Skip to content

Commit e876336

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #64578 from AedinC/OSDOCS#7678
 OSDOCS 7678: Included missing policy info and instructions for ROSA Shared VPC
2 parents e6bd5cb + 1b3f1a1 commit e876336

File tree

1 file changed

+84
-20
lines changed

1 file changed

+84
-20
lines changed

‎modules/rosa-sharing-vpc-creation-and-sharing.adoc

Lines changed: 84 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,35 +10,99 @@ You can share subnets within a configured VPC with another AWS user account if t
1010

1111
.Procedure
1212

13-
. From the AWS account that centrally manages your VPC, create or modify a VPC to your specifications in the link:https://us-east-1.console.aws.amazon.com/vpc/[VPC section of the AWS console]. This AWS account will be the *VPC-owning AWS account*.
14-
. In the link:https://us-east-1.console.aws.amazon.com/iamv2/[Identity and Access Management (IAM) section of the AWS console], create a custom trust policy role for the shared VPC permissions. This role needs to have the following permissions:
15-
* A trust policy to assume roles:
13+
. From the AWS account that centrally manages your VPC, create or modify a VPC to your specifications in the link:https://us-east-1.console.aws.amazon.com/vpc/[VPC section of the AWS console]. This AWS account will be the *VPC-owning AWS account*.
14+
+
15+
. Create a custom policy file to allow for necessary Shared VPC permissions that uses the name `SharedVPCPolicy`:
1616
+
1717
[source,terminal]
1818
----
19+
$ cat <<EOF > /tmp/shared-vpc-policy.json
1920
{
20-
"Version": "2012-10-17",
21-
"Statement": [
22-
{
23-
"Sid": "Statement1",
24-
"Effect": "Allow",
25-
"Principal": {
26-
"AWS": "arn:aws:iam::<Account-ID>:root"
27-
}, <1>
28-
"Action": "sts:AssumeRole"
29-
}
30-
]
21+
"Version": "2012-10-17",
22+
"Statement": [
23+
{
24+
"Effect": "Allow",
25+
"Action": [
26+
"route53:ChangeResourceRecordSets",
27+
"route53:ListHostedZones",
28+
"route53:ListHostedZonesByName",
29+
"route53:ListResourceRecordSets",
30+
"route53:ChangeTagsForResource",
31+
"route53:GetAccountLimit",
32+
"route53:GetChange",
33+
"route53:GetHostedZone",
34+
"route53:ListTagsForResource",
35+
"route53:UpdateHostedZoneComment",
36+
"tag:GetResources",
37+
"tag:UntagResources"
38+
],
39+
"Resource": "*"
40+
}
41+
]
3142
}
43+
EOF
44+
----
45+
+
46+
. Create the policy in AWS:
47+
+
48+
[source,terminal]
49+
----
50+
$ aws iam create-policy \
51+
--policy-name SharedVPCPolicy \
52+
--policy-document file:///tmp/shared-vpc-policy.json
53+
----
54+
+
55+
You will attach this policy to a role necessary for the shared VPC permissions.
56+
+
57+
. Create a custom trust policy file that grants permission to assume roles:
58+
+
59+
[source,terminal]
60+
----
61+
$ cat <<EOF > /tmp/shared-vpc-role.json
62+
{
63+
"Version": "2012-10-17",
64+
"Statement": [
65+
{
66+
"Effect": "Allow",
67+
"Principal": {
68+
"AWS": "arn:aws:iam::<Account-ID>:root" <1>
69+
},
70+
"Action": "sts:AssumeRole"
71+
}
72+
]
73+
}
74+
EOF
3275
----
3376
+
3477
--
35-
<1> The following principals are be added later in this process after the *cluster-creating AWS account* user has created these roles. On creation, you must create a root user placeholder by using the *cluster-creator's AWS Account* ID as `arn:aws:iam::{Account}:root`.
78+
<1> The principal will be scoped down later in this process after the *cluster-creating AWS account* user has created the necessary cluster roles. On creation, you must create a root user placeholder by using the *cluster-creator's AWS Account* ID as `arn:aws:iam::{Account}:root`.
79+
--
80+
+
81+
. Create the IAM role:
82+
+
83+
[source,terminal]
84+
----
85+
$ aws iam create-role --role-name <role_name> \ <1>
86+
--assume-role-policy-document file:///tmp/trust-policy.json
87+
----
88+
+
89+
--
90+
<1> Replace _<role_name>_ with the name of the role you want to create.
91+
--
92+
+
93+
. Attach the custom `SharedVPCPolicy` permissions policy:
94+
+
95+
[source, terminal]
96+
----
97+
$ aws iam attach-role-policy --role-name <role_name> --policy-arn \ <1>
98+
arn:aws:iam::<AWS_account_ID>:policy/SharedVPCPolicy <2>
99+
----
100+
+
101+
--
102+
<1> Replace _<role_name>_ with the name of the role you created.
103+
<2> Replace _<AWS_account_ID>_ with the *VPC-owning AWS account* ID.
36104
--
37-
* The `ResourceGroupandTagEditorFullAccess` permissions policy
38-
* The `Route53minimalPermissions` permissions policy
39105
+
40-
After you create this IAM role, provide the created role's ARN to the cluster creator.
41-
42106
. In the link:https://us-east-1.console.aws.amazon.com/ram/[Resource Access Manager of the AWS console], create a Resource Share that shares the previously created public and private subnets to the *cluster-creating AWS account* ID.
43107

44-
After you create the Resource Share, notify the *cluster-creating AWS account* user to reserve an `openshiftapps.com` DNS domain and create Operator roles to continue configuration.
108+
After you create the Resource Share, notify the *cluster-creating AWS account* user to reserve an `openshiftapps.com` DNS domain and create Operator roles to continue configuration.

0 commit comments

Comments
 (0)