Skip to content

Commit ebd3797

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #73430 from mletalie/OSDOCS-3498
[OSDOCS-3498]ROSA STS docs: least-privilege user IAM for CLI user
2 parents 8d6fedb + aba4da4 commit ebd3797

File tree

6 files changed

+638
-0
lines changed

6 files changed

+638
-0
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -516,6 +516,9 @@ Topics:
516516
File: rosa-checking-acct-version-cli
517517
- Name: Checking logs with the ROSA CLI
518518
File: rosa-checking-logs-cli
519+
- Name: Least privilege permissions for ROSA CLI commands
520+
File: rosa-cli-permission-examples
521+
519522
---
520523
Name: Red Hat OpenShift Cluster Manager
521524
Dir: ocm

‎cli_reference/rosa_cli/rosa-cli-permission-examples.adoc

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
include::_attributes/attributes-openshift-dedicated.adoc[]
3+
[id="rosa-cli-permission-examples"]
4+
= Least privilege permissions for ROSA CLI commands
5+
:context: rosa-cli-permission-examples
6+
toc::[]
7+
8+
You can create roles with permissions that adhere to the principal of least privilege, in which the users assigned the roles have no other permissions assigned to them outside the scope of the specific action they need to perform. These policies contain only the minimum required permissions needed to perform specific actions by using the {product-title} (ROSA) command line interface (CLI).
9+
10+
[IMPORTANT]
11+
====
12+
Although the policies and commands presented in this topic will work in conjunction with one another, you might have other restrictions within your AWS environment that make the policies for these commands insufficient for your specific needs. Red Hat provides these examples as a baseline, assuming no other AWS Identity and Access Management (IAM) restrictions are present.
13+
====
14+
15+
[NOTE]
16+
====
17+
The examples listed cover several of the most common ROSA CLI commands. For more information regarding ROSA CLI commands, see xref:../../cli_reference/rosa_cli/rosa-manage-objects-cli.adoc#rosa-common-commands_rosa-managing-objects-cli[Common commands and arguments].
18+
====
19+
20+
For more information about configuring permissions, policies, and roles in the AWS console, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html[AWS Identity and Access Management] in the AWS documentation.
21+
22+
include::modules/rosa-cli-hcp-classic-examples.adoc[leveloffset=+1]
23+
include::modules/rosa-cli-hcp-examples.adoc[leveloffset=+1]
24+
include::modules/rosa-cli-classic-examples.adoc[leveloffset=+1]
25+
include::modules/rosa-cli-no-permissions-required.adoc[leveloffset=+1]
26+
27+
[role="_additional-resources"]
28+
[id="additional-resources_min-permissions-required"]
29+
== Additional resources
30+
31+
* For more information about AWS roles, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html[IAM roles].
32+
* For more information about AWS policies and permissions, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html[Policies and permissions in IAM].

‎modules/rosa-cli-classic-examples.adoc

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_cli/rosa-cli-permission-examples.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="rosa-cli-classic-examples_{context}"]
7+
= Least privilege permissions for common ROSA Classic CLI commands
8+
9+
The following examples show the least privilege permissions needed for the most common ROSA CLI commands when building ROSA Classic clusters.
10+
11+
[id="rosa-min-permissions-required-classic_{context}"]
12+
== Create a cluster
13+
14+
Run the following command with the specified permissions to create a ROSA Classic cluster with least privilege permissions.
15+
16+
.Input
17+
[source,terminal]
18+
----
19+
$ rosa create cluster
20+
----
21+
.Policy
22+
[source,json]
23+
----
24+
25+
{
26+
"Version": "2012-10-17",
27+
"Statement": [
28+
{
29+
"Sid": "CreateCluster",
30+
"Effect": "Allow",
31+
"Action": [
32+
"iam:GetRole",
33+
"iam:ListRoleTags",
34+
"iam:ListRoles"
35+
],
36+
"Resource": "*"
37+
}
38+
]
39+
}
40+
41+
----
42+
43+
[id="rosa-create-account-operator-roles-classic_{context}"]
44+
== Create account roles and Operator roles
45+
46+
Run the following command with the specified permissions to create account and Operator roles in `auto' mode.
47+
48+
.Input
49+
[source,terminal]
50+
----
51+
$ rosa create account-roles --mode auto --classic
52+
----
53+
.Policy
54+
[source,json]
55+
----
56+
57+
{
58+
"Version": "2012-10-17",
59+
"Statement": [
60+
{
61+
"Sid": "CreateAccountOperatorRoles",
62+
"Effect": "Allow",
63+
"Action": [
64+
"iam:GetRole",
65+
"iam:UpdateAssumeRolePolicy",
66+
"iam:ListRoleTags",
67+
"iam:GetPolicy",
68+
"iam:TagRole",
69+
"iam:ListRoles",
70+
"iam:CreateRole",
71+
"iam:AttachRolePolicy",
72+
"iam:TagPolicy",
73+
"iam:CreatePolicy",
74+
"iam:ListPolicyTags"
75+
],
76+
"Resource": "*"
77+
}
78+
]
79+
}
80+
81+
----
82+
[id="rosa-delete-account-roles-classic_{context}"]
83+
== Delete your account roles
84+
85+
Run the following command with the specified permissions to delete the account roles in `auto` mode.
86+
87+
.Input
88+
[source,terminal]
89+
----
90+
$ rosa delete account-roles -–mode auto
91+
----
92+
.Policy
93+
[source,json]
94+
----
95+
{
96+
"Version": "2012-10-17",
97+
"Statement": [
98+
{
99+
"Sid": "VisualEditor0",
100+
"Effect": "Allow",
101+
"Action": [
102+
"iam:GetRole",
103+
"iam:ListInstanceProfilesForRole",
104+
"iam:DetachRolePolicy",
105+
"iam:ListAttachedRolePolicies",
106+
"iam:ListRoles",
107+
"iam:DeleteRole",
108+
"iam:ListRolePolicies",
109+
"iam:GetPolicy",
110+
"iam:ListPolicyVersions",
111+
"iam:DeletePolicy"
112+
],
113+
"Resource": "*"
114+
}
115+
]
116+
}
117+
----
118+
119+
[id="rosa-delete-operator-roles-classic_{context}"]
120+
== Delete your Operator roles
121+
122+
Run the following command with the specified permissions to delete the Operator roles in `auto` mode.
123+
124+
.Input
125+
[source,terminal]
126+
----
127+
$ rosa delete operator-roles -–mode auto
128+
----
129+
.Policy
130+
[source,json]
131+
----
132+
{
133+
"Version": "2012-10-17",
134+
"Statement": [
135+
{
136+
"Sid": "VisualEditor0",
137+
"Effect": "Allow",
138+
"Action": [
139+
"iam:GetRole",
140+
"iam:ListInstanceProfilesForRole",
141+
"iam:DetachRolePolicy",
142+
"iam:ListAttachedRolePolicies",
143+
"iam:ListRoles",
144+
"iam:DeleteRole",
145+
"iam:ListRolePolicies",
146+
"iam:GetPolicy",
147+
"iam:ListPolicyVersions",
148+
"iam:DeletePolicy"
149+
],
150+
"Resource": "*"
151+
}
152+
]
153+
}
154+
155+
----

0 commit comments

Comments
 (0)