Skip to content

Commit ad1cf29

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #65180 from smunje1/OSDOCS-6743
OSDOCS-6743
2 parents 612fb70 + 486578e commit ad1cf29

File tree

4 files changed

+226
-0
lines changed

4 files changed

+226
-0
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,8 @@ Distros: openshift-rosa
330330
Topics:
331331
- Name: Audit logs
332332
File: audit-log-view
333+
- Name: Adding additional constraints for IP-based AWS role assumption
334+
File: rosa-adding-additional-constraints-for-ip-based-aws-role-assumption
333335
#- Name: Security
334336
# File: rosa-security
335337
#- Name: Application and cluster compliance

‎modules/rosa-attaching-the-policy.adoc

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa-adding-additional-constraints-for-ip-based-aws-role-assumption/rosa-attaching-the-policy.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="rosa-attaching-the-policy_{context}"]
7+
= Attaching the identity-based IAM policy
8+
9+
:context: rosa-attaching-the-policy
10+
11+
toc::[]
12+
13+
Once you have created an identity-based IAM policy, attach it to the relevant IAM users, groups, or roles in your AWS account to prevent IP-based role assumption for those entities.
14+
15+
.Procedure
16+
17+
. Navigate to the IAM console in the AWS Management Console.
18+
. Select the default IAM `ManagedOpenShift-Support-Role` role to which you want to attach the policy.
19+
+
20+
[NOTE]
21+
====
22+
You can change the default IAM `ManagedOpenShift-Support-Role` role. For more information about roles, see link:https://docs.openshift.com/rosa/rosa_architecture/rosa_policy_service_definition/rosa-sre-access.html#rosa-policy-rh-access_rosa-sre-access[Red Hat support access].
23+
====
24+
+
25+
. In the *Permissions* tab, select *Add Permissions* or *Create inline policy* from the *Add Permissions* drop-down list.
26+
. Search for the policy you created earlier by:
27+
.. Entering the policy name.
28+
.. Filtering by the appropriate category.
29+
. Select the policy and click *Attach policy*.
30+
31+
[IMPORTANT]
32+
====
33+
To ensure effective IP-based role assumption prevention, you must keep the allowlisted IPs up to date. Failure to do so may result in Red Hat site reliability engineering (SRE) being unable to access your account and affect your SLA. If you have further questions or require assistance, please reach out to our support team.
34+
====
35+

‎modules/rosa-create-an-identity-based-policy.adoc

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa-adding-additional-constraints-for-ip-based-aws-role-assumption/rosa-create-an-identity-based-policy.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="rosa-create-an-identity-based-policy_{context}"]
7+
= Create an identity-based IAM policy
8+
9+
:context: rosa-create-an-identity-based-policy
10+
11+
toc::[]
12+
13+
You can create an identity-based Identity and Access Management (IAM) policy that denies access to all AWS actions when the request originates from an IP address other than Red Hat provided IPs.
14+
15+
.Prerequisites
16+
17+
* You have access to the see link:https://aws.amazon.com/console/[AWS Management Console] with the permissions required to create and modify IAM policies.
18+
19+
.Procedure
20+
21+
. Sign in to the AWS Management Console using your AWS account credentials.
22+
. Navigate to the IAM service.
23+
. In the IAM console, select *Policies* from the left navigation menu.
24+
. Click *Create policy*.
25+
. Select the *JSON* tab to define the policy using JSON format.
26+
. Copy and paste the following JSON policy document into the editor:
27+
+
28+
[source,json]
29+
----
30+
{
31+
"Version": "2012-10-17",
32+
"Statement": [
33+
{
34+
"Effect": "Deny",
35+
"Action": "*",
36+
"Resource": "*",
37+
"Condition": {
38+
"NotIpAddress": {
39+
"aws:SourceIp": [
40+
"3.223.162.20/32",
41+
"3.233.177.185/32",
42+
"54.209.120.28/32",
43+
"23.21.192.204/32",
44+
"23.23.16.23/32",
45+
"3.217.67.187/32",
46+
"34.206.248.211/32",
47+
"34.237.192.147/32",
48+
"52.1.97.230/32",
49+
"18.214.192.218/32",
50+
"3.218.132.183/32",
51+
"52.202.67.83/32",
52+
"18.220.162.161/32",
53+
"18.224.36.208/32",
54+
"3.143.200.173/32",
55+
"54.197.245.192/32",
56+
"3.23.162.248/32",
57+
"44.217.70.145/32",
58+
"52.202.89.184/32",
59+
"54.174.41.137/32",
60+
"3.231.181.77/32",
61+
"44.193.253.218/32",
62+
"52.201.38.139/32",
63+
"34.205.217.112/32",
64+
"23.22.217.39/32",
65+
"44.193.121.36/32",
66+
"54.211.144.4/32",
67+
"34.194.251.19/32",
68+
"44.196.79.250/32",
69+
"52.45.208.183/32",
70+
"100.20.120.76/32",
71+
"100.20.197.29/32",
72+
"52.26.177.23/32",
73+
"34.197.214.203/32",
74+
"35.170.167.51/32",
75+
"52.23.44.43/32",
76+
"44.228.245.162/32",
77+
"44.238.205.35/32",
78+
"54.203.216.175/32",
79+
"34.237.49.153/32",
80+
"44.196.177.146/32",
81+
"52.23.117.40/32",
82+
"44.225.234.235/32",
83+
"44.241.225.78/32",
84+
"44.241.55.3/32",
85+
"34.237.180.56/32",
86+
"44.205.240.205/32",
87+
"52.54.93.238/32",
88+
"35.155.66.53/32",
89+
"44.231.249.237/32",
90+
"44.233.161.100/32",
91+
"3.229.185.234/32",
92+
"54.147.98.63/32",
93+
"54.163.100.197/32",
94+
"23.20.194.86/32",
95+
"23.22.242.238/32",
96+
"54.147.218.140/32",
97+
"52.21.229.141/32",
98+
"54.227.5.10/32",
99+
"54.146.138.135/32",
100+
"23.21.239.1/32",
101+
"52.20.145.130/32",
102+
"54.157.89.24/32",
103+
"107.22.162.110/32",
104+
"3.223.147.2/32",
105+
"54.88.225.66/32",
106+
"54.177.143.128/32",
107+
"54.219.250.189/32",
108+
"18.135.14.84/32",
109+
"18.135.218.119/32",
110+
"3.11.51.55/32",
111+
"3.233.86.181/32",
112+
"34.226.229.129/32",
113+
"44.194.44.138/32",
114+
"34.216.5.118/32",
115+
"52.11.52.9/32",
116+
"52.40.203.77/32",
117+
"18.217.173.123/32",
118+
"3.13.34.119/32",
119+
"3.19.160.232/32",
120+
"18.188.187.143/32",
121+
"18.216.245.132/32",
122+
"52.14.85.89/32",
123+
"52.21.184.148/32",
124+
"44.194.57.131/32",
125+
"18.188.65.148/32",
126+
"3.130.101.176/32",
127+
"3.130.198.233/32",
128+
"54.210.128.71/32",
129+
"54.227.100.14/32",
130+
"54.92.188.93/32",
131+
"107.22.5.187/32",
132+
"3.217.212.27/32",
133+
"52.22.56.3/32",
134+
"52.5.10.152/32",
135+
"54.237.41.201/32",
136+
"34.202.145.72/32",
137+
"52.205.239.95/32",
138+
"54.236.208.68/32",
139+
"3.234.64.191/32",
140+
"34.195.159.252/32",
141+
"34.228.34.122/32",
142+
"54.205.89.242/32",
143+
"209.132.0.0/16",
144+
"66.187.0.0/16",
145+
"2620:0052:0004:0000:0000:0000:0000:0000/48"
146+
]
147+
},
148+
"Bool": {
149+
"aws:ViaAWSService": "false"
150+
}
151+
}
152+
}
153+
]
154+
}
155+
----
156+
+
157+
[NOTE]
158+
====
159+
This list is subject to change. Additionally, you must specify the IP addresses in CIDR notation.
160+
====
161+
+
162+
. Click *Review and create*.
163+
. Provide a name and description for the policy, and review the details for accuracy.
164+
. Click *Create policy* to save the policy.
165+
166+
[NOTE]
167+
====
168+
The condition key `aws:ViaAWSService` must be set to false to enable subsequent calls to succeed based on the initial call. For example, if you make an initial call to `aws ec2 describe-instances`, all subsequent calls made within the AWS API server to retrieve information about the EBS volumes attached to the ec2 instance will fail if the condition key `aws:ViaAWSService` is not set to false. The subsequent calls would fail because they would originate from AWS IP addresses, which are not included in the AllowList.
169+
====

‎security/rosa-adding-additional-constraints-for-ip-based-aws-role-assumption.adoc

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
:_content-type: ASSEMBLY
2+
[id="rosa-adding-additional-constraints-for-ip-based-aws-role-assumption_{context}"]
3+
include::_attributes/attributes-openshift-dedicated.adoc[]
4+
include::_attributes/common-attributes.adoc[]
5+
= Adding additional constraints for IP-based AWS role assumption
6+
7+
:context: rosa-adding-additional-constraints-for-ip-based-aws-role-assumption
8+
9+
toc::[]
10+
11+
You can implement an additional layer of security in your AWS account to prevent role assumption from non-allowlisted IP addresses.
12+
13+
include::modules/rosa-create-an-identity-based-policy.adoc[leveloffset=+1]
14+
include::modules/rosa-attaching-the-policy.adoc[leveloffset=+1]
15+
16+
17+
[role="_additional-resources"]
18+
== Additional resources
19+
20+
* For more information about denying access based on the source IP, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.html[AWS: Denies access to AWS based on the source IP] in the AWS documentation.

0 commit comments

Comments
 (0)