Skip to content

Commit edb7bf5

Browse files
bmcelveebmcelvee
authored
Merge pull request #64909 from skopacz1/OSDOCS-7785
OSDOCS#7785: Migrate Verify permissions for ROSA STS deployment from MOBB to ROSA
2 parents 990e471 + 1dc0be6 commit edb7bf5

File tree

2 files changed

+114
-0
lines changed

2 files changed

+114
-0
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,8 @@ Topics:
8686
File: rosa-mobb-prerequisites-tutorial
8787
- Name: Configuring ROSA/OSD to use custom TLS ciphers on the ingress controllers
8888
File: rosa-mobb-configure-custom-tls-ciphers
89+
- Name: Verifying Permissions for a ROSA STS Deployment
90+
File: rosa-mobb-verify-permissions-sts-deployment
8991
---
9092
Name: Getting started
9193
Dir: rosa_getting_started

‎rosa_tutorials/rosa-mobb-verify-permissions-sts-deployment.adoc

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
:_content-type: ASSEMBLY
2+
[id="rosa-mobb-verify-permissions-sts-deployment"]
3+
= Tutorial: Verifying Permissions for a ROSA STS Deployment
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: rosa-mobb-verify-permissions-sts-deployment
6+
7+
toc::[]
8+
9+
// ---
10+
// date: '2022-10-04'
11+
// title: "Verify Permissions for ROSA STS Deployment"
12+
// authors:
13+
// - Tyler Stacey
14+
// - Kumudu Herath
15+
// tags: ["AWS", "ROSA", "STS"]
16+
// ---
17+
18+
To proceed with the deployment of a ROSA cluster, an account must support the required roles and permissions.
19+
AWS Service Control Policies (SCPs) cannot block the API calls made by the installer or operator roles.
20+
21+
Details about the IAM resources required for an STS-enabled installation of ROSA can be found here: xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-iam-resources[About IAM resources for ROSA clusters that use STS]
22+
23+
This guide is validated for ROSA v4.11.X.
24+
25+
== Prerequisites
26+
27+
* link:https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html[AWS CLI]
28+
* xref:../cli_reference/rosa_cli/rosa-get-started-cli.adoc#rosa-get-started-cli[ROSA CLI] v1.2.6
29+
* link:https://stedolan.github.io/jq/[jq CLI]
30+
* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html[AWS role with required permissions]
31+
32+
[id="verify-ROSA-permissions_{context}"]
33+
== Verifying ROSA permissions
34+
To verify the permissions required for ROSA, we can run the script included in the following section without ever creating any AWS resources.
35+
36+
The script uses the `rosa`, `aws`, and `jq` CLI commands to create files in the working directory that will be used to verify permissions in the account connected to the current AWS configuration.
37+
38+
The AWS Policy Simulator is used to verify the permissions of each role policy against the API calls extracted by `jq`; results are then stored in a text file appended with `.results`.
39+
40+
This script is designed to verify the permissions for the current account and region.
41+
42+
[id="usage-instructions_{context}"]
43+
== Usage Instructions
44+
45+
. To use the script, run the following commands in a `bash` terminal (the -p option defines a prefix for the roles):
46+
+
47+
[source,terminal]
48+
----
49+
$ mkdir scratch
50+
$ cd scratch
51+
$ cat << 'EOF' > verify-permissions.sh
52+
#!/bin/bash
53+
while getopts 'p:' OPTION; do
54+
case "$OPTION" in
55+
p)
56+
PREFIX="$OPTARG"
57+
;;
58+
?)
59+
echo "script usage: $(basename \$0) [-p PREFIX]" >&2
60+
exit 1
61+
;;
62+
esac
63+
done
64+
shift "$(($OPTIND -1))"
65+
rosa create account-roles --mode manual --prefix $PREFIX
66+
INSTALLER_POLICY=$(cat sts_installer_permission_policy.json | jq )
67+
CONTROL_PLANE_POLICY=$(cat sts_instance_controlplane_permission_policy.json | jq)
68+
WORKER_POLICY=$(cat sts_instance_worker_permission_policy.json | jq)
69+
SUPPORT_POLICY=$(cat sts_support_permission_policy.json | jq)
70+
simulatePolicy () {
71+
outputFile="${2}.results"
72+
echo $2
73+
aws iam simulate-custom-policy --policy-input-list "$1" --action-names $(jq '.Statement | map(select(.Effect == "Allow"))[].Action | if type == "string" then . else .[] end' "$2" -r) --output text > $outputFile
74+
}
75+
simulatePolicy "$INSTALLER_POLICY" "sts_installer_permission_policy.json"
76+
simulatePolicy "$CONTROL_PLANE_POLICY" "sts_instance_controlplane_permission_policy.json"
77+
simulatePolicy "$WORKER_POLICY" "sts_instance_worker_permission_policy.json"
78+
simulatePolicy "$SUPPORT_POLICY" "sts_support_permission_policy.json"
79+
EOF
80+
$ chmod +x verify-permissions.sh
81+
$ ./verify-permissions.sh -p SimPolTest
82+
----
83+
84+
. After the script completes, review each results file to ensure that none of the required API calls are blocked:
85+
+
86+
[source,terminal]
87+
----
88+
$ for file in $(ls *.results); do echo $file; cat $file; done
89+
----
90+
+
91+
The output will look similar to the following:
92+
+
93+
[source,terminal]
94+
----
95+
sts_installer_permission_policy.json.results
96+
EVALUATIONRESULTS autoscaling:DescribeAutoScalingGroups allowed *
97+
MATCHEDSTATEMENTS PolicyInputList.1 IAM Policy
98+
ENDPOSITION 6 195
99+
STARTPOSITION 17 3
100+
EVALUATIONRESULTS ec2:AllocateAddress allowed *
101+
MATCHEDSTATEMENTS PolicyInputList.1 IAM Policy
102+
ENDPOSITION 6 195
103+
STARTPOSITION 17 3
104+
EVALUATIONRESULTS ec2:AssociateAddress allowed *
105+
MATCHEDSTATEMENTS PolicyInputList.1 IAM Policy
106+
...
107+
----
108+
+
109+
[NOTE]
110+
====
111+
If any actions are blocked, review the error provided by AWS and consult with your Administrator to determine if SCPs are blocking the required API calls.
112+
====

0 commit comments

Comments
 (0)