift-openshift-cluster-csi-drivers-ebs-cloud-credent
aws iam create-role \
--role-name <cluster_name>-<hash>-openshift-machine-api-aws-cloud-credentials \
--assume-role-policy-document file://operator_machine_api_aws_cloud_credentials_policy.json \
--tags Key=rosa_cluster_id,Value=<id> Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value= Key=operator_namespace,Value=openshift-machine-api Key=operator_name,Value=aws-cloud-credentials
aws iam attach-role-policy \
--role-name <cluster_name>-<hash>-openshift-machine-api-aws-cloud-credentials \
--policy-arn arn:aws:iam::<aws_account_id>:policy/ManagedOpenShift-openshift-machine-api-aws-cloud-credentials
aws iam create-role \
--role-name <cluster_name>-<hash>-openshift-cloud-credential-operator-cloud-crede \
--assume-role-policy-document file://operator_cloud_credential_operator_cloud_credential_operator_iam_ro_creds_policy.json \
--tags Key=rosa_cluster_id,Value=<id> Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value= Key=operator_namespace,Value=openshift-cloud-credential-operator Key=operator_name,Value=cloud-credential-operator-iam-ro-creds
aws iam attach-role-policy \
--role-name <cluster_name>-<hash>-openshift-cloud-credential-operator-cloud-crede \
--policy-arn arn:aws:iam::<aws_account_id>:policy/ManagedOpenShift-openshift-cloud-credential-operator-cloud-crede
aws iam create-role \
--role-name <cluster_name>-<hash>-openshift-image-registry-installer-cloud-creden \
--assume-role-policy-document file://operator_image_registry_installer_cloud_credentials_policy.json \
--tags Key=rosa_cluster_id,Value=<id> Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value= Key=operator_namespace,Value=openshift-image-registry Key=operator_name,Value=installer-cloud-credentials
aws iam attach-role-policy \
--role-name <cluster_name>-<hash>-openshift-image-registry-installer-cloud-creden \
--policy-arn arn:aws:iam::<aws_account_id>:policy/ManagedOpenShift-openshift-image-registry-installer-cloud-creden
aws iam create-role \
--role-name <cluster_name>-<hash>-openshift-ingress-operator-cloud-credentials \
--assume-role-policy-document file://operator_ingress_operator_cloud_credentials_policy.json \
--tags Key=rosa_cluster_id,Value=<id> Key=rosa_openshift_version,Value=<openshift_version> Key=rosa_role_prefix,Value= Key=operator_namespace,Value=openshift-ingress-operator Key=operator_name,Value=cloud-credentials
aws iam attach-role-policy \
--role-name <cluster_name>-<hash>-openshift-ingress-operator-cloud-credentials \
--policy-arn arn:aws:iam::<aws_account_id>:policy/ManagedOpenShift-openshift-ingress-operator-cloud-credentials
The command examples provided in the table include Operator roles that use the ManagedOpenShift prefix. If you defined a custom prefix when you created the account-wide roles and policies, including the Operator policies, you must reference it by using the --prefix <prefix_name> option when you create the Operator roles.
6.3.2. Custom Operator IAM role prefixes
Each Red Hat OpenShift Service on AWS cluster requires cluster-specific Operator Identity and Access Management (IAM) roles.
By default, the Operator role names are prefixed with the cluster name and a random 4-digit hash. For example, the Ingress Cloud Credentials Operator IAM role for a cluster named mycluster has the default name mycluster-<hash>-openshift-ingress-operator-cloud-credentials, where <hash> is a random 4-digit string.
This default naming convention enables you to easily identify the Operator IAM roles for a cluster in your AWS account.
When you create the Operator roles for a cluster, you can optionally specify a custom prefix to use instead of <cluster_name>-<hash>. By using a custom prefix, you can prepend logical identifiers to your Operator role names to meet the requirements of your environment. For example, you might prefix the cluster name and the environment type, such as mycluster-dev. In that example, the Ingress Cloud Credentials Operator role name with the custom prefix is mycluster-dev-openshift-ingress-operator-cloud-credenti.
The role names are truncated to 64 characters.
6.4. OIDC requirements for Operator authentication
For Red Hat OpenShift Service on AWS installations that use the AWS Security Token Service (STS), you must create a cluster-specific OpenID Connect (OIDC) provider that is used by the cluster Operators to authenticate or create your own OIDC configuration for your own OIDC provider.
6.4.1. Create an OIDC provider using the rosa CLI
Create an OpenID Connect (OIDC) provider that is hosted in your AWS account with the ROSA command-line interface (CLI) (rosa) to enable in-cluster Operators to authenticate with AWS resources.
Prerequisites
-
You have installed the latest version of the
rosaCLI.
Procedure
To create an OIDC provider, use an unregistered or a registered OIDC configuration.
Unregistered OIDC configurations require you to create the OIDC provider through the cluster. Run the following to create the OIDC provider:
$ rosa create oidc-provider --mode manual --cluster <cluster_name>NoteWhen using
manualmode, theawscommand is printed to the terminal for your review. After reviewing theawscommand, you must run it manually. Alternatively, you can specify--mode autowith therosa createcommand to run theawscommand immediately.Example output
aws iam create-open-id-connect-provider \ --url https://oidc.op1.openshiftapps.com/<oidc_config_id> \ --client-id-list openshift sts.<aws_region>.amazonaws.com \ --thumbprint-list <thumbprint>where:
<oidc_config_id>- Specifies the URL used to reach the OIDC identity provider after the cluster is created.
<thumbprint>-
Specifies the thumbprint, which is generated automatically when you run the
rosa create oidc-providercommand. For more information about using thumbprints with AWS Identity and Access Management (IAM) OIDC identity providers, see Obtain the thumbprint for OIDC (AWS documentation).
Registered OIDC configurations use an OIDC configuration ID. Run the following command with your OIDC configuration ID:
$ rosa create oidc-provider --oidc-config-id <oidc_config_id> --mode auto -yExample output
I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName' I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/241rh9ql5gpu99d7leokhvkp8icnalpf'
6.4.2. OpenID Connect configuration overview
When using a cluster hosted by Red Hat, you can create a managed or unmanaged OpenID Connect (OIDC) configuration by using the ROSA command-line interface (CLI) (rosa). Your choice of OIDC configuration determines where the OIDC keys are stored.
A managed OIDC configuration is stored within Red Hat’s AWS account, while a generated unmanaged OIDC configuration is stored within your AWS account. The OIDC configuration is registered to be used with OpenShift Cluster Manager. When creating an unmanaged OIDC configuration, the rosa CLI provides the private key for you.
6.4.2.1. Create an OpenID Connect configuration
Create an OpenID Connect (OIDC) configuration before creating your Red Hat OpenShift Service on AWS cluster to authenticate Operator access to required AWS resources by using the AWS Security Token Service (STS). Each production cluster requires its own OIDC configuration.
Prerequisites
- You have completed the AWS prerequisites for Red Hat OpenShift Service on AWS.
-
You have installed and configured the latest ROSA command-line interface (CLI) (
rosa) on your installation host.
Procedure
To create your OIDC configuration alongside the AWS resources, run the following command:
$ rosa create oidc-config --mode=auto --yesExample output
? Would you like to create a Managed (Red{nbsp}Hat hosted) OIDC Configuration Yes I: Setting up managed OIDC configuration I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user_defined> with a prefix of your choice: rosa create operator-roles --prefix <user_defined> --oidc-config-id 13cdr6b If you are going to create a Hosted Control Plane cluster please include '--hosted-cp' I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName' ? Create the OIDC provider? Yes I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for
--mode auto, otherwise you must determine these values based onawsCLI output for--mode manual.Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable:
$ export OIDC_ID=<oidc_config_id><oidc_config_id>-
In this example output, the OIDC configuration ID is
13cdr6b.
View the value of the variable by running the following command:
$ echo $OIDC_IDExample output
13cdr6b
Verification
You can list the possible OIDC configurations available for your clusters that are associated with your user organization. Run the following command:
$ rosa list oidc-configExample output
ID MANAGED ISSUER URL SECRET ARN 2330dbs0n8m3chkkr25gkkcd8pnj3lk2 true https://dvbwgdztaeq9o.cloudfront.net/2330dbs0n8m3chkkr25gkkcd8pnj3lk2 233hvnrjoqu14jltk6lhbhf2tj11f8un false https://oidc-r7u1.s3.us-east-1.amazonaws.com aws:secretsmanager:us-east-1:242819244:secret:rosa-private-key-oidc-r7u1-tM3MDN
6.4.2.2. Parameter options for creating your own OpenID Connect configuration
The rosa create oidc-config command accepts several optional parameters. Running this command without parameters creates an unmanaged OpenID Connect (OIDC) configuration.
You are required to register the unmanaged OIDC configuration by posting a request to /oidc_configs through OpenShift Cluster Manager. You receive an ID in the response. Use this ID to create a cluster.
6.4.2.2.1. raw-files
Allows you to provide raw files for the private RSA key. This key is named rosa-private-key-oidc-<random_label_of_length_4>.key. You also receive a discovery document, named discovery-document-oidc-<random_label_of_length_4>.json, and a JSON Web Key Set, named jwks-oidc-<random_label_of_length_4>.json.
You use these files to set up the endpoint. This endpoint responds to /.well-known/openid-configuration with the discovery document and on keys.json with the JSON Web Key Set. The private key is stored in Amazon Web Services (AWS) Secrets Manager Service (SMS) as plain text.
Example
$ rosa create oidc-config --raw-files6.4.2.2.2. mode
Allows you to specify the mode to create your OIDC configuration. With the manual option, you receive AWS commands that set up the OIDC configuration in an S3 bucket. This option stores the private key in the Secrets Manager. With the manual option, the OIDC Endpoint URL is the URL for the S3 bucket. You must retrieve the Secrets Manager Amazon Resource Name (ARN) to register the OIDC configuration with OpenShift Cluster Manager.
You receive the same OIDC configuration and AWS resources as the manual mode when using the auto option. A significant difference between the two options is that when using the auto option, Red Hat OpenShift Service on AWS calls AWS, so you do not need to take any further actions. The OIDC Endpoint URL is the URL for the S3 bucket. The rosa CLI retrieves the Secrets Manager ARN, registers the OIDC configuration with OpenShift Cluster Manager, and reports the second rosa command that the user can run to continue with the creation of the STS cluster.
Example
$ rosa create oidc-config --mode=<auto|manual>6.4.2.2.3. managed
Creates an OIDC configuration that is hosted under Red Hat’s AWS account. This command creates a private key that responds directly with an OIDC Config ID for you to use when creating the STS cluster.
Example
$ rosa create oidc-config --managedExample output
W: For a managed OIDC Config only auto mode is supported. However, you may choose the provider creation mode
? OIDC Provider creation mode: auto
I: Setting up managed OIDC configuration
I: Please run the following command to create a cluster with this oidc config
rosa create cluster --sts --oidc-config-id 233jnu62i9aphpucsj9kueqlkr1vcgra
I: Creating OIDC provider using 'arn:aws:iam::242819244:user/userName'
? Create the OIDC provider? Yes
I: Created OIDC provider with ARN 'arn:aws:iam::242819244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/233jnu62i9aphpucsj9kueqlkr1vcgra'6.5. Minimum set of effective permissions for service control policies
Review a minimum set of permissions that your AWS organization’s service control policies (SCPs) must allow for Red Hat OpenShift Service on AWS to work correctly.
SCPs are a type of organization policy that manages permissions within your organization. SCPs ensure that accounts within your organization stay within your defined access control guidelines. These policies are maintained in AWS organizations and control the services that are available within the attached AWS accounts. SCP management is the responsibility of the customer.
When using AWS Security Token Service (STS), you must ensure that the service control policy does not block the following resources:
-
ec2:{} -
iam:{} -
tag:*
Verify that your service control policy (SCP) does not restrict any of these required permissions.
| Service | Actions | Effect | |
|---|---|---|---|
| Required | Amazon EC2 | All | Allow |
| Amazon EC2 Auto Scaling | All | Allow | |
| Amazon S3 | All | Allow | |
| Identity And Access Management | All | Allow | |
| Elastic Load Balancing | All | Allow | |
| Elastic Load Balancing V2 | All | Allow | |
| Amazon CloudWatch | All | Allow | |
| Amazon CloudWatch Events | All | Allow | |
| Amazon CloudWatch Logs | All | Allow | |
| AWS EC2 Instance Connect | SendSerialConsoleSSHPublicKey | Allow | |
| AWS Support | All | Allow | |
| AWS Key Management Service | All | Allow | |
| AWS Security Token Service | All | Allow | |
| AWS Tiro | CreateQuery GetQueryAnswer GetQueryExplanation | Allow | |
| AWS Marketplace | Subscribe Unsubscribe View Subscriptions | Allow | |
| AWS Resource Tagging | All | Allow | |
| AWS Route53 DNS | All | Allow | |
| AWS Service Quotas | ListServices GetRequestedServiceQuotaChange GetServiceQuota RequestServiceQuotaIncrease ListServiceQuotas | Allow | |
| Optional | AWS Billing | ViewAccount Viewbilling ViewUsage | Allow |
| AWS Cost and Usage Report | All | Allow | |
| AWS Cost Explorer Services | All | Allow |
6.6. Customer-managed policies
In Red Hat OpenShift Service on AWS, you can attach customer-managed policies to the Identity and Access Management (IAM) roles required to run and maintain Red Hat OpenShift Service on AWS clusters. This is a standard AWS IAM roles capability.
The ability to attach these policies to IAM roles specific to Red Hat OpenShift Service on AWS extends cluster permission capabilities; for example, as a way to allow cluster components to access additional AWS resources that are otherwise not part of the IAM policies specific to Red Hat OpenShift Service on AWS.
To ensure that any critical customer applications that rely on customer-managed policies are not modified in any way during cluster or role upgrades, Red Hat OpenShift Service on AWS uses the ListAttachedRolesPolicies permission to retrieve the list of permission policies from roles and the ListRolePolicies permission to retrieve the list of policies from roles specific to Red Hat OpenShift Service on AWS. This information ensures that customer-managed policies are not impacted during cluster events, and allows Red Hat Site Reliability Engineers (SREs) to monitor both Red Hat OpenShift Service on AWS and customer-managed policies attached to IAM roles specific to Red Hat OpenShift Service on AWS, enhancing their ability to troubleshoot any cluster issues more effectively.
Attaching permission boundary policies to IAM roles that restrict policies specific to Red Hat OpenShift Service on AWS is not supported, as these policies could interrupt the functionality of the basic permissions necessary to successfully run and maintain your Red Hat OpenShift Service on AWS cluster. There are prepared permissions boundary policies for the Red Hat OpenShift Service on AWS (classic architecture) installer role. See the Additional resources section for more information.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}