Skip to content

Commit 92b8c61

Browse files
bmcelveebmcelvee
committed
OSDOCS-3371: Add roles and managed policy reference
1 parent 467a51a commit 92b8c61

File tree

6 files changed

+203
-3
lines changed

6 files changed

+203
-3
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -692,6 +692,8 @@ Topics:
692692
File: using-service-accounts-as-oauth-client
693693
- Name: Assuming an AWS IAM role for a service account
694694
File: assuming-an-aws-iam-role-for-a-service-account
695+
- Name: Roles and AWS managed policy reference
696+
File: rosa-aws-managed-policy-reference
695697
- Name: Scoping tokens
696698
File: tokens-scoping
697699
- Name: Using bound service account tokens

‎_topic_maps/_topic_map_rosa_hcp.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -527,6 +527,8 @@ Topics:
527527
File: using-service-accounts-as-oauth-client
528528
- Name: Assuming an AWS IAM role for a service account
529529
File: assuming-an-aws-iam-role-for-a-service-account
530+
- Name: Roles and AWS managed policy reference
531+
File: rosa-aws-managed-policy-reference
530532
- Name: Scoping tokens
531533
File: tokens-scoping
532534
- Name: Using bound service account tokens

‎authentication/rosa-aws-managed-policy-reference.adoc

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="rosa-aws-managed-policy-reference"]
3+
= AWS managed policies and roles reference guide
4+
include::_attributes/common-attributes.adoc[]
5+
:context: rosa-aws-managed-policy-reference
6+
7+
toc::[]
8+
9+
The roles and AWS managed policies used by {product-title} (ROSA) can be divided into account-wide roles and policies and Operator roles and policies.
10+
11+
The policies determine the allowed actions for each of the roles.
12+
ifdef::openshift-rosa[]
13+
See xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-iam-resources[About IAM resources] for more details about the individual roles and policies. See xref:../rosa_planning/rosa-sts-ocm-role.adoc#rosa-sts-ocm-role[ROSA IAM role resource] for more details about trust policies.
14+
endif::openshift-rosa[]
15+
ifdef::openshift-rosa-hcp[]
16+
See xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-iam-resources[About IAM resources] for more details about the individual roles and policies. See xref:../rosa_planning/rosa-hcp-prepare-iam-roles-resources.adoc#rosa-hcp-prepare-iam-roles-resources[Required IAM roles and resources] for more details on preparing these resources in your cluster.
17+
endif::openshift-rosa-hcp[]
18+
19+
[NOTE]
20+
====
21+
link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-awsmanpol.html[AWS managed policies] are created and administered by AWS. The permissions defined within the AWS managed policies cannot be changed. They are used as part of the AWS STS security process that you can use to assign permissions to users, groups, and roles.
22+
23+
If the permissions defined in an AWS managed policy are updated by AWS, the update will apply to all users, groups, and roles related to the policy.
24+
====
25+
26+
include::modules/rosa-roles-and-policies.adoc[leveloffset=+1]

‎modules/rosa-roles-and-policies.adoc

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * authentication/rosa-aws-managed-policy-reference.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="rosa-roles-and-policies_{context}"]
7+
= AWS managed policies and roles
8+
9+
ifdef::openshift-rosa-hcp[]
10+
[id="aws-managed-policies-hcp_{context}"]
11+
== AWS managed policies
12+
13+
.AWS managed account policies
14+
[options="header",cols="2*"]
15+
|===
16+
| Policy
17+
| Description
18+
19+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAManageSubscription.html[`ROSAManageSubscription`]
20+
| `ROSAManageSubscription` grants the AWS Marketplace permissions required for you to manage the ROSA subscription.
21+
22+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAWorkerInstancePolicy.html[ROSAWorkerInstancePolicy]
23+
| You must have the ROSA worker AWS Identity Access Management (IAM) role with `ROSAWorkerInstancePolicy` attached before creating a cluster.
24+
25+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSASRESupportPolicy.html[ROSASRESupportPolicy]
26+
| You must attach `ROSASRESupportPolicy` to a support IAM role before creating a cluster. `ROSASRESupportPolicy` grants required permissions to Red Hat site reliability engineers (SRE) to directly observe, diagnose, and support AWS resources associated with ROSA clusters, including the ability to change ROSA cluster node state.
27+
28+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAInstallerPolicy.html[ROSAInstallerPolicy]
29+
| You must attach `ROSAInstallerPolicy` to an IAM role named `<prefix>-ROSA-Worker-Role` before creating a cluster. `ROSAInstallerPolicy` allows the addition of any role that follows the `<prefix>-ROSA-Worker-Role` pattern to an instance profile. `ROSAInstallerPolicy` grants permissions to the installation program to manage AWS resources that support ROSA cluster installation.
30+
|===
31+
32+
[NOTE]
33+
====
34+
You must attach Operator policies to an Operator IAM role to allow a ROSA cluster to make calls to other AWS services.
35+
====
36+
37+
.AWS managed Operator policies
38+
[options="header",cols="2*"]
39+
|===
40+
| Policy
41+
| Description
42+
43+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAAmazonEBSCSIDriverOperatorPolicy.html[ROSAAmazonEBSCSIDriverOperatorPolicy]
44+
| `ROSAAmazonEBSCSIDriverOperatorPolicy` grants permissions to the Amazon EBS CSI Driver Operator to install and maintain the Amazon EBS CSI driver on a ROSA cluster.
45+
46+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAIngressOperatorPolicy.html[ROSAIngressOperatorPolicy]
47+
| `ROSAIngressOperatorPolicy` grants required permissions to the Ingress Operator to provision and manage load balancers and DNS configurations for ROSA clusters. The policy allows read access to tag values. The operator then filters the tag values for Route 53 resources to discover hosted zones.
48+
49+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAImageRegistryOperatorPolicy.html[ROSAImageRegistryOperatorPolicy]
50+
| `ROSAImageRegistryOperatorPolicy` grants permissions to the Image Registry Operator to provision and manage resources for the ROSA in-cluster image registry and dependent services, including S3, which allows the Operator to install and maintain the internal registry of a ROSA cluster.
51+
52+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSACloudNetworkConfigOperatorPolicy.html[ROSACloudNetworkConfigOperatorPolicy]
53+
| `ROSACloudNetworkConfigOperatorPolicy` grants permissions to the Cloud Network Config Controller Operator to provision and manage networking resources for the ROSA cluster networking overlay. The Operator uses these permissions to manage private IP addresses for Amazon EC2 instances as part of the ROSA cluster.
54+
55+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAKubeControllerPolicy.html[ROSAKubeControllerPolicy]
56+
| `ROSAKubeControllerPolicy` grants permissions to the kube controller to manage Amazon EC2, Elastic Load Balancing, and AWS Key Management Service (KMS) resources for a ROSA cluster.
57+
58+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSANodePoolManagementPolicy.html[ROSANodePoolManagementPolicy]
59+
| `ROSANodePoolManagementPolicy` grants permissions to the NodePool controller to describe, run, and terminate Amazon EC2 instances managed as worker nodes; and allows for disk encryption of the worker node root volume using AWS KMS keys.
60+
61+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAKMSProviderPolicy.html[ROSAKMSProviderPolicy]
62+
| `ROSAKMSProviderPolicy` grants permissions to the built-in AWS Encryption Provider to manage AWS KMS keys that support etcd data encryption. `ROSAKMSProviderPolicy` allows Amazon EC2 to use KMS keys that the AWS Encryption Provider provides to encrypt and decrypt etcd data.
63+
64+
| link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAControlPlaneOperatorPolicy.html[ROSAControlPlaneOperatorPolicy]
65+
| `ROSAControlPlaneOperatorPolicy` grants permissions to the Control Plane Operator to manage Amazon EC2 and Route 53 resources for ROSA clusters.
66+
67+
|===
68+
69+
[id="account-wide-roles-hcp_{context}"]
70+
== Account-wide roles
71+
* `<prefix>-HCP-ROSA-Worker-Role`
72+
* `<prefix>-HCP-ROSA-Support-Role`
73+
* `<prefix>-HCP-ROSA-Installer-Role`
74+
75+
[id="operator-roles-hcp_{context}"]
76+
== Operator roles
77+
78+
Certain policies are used by the cluster Operator roles, listed below. The Operator roles are created in a second step because they are dependent on an existing cluster name and cannot be created at the same time as the account-wide roles.
79+
80+
* `<operator_role_prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials`
81+
* `<operator_role_prefix>-openshift-cloud-network-config-controller-cloud-credentials`
82+
* `<operator_role_prefix>-openshift-machine-api-aws-cloud-credentials`
83+
* `<operator_role_prefix>-openshift-cloud-credential-operator-cloud-credentials`
84+
* `<operator_role_prefix>-openshift-image-registry-installer-cloud-credentials`
85+
* `<operator_role_prefix>-openshift-ingress-operator-cloud-credentials`
86+
87+
For the full `JSON` information for the AWS managed policies, see the link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/about-managed-policy-reference.html[AWS Managed Policy Reference guide].
88+
89+
endif::openshift-rosa-hcp[]
90+
91+
ifdef::openshift-rosa[]
92+
[id="aws-managed-policies_{context}"]
93+
== AWS managed policies
94+
95+
.AWS managed account policies
96+
[options="header",cols="2*"]
97+
|===
98+
| Policy
99+
| Description
100+
101+
| link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-account-policies.html#security-iam-id-based-policy-examples-rosa-classic-installer-policy[<prefix>-Installer-Role-Policy]
102+
| You must attach `<prefix>-Installer-Role-Policy` to an IAM role named `<prefix>-installer-role` before creating a ROSA cluster. `<prefix>-Installer-Role-Policy` grants permissions that allow the ROSA installer to manage the AWS resources that are needed for cluster creation.
103+
104+
| link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-account-policies.html#security-iam-id-based-policy-examples-rosa-classic-control-plane-policy[<prefix>-ControlPlane-Role-Policy]
105+
| You must attach `<prefix>-ControlPlane-Role-Policy` to an IAM role named `<prefix>-ControlPlane-Role` before creating a ROSA cluster. `<prefix>-ControlPlane-Role-Policy` grants permissions for ROSA to manage Amazon EC2 and Elastic Load Balancing resources that host the ROSA control plane, and to read KMS keys.
106+
107+
| link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-account-policies.html#security-iam-id-based-policy-examples-rosa-classic-worker-policy[<prefix>-Worker-Role-Policy]
108+
| You must attach `<prefix>-Worker-Role-Policy` to an IAM role named `<prefix>-Worker-Role`. `<prefix>-Worker-Role-Policy` grants permissions for ROSA to describe the EC2 instances running as worker nodes.
109+
110+
| link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-account-policies.html#security-iam-id-based-policy-examples-rosa-classic-support-policy[<prefix>-Support-Role-Policy]
111+
| You must attach `<prefix>-Support-Role-Policy` to an IAM role named `<prefix>-Support-Role`. `<prefix>-Support-Role-Policy` grants permissions to Red Hat site reliability engineers (SRE) to observe, diagnose, and support the AWS resources that ROSA classic clusters use, including the ability to change cluster node state.
112+
113+
|===
114+
115+
.AWS managed Operator policies
116+
[options="header",cols="2*"]
117+
|===
118+
| Policy
119+
| Description
120+
121+
| link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-operator-policies.html#security-iam-id-based-policy-examples-rosa-classic-ingress-operator-policy[<prefix>-openshift-ingress-operator-cloud-credentials]
122+
| `<prefix>-openshift-ingress-operator-cloud-credentials` grants permissions for the Ingress Operator to provision and manage load balancers and DNS configurations for external cluster access; and allows the Ingress Operator to read and filter Route 53 resource tag values to discover hosted zones.
123+
124+
| link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-operator-policies.html#security-iam-id-based-policy-examples-rosa-classic-csi-operator-policy[<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials]
125+
| `<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials` grants permissions for the Amazon EBS CSI Driver Operator to install and maintain the Amazon EBS CSI driver on a ROSA cluster.
126+
127+
| link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-operator-policies.html#security-iam-id-based-policy-examples-rosa-classic-machine-config-operator-policy[<prefix>-openshift-machine-api-aws-cloud-credentials]
128+
| `<prefix>-openshift-machine-api-aws-cloud-credentials` grants permissions for the Machine Config Operator to describe, run, and terminate Amazon EC2 instances managed as worker nodes; and allows for disk encryption of the worker node root volume using AWS KMS keys.
129+
130+
| link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-operator-policies.html#security-iam-id-based-policy-examples-rosa-classic-cloud-credential-operator-policy[<prefix>-openshift-cloud-credential-operator-cloud-credentials]
131+
| `<prefix>-openshift-cloud-credential-operator-cloud-credentials` grants permissions for the Cloud Credential Operator to retrieve IAM user details, including access key IDs, attached inline policy documents, user creation date, path, user ID, and Amazon Resource Name (ARN).
132+
133+
| link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-operator-policies.html#security-iam-id-based-policy-examples-rosa-classic-image-registry-operator-policy[<prefix>-openshift-image-registry-installer-cloud-credentials]
134+
| `<prefix>-openshift-image-registry-installer-cloud-credentials` grants permissions for the Image Registry Operator to provision and manage resources for the ROSA in-cluster image registry and dependent services, including Amazon S3. It is required so that the Operator can install and maintain the internal registry of a ROSA cluster.
135+
136+
| link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-operator-policies.html#security-iam-id-based-policy-examples-rosa-classic-cloud-network-config-controller-policy[<prefix>-openshift-cloud-network-config-controller-cloud-cr]
137+
| `<prefix>-openshift-cloud-network-config-controller-cloud-cr` grants required permissions for the Cloud Network Config Controller Operator to provision and manage networking resources for the ROSA cluster networking overlay. The Operator uses these permissions to manage private IP addresses for Amazon EC2 instances as part of the ROSA cluster.
138+
139+
|===
140+
141+
For the full `JSON` information for the following policies, see the link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-rosa-classic-account-policies.html#security-iam-id-based-policy-examples-rosa-classic-support-policy[AWS _ROSA classic account policies_ documentation].
142+
143+
[id="account-wide-roles_{context}"]
144+
== Account-wide roles
145+
146+
* `ManagedOpenShift-Installer-Role`
147+
* `ManagedOpenShift-ControlPlane-Role`
148+
* `ManagedOpenShift-Worker-Role`
149+
* `ManagedOpenShift-Support-Role`
150+
151+
152+
[id="operator-roles_{context}"]
153+
== Operator roles
154+
155+
Certain policies are used by the cluster Operator roles, listed below. The Operator roles are created in a second step because they are dependent on an existing cluster name and cannot be created at the same time as the account-wide roles.
156+
157+
* `<cluster-name\>-xxxx-openshift-cluster-csi-drivers-ebs-cloud-credent`
158+
* `<cluster-name\>-xxxx-openshift-cloud-network-config-controller-cloud`
159+
* `<cluster-name\>-xxxx-openshift-machine-api-aws-cloud-credentials`
160+
* `<cluster-name\>-xxxx-openshift-cloud-credential-operator-cloud-crede`
161+
* `<cluster-name\>-xxxx-openshift-image-registry-installer-cloud-creden`
162+
* `<cluster-name\>-xxxx-openshift-ingress-operator-cloud-credentials`
163+
endif::openshift-rosa[]
164+
165+
[NOTE]
166+
====
167+
Trust policies are created for each account-wide role and each Operator role.
168+
====

‎rosa_architecture/cloud-experts-rosa-hcp-sts-explained.adoc

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,6 @@ ifdef::openshift-rosa-hcp[]
5050
See xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-hcp-about-iam-resources[About IAM resources] for more details about the individual roles and policies. See xref:../rosa_planning/rosa-hcp-prepare-iam-roles-resources.adoc#rosa-hcp-prepare-iam-roles-resources[Required IAM roles and resources] for more details on preparing these resources in your cluster.
5151
endif::openshift-rosa-hcp[]
5252
+
53-
--
5453
** The following account-wide roles are required:
5554

5655
*** `<prefix>-HCP-ROSA-Worker-Role`
@@ -71,7 +70,6 @@ endif::openshift-rosa-hcp[]
7170
*** link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAKubeControllerPolicy.html[ROSAKubeControllerPolicy]
7271
*** link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAManageSubscription.html[ROSAManageSubscription]
7372
*** link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSANodePoolManagementPolicy.html[ROSANodePoolManagementPolicy]
74-
--
7573
+
7674
[NOTE]
7775
====

‎welcome/cloud-experts-rosa-hcp-sts-explained.adoc

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,18 @@ ifdef::openshift-rosa-hcp[]
5050
See xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-iam-resources[About IAM resources] for more details about the individual roles and policies. See xref:../rosa_planning/rosa-hcp-prepare-iam-roles-resources.adoc#rosa-hcp-prepare-iam-roles-resources[Required IAM roles and resources] for more details on preparing these resources in your cluster.
5151
endif::openshift-rosa-hcp[]
5252
+
53+
[NOTE]
54+
====
55+
See xref:../authentication/rosa-aws-managed-policy-reference.adoc#rosa-roles-and-policies_rosa-aws-managed-policy-reference[AWS managed policies and roles] for a comprehensive view of the AWS managed policies.
56+
====
5357
--
5458
** The account-wide roles are:
5559

5660
*** `<prefix>-HCP-ROSA-Worker-Role`
5761
*** `<prefix>-HCP-ROSA-Support-Role`
5862
*** `<prefix>-HCP-ROSA-Installer-Role`
5963

60-
** The account-wide AWS-managed policies are:
64+
** The account-wide AWS managed policies are:
6165

6266
*** link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAInstallerPolicy.html[ROSAInstallerPolicy]
6367
*** link:https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ROSAWorkerInstancePolicy.html[ROSAWorkerInstancePolicy]

0 commit comments

Comments
 (0)