Skip to content

Commit c26c6d9

Browse files
cmilesbcmilesb
authored
Merge pull request #1546 from redis/AdarBahar-patch-2
Update aws-console.md
2 parents bee6235 + 310f97f commit c26c6d9

File tree

6 files changed

+97
-49
lines changed

6 files changed

+97
-49
lines changed

‎content/operate/rc/subscriptions/bring-your-own-cloud/cloud-account-settings.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ categories:
88
description: null
99
hideListLinks: true
1010
weight: 2
11+
aliases:
12+
- /operate/rc/how-to/view-edit-cloud-account/cloud-account-settings
13+
- /operate/rc/cloud-accounts/cloud-account-settings
14+
- /operate/rc/cloud-integrations/aws-cloud-accounts/cloud-account-settings
1115
---
1216

1317
Redis Cloud Bring your own Cloud (BYOC) lets you use your own cloud infrastructure to deploy Redis Cloud.

‎content/operate/rc/subscriptions/bring-your-own-cloud/iam-resources/_index.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ description: null
88
hideListLinks: true
99
linkTitle: Create IAM resources
1010
weight: 1
11+
aliases:
12+
- /operate/rc/how-to/view-edit-cloud-account/iam-resources
13+
- /operate/rc/cloud-accounts/iam-resources
14+
- /operate/rc/cloud-integrations/aws-cloud-accounts/iam-resources
1115
---
1216
For Redis Cloud Bring your Own Cloud (BYOC) on Amazon Web Services (AWS), we manage the supporting infrastructure for you in dedicated AWS accounts.
1317

‎content/operate/rc/subscriptions/bring-your-own-cloud/iam-resources/aws-console.md‎

Lines changed: 77 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ categories:
77
- operate
88
- rc
99
weight: $weight
10+
aliases:
11+
- /operate/rc/how-to/view-edit-cloud-account/iam-resources/aws-console
12+
- /operate/rc/cloud-accounts/iam-resources/aws-console
13+
- /operate/rc/cloud-integrations/aws-cloud-accounts/iam-resources/aws-console
1014
---
1115
Follow these steps to manually create IAM resources using the [AWS console](https://console.aws.amazon.com/).
1216

@@ -26,7 +30,7 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
2630

2731
{{< expand "View RedisLabsInstanceRolePolicy.json" >}}
2832
```js
29-
{
33+
{
3034
"Version": "2012-10-17",
3135
"Statement": [
3236
{
@@ -84,19 +88,19 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
8488
]
8589
},
8690
{
87-
"Sid": "TagResourcesDelete",
88-
"Effect": "Allow",
89-
"Action": [
91+
"Sid": "TagResourcesDelete",
92+
"Effect": "Allow",
93+
"Action": [
9094
"ec2:DeleteTags"
91-
],
92-
"Resource": [
95+
],
96+
"Resource": [
9397
"*"
94-
],
95-
"Condition": {
96-
"StringEquals": {
97-
"ec2:ResourceTag/RedisLabsIdentifier": "Redislabs-VPC"
98-
}
99-
}
98+
],
99+
"Condition": {
100+
"StringEquals": {
101+
"ec2:ResourceTag/RedisLabsIdentifier": "Redislabs-VPC"
102+
}
103+
}
100104
}
101105
]
102106
}
@@ -152,7 +156,11 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
152156
"ec2:DescribeInternetGateways",
153157
"ec2:DescribeImages",
154158
"ec2:DescribeTransitGatewayVpcAttachments",
155-
"ec2:DescribeVpcPeeringConnections"
159+
"ec2:DescribeVpcPeeringConnections",
160+
"ec2:DescribeKeyPairs",
161+
"ec2:DescribeTransitGateways",
162+
"ec2:DescribeInstanceStatus",
163+
"ec2:DescribeNetworkAcls"
156164
],
157165
"Resource": "*"
158166
},
@@ -164,12 +172,7 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
164172
"cloudwatch:Get*",
165173
"cloudwatch:List*"
166174
],
167-
"Resource": "*",
168-
"Condition": {
169-
"StringEquals": {
170-
"ec2:ResourceTag/RedisLabsIdentifier": "Redislabs-VPC"
171-
}
172-
}
175+
"Resource": "*"
173176
},
174177
{
175178
"Sid": "IamUserOperations",
@@ -182,27 +185,26 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
182185
"Resource": "arn:aws:iam::*:user/${aws:username}"
183186
},
184187
{
185-
"Sid": "PassRlClusterNodeRole",
186-
"Effect": "Allow",
187-
"Action": "iam:PassRole",
188-
"Resource": "arn:aws:iam::*:role/redislabs-cluster-node-role"
189-
},
190-
{
191-
"Sid": "IAMRoleReadAccess",
192-
"Effect": "Allow",
188+
"Sid": "RolePolicyUserReadActions",
193189
"Action": [
194190
"iam:GetRole",
195191
"iam:GetPolicy",
192+
"iam:ListUsers",
193+
"iam:ListPolicies",
196194
"iam:ListRolePolicies",
197195
"iam:ListAttachedRolePolicies",
198196
"iam:ListInstanceProfiles",
199197
"iam:ListInstanceProfilesForRole",
200198
"iam:SimulatePrincipalPolicy"
201199
],
202-
"Resource": [
203-
"arn:aws:iam::*:role/Redislabs-*",
204-
"arn:aws:iam::*:policy/Redislabs-*"
205-
]
200+
"Effect": "Allow",
201+
"Resource": "*"
202+
},
203+
{
204+
"Sid": "PassRlClusterNodeRole",
205+
"Effect": "Allow",
206+
"Action": "iam:PassRole",
207+
"Resource": "arn:aws:iam::*:role/redislabs-cluster-node-role"
206208
},
207209
{
208210
"Sid": "CreateEc2ResourcesWithoutTag",
@@ -216,7 +218,13 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
216218
"ec2:CreateSecurityGroup",
217219
"ec2:CreateInternetGateway",
218220
"ec2:CreateRouteTable",
219-
"ec2:CreateSubnet"
221+
"ec2:CreateSubnet",
222+
"ec2:CreateSnapshot",
223+
"ec2:CreateTransitGateway",
224+
"ec2:AssociateVpcCidrBlock",
225+
"ec2:CreateTransitGatewayVpcAttachment",
226+
"ec2:AttachInternetGateway",
227+
"ec2:ReplaceRoute"
220228
],
221229
"Resource": "*"
222230
},
@@ -238,19 +246,6 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
238246
}
239247
}
240248
},
241-
{
242-
"Sid": "DenyCreateVpcWithoutRequiredTag",
243-
"Effect": "Deny",
244-
"Action": [
245-
"ec2:CreateVpc"
246-
],
247-
"Resource": "*",
248-
"Condition": {
249-
"Null": {
250-
"aws:RequestTag/RedisLabsIdentifier": "true"
251-
}
252-
}
253-
},
254249
{
255250
"Sid": "AllowVpcPeeringManagement",
256251
"Effect": "Allow",
@@ -278,9 +273,6 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
278273
"Effect": "Allow",
279274
"Action": [
280275
"ec2:CreateVolume",
281-
"ec2:CreateSnapshot",
282-
"ec2:ImportKeyPair",
283-
"ec2:AttachInternetGateway",
284276
"ec2:CreateRoute",
285277
"ec2:AuthorizeSecurityGroupIngress",
286278
"ec2:AuthorizeSecurityGroupEgress"
@@ -325,7 +317,6 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
325317
"ec2:DeleteSecurityGroup",
326318
"ec2:DeleteRouteTable",
327319
"ec2:DeleteRoute",
328-
"ec2:DetachInternetGateway",
329320
"ec2:DeleteInternetGateway",
330321
"ec2:DeleteVpc"
331322
],
@@ -336,6 +327,18 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
336327
}
337328
}
338329
},
330+
{
331+
"Sid": "DeleteEc2ResourcesWithoutTag",
332+
"Effect": "Allow",
333+
"Action": [
334+
"ec2:RevokeSecurityGroupIngress",
335+
"ec2:RejectVpcPeeringConnection",
336+
"ec2:DeleteTransitGatewayVpcAttachment",
337+
"ec2:DeleteTransitGateway",
338+
"ec2:DetachInternetGateway"
339+
],
340+
"Resource": "*"
341+
},
339342
{
340343
"Sid": "CreateAndChangeServiceLinkedRoleForTransitGateway",
341344
"Effect": "Allow",
@@ -348,12 +351,37 @@ Follow the steps to [create an IAM policy using the JSON editor](https://docs.aw
348351
}
349352
},
350353
{
354+
"Sid": "RolePolicyForTransitGateway",
351355
"Effect": "Allow",
352356
"Action": [
353357
"iam:AttachRolePolicy",
354358
"iam:PutRolePolicy"
355359
],
356360
"Resource": "arn:aws:iam::*:role/aws-service-role/transitgateway.amazonaws.com/AWSServiceRoleForVPCTransitGateway*"
361+
},
362+
{
363+
"Sid": "AllowEncryptedVolumeCreation",
364+
"Effect": "Allow",
365+
"Action": [
366+
"kms:GenerateDataKeyWithoutPlaintext",
367+
"kms:DescribeKey"
368+
],
369+
"Resource": "*"
370+
},
371+
{
372+
"Sid": "AllowAttachDetachOfEncryptedVolumes",
373+
"Effect": "Allow",
374+
"Action": [
375+
"kms:CreateGrant",
376+
"kms:ListGrants",
377+
"kms:RevokeGrant"
378+
],
379+
"Resource": "*",
380+
"Condition": {
381+
"Bool": {
382+
"kms:GrantIsForAWSResource": "true"
383+
}
384+
}
357385
}
358386
]
359387
}

‎content/operate/rc/subscriptions/bring-your-own-cloud/iam-resources/cloudformation.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ categories:
77
- operate
88
- rc
99
linkTitle: CloudFormation
10+
aliases:
11+
- /operate/rc/how-to/view-edit-cloud-account/iam-resources/cloudformation
12+
- /operate/rc/cloud-accounts/iam-resources/cloudformation
13+
- /operate/rc/cloud-integrations/aws-cloud-accounts/iam-resources/cloudformation
1014
---
1115
You can use [AWS CloudFormation](https://aws.amazon.com/cloudformation/) to create the IAM resources for Redis Cloud Bring your Own Cloud (BYOC).
1216

‎content/operate/rc/subscriptions/bring-your-own-cloud/iam-resources/terraform.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ categories:
77
- operate
88
- rc
99
linkTitle: Terraform
10+
aliases:
11+
- /operate/rc/how-to/view-edit-cloud-account/iam-resources/terraform
12+
- /operate/rc/cloud-accounts/iam-resources/terraform
13+
- /operate/rc/cloud-integrations/aws-cloud-accounts/iam-resources/terraform
1014
---
1115
You can use [HashiCorp Terraform](https://www.terraform.io/intro/index.html) to create identity and access management (IAM) resources to support AWS cloud account access to Redis Cloud subscriptions.
1216

‎content/operate/rc/subscriptions/bring-your-own-cloud/subscription-whitelist.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ description: The CIDR allow list permits traffic between a range of IP addresses
99
the Redis Cloud VPC.
1010
linkTitle: Subscription CIDR allow list
1111
weight: $weight
12+
aliases:
13+
- /operate/rc/how-to/view-edit-cloud-account/subscription-whitelist
14+
- /operate/rc/cloud-accounts/subscription-whitelist
15+
- /operate/rc/cloud-integrations/aws-cloud-accounts/subscription-whitelist
1216
---
1317

1418
The [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) [allow list](https://en.wikipedia.org/wiki/Whitelist) lets you restrict traffic to your Redis Cloud database. When you configure an allow list, only the [IP addresses](https://en.wikipedia.org/wiki/IP_address) defined in the list can connect to the database. Traffic from all other IP addresses is blocked.

0 commit comments

Comments
 (0)