Skip to content

Commit b860826

Browse files
faermanjmjpytlak
faermanj
authored and
mjpytlak
committed
OSDOCS-4572: Added guidance on identifying min set of AWS permissions
1 parent fa1f38a commit b860826

File tree

5 files changed

+104
-8
lines changed

5 files changed

+104
-8
lines changed

‎installing/installing_aws/installing-aws-account.adoc

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,16 @@ include::modules/installation-aws-iam-user.adoc[leveloffset=+1]
2424

2525
* See xref:../../installing/installing_aws/manually-creating-iam.adoc#manually-creating-iam-aws[Manually creating IAM for AWS] for steps to set the Cloud Credential Operator (CCO) to manual mode prior to installation. Use this mode in environments where the cloud identity and access management (IAM) APIs are not reachable, or if you prefer not to store an administrator-level credential secret in the cluster `kube-system` project.
2626
27-
include::modules/installation-aws-permissions-iam-roles.adoc[leveloffset=+1]
27+
include::modules/installation-aws-iam-policies-about.adoc[leveloffset=+1]
28+
29+
include::modules/installation-aws-permissions-iam-roles.adoc[leveloffset=+2]
30+
include::modules/installation-aws-add-iam-roles.adoc[leveloffset=+2]
31+
32+
[role="_additional-resources"]
33+
.Additional resources
34+
* See xref:../../installing/installing_aws/installing-aws-customizations.adoc#installation-launching-installer_installing-aws-customizations[Deploying the cluster].
35+
36+
include::modules/installation-aws-access-analyzer.adoc[leveloffset=+2]
2837

2938
include::modules/installation-aws-marketplace.adoc[leveloffset=+1]
3039

‎modules/installation-aws-access-analyzer.adoc

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
:_content-type: PROCEDURE
2+
[id="create-custom-permissions-for-iam-instance-profiles_{context}"]
3+
= Using AWS IAM Analyzer to create policy templates
4+
5+
The minimal set of permissions that the control plane and compute instance profiles require depends on how the cluster is configured for its daily operation.
6+
7+
One way to determine which permissions the cluster instances require is to use the AWS Identity and Access Management Access Analyzer (IAM Access Analyzer) to create a policy template:
8+
9+
* A policy template contains the permissions the cluster has used over a specified period of time.
10+
* You can then use the template to create policies with fine-grained permissions.
11+
12+
.Procedure
13+
14+
The overall process could be:
15+
16+
. Ensure that CloudTrail is enabled. CloudTrail records all of the actions and events in your AWS account, including the API calls that are required to create a policy template. For more information, see the AWS documentation for https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-getting-started.html[working with CloudTrail].
17+
. Create an instance profile for control plane instances and an instance profile for compute instances. Be sure to assign each role a permissive policy, such as PowerUserAccess. For more information, see the AWS documentation for
18+
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html[creating instance profile roles].
19+
. Install the cluster in a development environment and configure it as required. Be sure to deploy all of applications the cluster will host in a production environment.
20+
. Test the cluster thoroughly. Testing the cluster ensures that all of the required API calls are logged.
21+
. Use the IAM Access Analyzer to create a policy template for each instance profile. For more information, see the AWS documentation for https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.html[generating policies based on the CloudTrail logs].
22+
. Create and add a fine-grained policy to each instance profile.
23+
. Remove the permissive policy from each instance profile.
24+
. Deploy a production cluster using the existing instance profiles with the new policies.
25+
26+
[NOTE]
27+
====
28+
You can add https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html[IAM Conditions] to your policy to make it more restrictive and compliant with your organization security requirements.
29+
====

‎modules/installation-aws-add-iam-roles.adoc

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_aws/installing-aws-account.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="specify-an-existing-iam-role_{context}"]
7+
= Specifying an existing IAM role
8+
9+
Instead of allowing the installation program to create IAM instance profiles with the default permissions, you can use the `install-config.yaml` file to specify an existing IAM role for control plane and compute instances.
10+
11+
.Prerequisites
12+
13+
* You have an existing `install-config.yaml` file.
14+
15+
.Procedure
16+
17+
. Update `compute.platform.aws.iamRole` with an existing role for the control plane machines.
18+
+
19+
.Sample `install-config.yaml` file with an IAM role for compute instances
20+
[source,yaml]
21+
----
22+
compute:
23+
- hyperthreading: Enabled
24+
name: worker
25+
platform:
26+
aws:
27+
iamRole: ExampleRole
28+
----
29+
. Update `controlPlane.platform.aws.iamRole` with an existing role for the compute machines.
30+
+
31+
.Sample `install-config.yaml` file with an IAM role for control plane instances
32+
[source,yaml]
33+
----
34+
controlPlane:
35+
hyperthreading: Enabled
36+
name: master
37+
platform:
38+
aws:
39+
iamRole: ExampleRole
40+
----
41+
. Save the file and reference it when installing the {product-title} cluster.

‎modules/installation-aws-iam-policies-about.adoc

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_aws/installing-aws-account.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="iam-policies-and-aws-authentication_{context}"]
7+
= IAM Policies and AWS authentication
8+
9+
By default, the installation program creates instance profiles for the bootstrap, control plane, and compute instances with the necessary permissions for the cluster to operate.
10+
11+
However, you can create your own IAM roles and specify them as part of the installation process. You might need to specify your own roles to deploy the cluster or to manage the cluster after installation. For example:
12+
13+
* Your organization's security policies require that you use a more restrictive set of permissions to install the cluster.
14+
* After the installation, the cluster is configured with an Operator that requires access to additional services.
15+
16+
If you choose to specify your own IAM roles, you can take the following steps:
17+
18+
* Begin with the default policies and adapt as required. For more information, see "Default permissions for IAM instance profiles".
19+
* Use the AWS Identity and Access Management Access Analyzer (IAM Access Analyzer) to create a policy template that is based on the cluster's activity. For more information see, "Using AWS IAM Analyzer to create policy templates".

‎modules/installation-aws-permissions-iam-roles.adoc

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,15 @@
33
// * installing/installing_aws/installing-aws-account.adoc
44

55
[id="installation-aws-permissions-iam-roles_{context}"]
6-
= Required AWS permissions for IAM roles
6+
= Default permissions for IAM instance profiles
77

8-
You have the option of defining your own IAM roles that are applied to the instance profiles of your machines created by the installation program. You can specify existing IAM roles by defining the `controlPlane.platform.aws.iamRole` and `compute.platform.aws.iamRoleThis` fields in the `install-config.yaml` file. You can use these fields to match naming schemes and include predefined permissions boundaries for your IAM roles.
8+
By default, the installation program creates IAM instance profiles for the bootstrap, control plane and worker instances with the necessary permissions for the cluster to operate.
99

10-
The control plane and compute machines require the following IAM role permissions:
10+
The following lists specify the default permissions for control plane and compute machines:
1111

12-
.Required IAM role permissions for control plane instance profiles
12+
.Default IAM role permissions for control plane instance profiles
1313
[%collapsible]
1414
====
15-
* `sts:AssumeRole`
1615
* `ec2:AttachVolume`
1716
* `ec2:AuthorizeSecurityGroupIngress`
1817
* `ec2:CreateSecurityGroup`
@@ -53,10 +52,9 @@ The control plane and compute machines require the following IAM role permission
5352
* `kms:DescribeKey`
5453
====
5554

56-
.Required IAM role permissions for compute instance profiles
55+
.Default IAM role permissions for compute instance profiles
5756
[%collapsible]
5857
====
59-
* `sts:AssumeRole`
6058
* `ec2:DescribeInstances`
6159
* `ec2:DescribeRegions`
6260
====

0 commit comments

Comments
 (0)