Skip to content

Commit b52ab7e

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #55066 from EricPonvelle/OSDOCS-4813_Add-SCP-Info
OSDOCS-4813: Added the SCP requirements to AWS STS prerequisites
2 parents ff636ed + 734c22f commit b52ab7e

File tree

3 files changed

+43
-146
lines changed

3 files changed

+43
-146
lines changed

‎modules/rosa-aws-scp.adoc

Lines changed: 41 additions & 145 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,42 @@
11
// Module included in the following assemblies:
22
//
3-
// * rosa_getting_started/rosa-aws-prereqs.adoc
3+
// * rosa_architecture/rosa-sts-about-iam-resources.adoc
4+
//
5+
// * rosa_install_access_delete_clusters/rosa_getting_started_iam/rosa-aws-prereqs.adoc
6+
//
47

58
[id="rosa-minimum-scp_{context}"]
6-
== Minimum required service control policy (SCP)
9+
= Minimum required service control policy (SCP)
10+
11+
Service control policies (SCP) are a type of organization policy that manages permissions within your organization. SCPs ensure that accounts within your organization stay within your defined access control guidelines. These polices are maintained in the AWS Organizations and control the services that are available within the attached AWS accounts. SCP management is the responsibility of the customer.
12+
13+
ifeval::["{context}" == "rosa-sts-about-iam-resources"]
14+
:aws-sts:
15+
endif::[]
16+
17+
ifeval::["{context}" == "prerequisites"]
18+
:aws-non-sts:
19+
endif::[]
20+
21+
ifdef::aws-sts[]
22+
[NOTE]
23+
====
24+
When using AWS Security Token Service (STS), you must ensure that the service control policy does not block the following resources:
725
8-
Service control policy (SCP) management is the responsibility of the customer. These policies are maintained in the AWS Organizations and control what services are available within the attached AWS accounts.
26+
* `ec2:{}`
27+
* `iam:{}`
28+
* `tag:*`
29+
====
30+
endif::aws-sts[]
931

32+
ifdef::aws-non-sts[]
1033
[NOTE]
1134
====
1235
The minimum SCP requirement does not apply when using AWS security token service (STS). For more information about STS, see link:https://docs.openshift.com/rosa/rosa_getting_started_sts/rosa-sts-aws-prereqs.html[AWS prerequisites for ROSA with STS].
1336
====
37+
endif::aws-non-sts[]
38+
39+
Verify that your service control policy (SCP) does not restrict any of these required permissions.
1440

1541
[cols="2a,2a,2a,2a",options="header"]
1642

@@ -20,7 +46,7 @@ The minimum SCP requirement does not apply when using AWS security token service
2046
| Actions
2147
| Effect
2248

23-
.15+| Required
49+
.16+| Required
2450
|Amazon EC2 | All |Allow
2551
|Amazon EC2 Auto Scaling | All |Allow
2652
|Amazon S3| All |Allow
@@ -33,6 +59,12 @@ The minimum SCP requirement does not apply when using AWS security token service
3359
|AWS Support | All |Allow
3460
|AWS Key Management Service | All |Allow
3561
|AWS Security Token Service | All |Allow
62+
|AWS Marketplace | Subscribe
63+
64+
Unsubscribe
65+
66+
View Subscriptions
67+
| Allow
3668
|AWS Resource Tagging | All |Allow
3769
|AWS Route53 DNS | All |Allow
3870
|AWS Service Quotas | ListServices
@@ -47,9 +79,7 @@ ListServiceQuotas
4779
| Allow
4880

4981

50-
.3+|Optional
51-
52-
| AWS Billing
82+
.3+|Optional | AWS Billing
5383
| ViewAccount
5484

5585
Viewbilling
@@ -68,141 +98,7 @@ ViewUsage
6898

6999
|===
70100

71-
----
72-
{
73-
"Version": "2012-10-17",
74-
"Statement": [
75-
{
76-
"Effect": "Allow",
77-
"Action": [
78-
"ec2:*"
79-
],
80-
"Resource": [
81-
"*"
82-
]
83-
},
84-
{
85-
"Effect": "Allow",
86-
"Action": [
87-
"autoscaling:*"
88-
],
89-
"Resource": [
90-
"*"
91-
]
92-
},
93-
{
94-
"Effect": "Allow",
95-
"Action": [
96-
"s3:*"
97-
],
98-
"Resource": [
99-
"*"
100-
]
101-
},
102-
{
103-
"Effect": "Allow",
104-
"Action": [
105-
"iam:*"
106-
],
107-
"Resource": [
108-
"*"
109-
]
110-
},
111-
{
112-
"Effect": "Allow",
113-
"Action": [
114-
"elasticloadbalancing:*"
115-
],
116-
"Resource": [
117-
"*"
118-
]
119-
},
120-
{
121-
"Effect": "Allow",
122-
"Action": [
123-
"cloudwatch:*"
124-
],
125-
"Resource": [
126-
"*"
127-
]
128-
},
129-
{
130-
"Effect": "Allow",
131-
"Action": [
132-
"events:*"
133-
],
134-
"Resource": [
135-
"*"
136-
]
137-
},
138-
{
139-
"Effect": "Allow",
140-
"Action": [
141-
"logs:*"
142-
],
143-
"Resource": [
144-
"*"
145-
]
146-
},
147-
{
148-
"Effect": "Allow",
149-
"Action": [
150-
"support:*"
151-
],
152-
"Resource": [
153-
"*"
154-
]
155-
},
156-
{
157-
"Effect": "Allow",
158-
"Action": [
159-
"kms:*"
160-
],
161-
"Resource": [
162-
"*"
163-
]
164-
},
165-
{
166-
"Effect": "Allow",
167-
"Action": [
168-
"sts:*"
169-
],
170-
"Resource": [
171-
"*"
172-
]
173-
},
174-
{
175-
"Effect": "Allow",
176-
"Action": [
177-
"tag:*"
178-
],
179-
"Resource": [
180-
"*"
181-
]
182-
},
183-
{
184-
"Effect": "Allow",
185-
"Action": [
186-
"route53:*"
187-
],
188-
"Resource": [
189-
"*"
190-
]
191-
},
192-
{
193-
"Effect": "Allow",
194-
"Action": [
195-
"servicequotas:ListServices",
196-
"servicequotas:GetRequestedServiceQuotaChange",
197-
"servicequotas:GetServiceQuota",
198-
"servicequotas:RequestServiceQuotaIncrease",
199-
"servicequotas:ListServiceQuotas"
200-
],
201-
"Resource": [
202-
"*"
203-
]
204-
}
205-
]
206-
}
207-
208-
----
101+
[role="_additional-resources"]
102+
.Additional resources
103+
104+
* link:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html[Service control policies]

‎rosa_architecture/rosa-sts-about-iam-resources.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,4 @@ include::modules/rosa-sts-about-operator-role-prefixes.adoc[leveloffset=+2]
8787

8888
include::modules/rosa-sts-oidc-provider.adoc[leveloffset=+1]
8989
include::modules/rosa-sts-oidc-provider-command.adoc[leveloffset=+2]
90+
include::modules/rosa-aws-scp.adoc[leveloffset=+1]

‎rosa_install_access_delete_clusters/rosa_getting_started_iam/rosa-aws-prereqs.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ include::snippets/rosa-sts.adoc[]
1616
include::modules/rosa-aws-understand.adoc[leveloffset=+1]
1717
include::modules/rosa-aws-requirements.adoc[leveloffset=+1]
1818
include::modules/rosa-aws-procedure.adoc[leveloffset=+1]
19-
include::modules/rosa-aws-scp.adoc[leveloffset=+1]
19+
include::modules/rosa-aws-scp.adoc[leveloffset=+2]
2020
include::modules/rosa-aws-iam.adoc[leveloffset=+1]
2121
include::modules/rosa-aws-provisioned.adoc[leveloffset=+1]
2222
include::modules/osd-aws-privatelink-firewall-prerequisites.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)