Skip to content

Commit 8856a3e

Browse files
jneczyporjneczypor
committed
SME edits openshift#1 
1 parent 4c3c802 commit 8856a3e

File tree

4 files changed

+231
-72
lines changed

4 files changed

+231
-72
lines changed

‎modules/rosa-hcp-sharing-vpc-creation-and-sharing.adoc‎

Lines changed: 222 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -14,44 +14,72 @@ image::522-shared-vpc-step-1.png[]
1414
. Create or modify a VPC to your specifications in the link:https://us-east-1.console.aws.amazon.com/vpc/[VPC section of the AWS console].
1515
+
1616
. Create the `Route 53 role`.
17-
.. Create a custom policy file to allow for necessary shared VPC permissions that uses the name `SharedVPCPolicy`:
17+
+
18+
[NOTE]
19+
====
20+
You must create the `Route 53 role` in the same account as the hosted zones (which are created in Step 3). For example, if you want to create the hosted zones in the centrally-managed VPC account, you must create the `Route 53 role` in the *VPC Owner* account. If you want to create the hosted zones in the workload account, you must create the `Route 53 role` in the *Cluster Creator* account.
21+
====
22+
+
23+
.. Create a custom policy file to allow for necessary shared VPC permissions that uses the name `Route53Policy`:
1824
+
1925
[source,terminal]
2026
----
21-
$ cat <<EOF > /tmp/shared-vpc-policy.json
27+
$ cat <<EOF > /tmp/route53-policy.json
2228
{
23-
"Version": "2012-10-17",
24-
"Statement": [
25-
{
26-
"Effect": "Allow",
27-
"Action": [
28-
"route53:ChangeResourceRecordSets",
29-
"route53:ListHostedZones",
30-
"route53:ListHostedZonesByName",
31-
"route53:ListResourceRecordSets",
32-
"route53:ChangeTagsForResource",
33-
"route53:GetAccountLimit",
34-
"route53:GetChange",
35-
"route53:GetHostedZone",
36-
"route53:ListTagsForResource",
37-
"route53:UpdateHostedZoneComment",
38-
"tag:GetResources",
39-
"tag:UntagResources"
40-
],
41-
"Resource": "*"
29+
"Version" : "2012-10-17",
30+
"Statement" : [
31+
{
32+
"Sid" : "ReadPermissions",
33+
"Effect" : "Allow",
34+
"Action" : [
35+
"elasticloadbalancing:DescribeLoadBalancers",
36+
"route53:GetHostedZone",
37+
"route53:ListResourceRecordSets",
38+
"route53:ListHostedZones",
39+
"tag:GetResources"
40+
],
41+
"Resource" : "*"
42+
},
43+
{
44+
"Sid" : "ChangeResourceRecordSetsRestrictedRecordNames",
45+
"Effect" : "Allow",
46+
"Action" : [
47+
"route53:ChangeResourceRecordSets"
48+
],
49+
"Resource" : [
50+
"*"
51+
],
52+
"Condition" : {
53+
"ForAllValues:StringLike" : {
54+
"route53:ChangeResourceRecordSetsNormalizedRecordNames" : [
55+
"*.hypershift.local",
56+
"*.openshiftapps.com",
57+
"*.devshift.org",
58+
"*.openshiftusgov.com",
59+
"*.devshiftusgov.com"
60+
]
4261
}
43-
]
62+
}
63+
},
64+
{
65+
"Sid" : "ChangeTagsForResourceNoCondition",
66+
"Effect" : "Allow",
67+
"Action" : [
68+
"route53:ChangeTagsForResource"
69+
],
70+
"Resource" : "*"
71+
}
72+
]
4473
}
45-
EOF
4674
----
4775
+
4876
.. Create the policy in AWS:
4977
+
5078
[source,terminal]
5179
----
5280
$ aws iam create-policy \
53-
--policy-name SharedVPCPolicy \
54-
--policy-document file:///tmp/shared-vpc-policy.json
81+
--policy-name Route53Policy \
82+
--policy-document file:///tmp/route53-policy.json
5583
----
5684
+
5785
You will attach this policy to a role necessary for the shared VPC permissions.
@@ -60,7 +88,7 @@ You will attach this policy to a role necessary for the shared VPC permissions.
6088
+
6189
[source,terminal]
6290
----
63-
$ cat <<EOF > /tmp/shared-vpc-role.json
91+
$ cat <<EOF > /tmp/route53-role.json
6492
{
6593
"Version": "2012-10-17",
6694
"Statement": [
@@ -85,19 +113,19 @@ EOF
85113
[source,terminal]
86114
----
87115
$ aws iam create-role --role-name <role_name> \ <1>
88-
--assume-role-policy-document file:///tmp/shared-vpc-role.json
116+
--assume-role-policy-document file:///tmp/route53-role.json
89117
----
90118
+
91119
--
92120
<1> Replace _<role_name>_ with the name of the role you want to create.
93121
--
94122
+
95-
.. Attach the custom `SharedVPCPolicy` permissions policy:
123+
.. Attach the custom `Route53Policy` permissions policy:
96124
+
97125
[source, terminal]
98126
----
99127
$ aws iam attach-role-policy --role-name <role_name> --policy-arn \ <1>
100-
arn:aws:iam::<AWS_account_ID>:policy/SharedVPCPolicy <2>
128+
arn:aws:iam::<AWS_account_ID>:policy/Route53Policy <2>
101129
----
102130
+
103131
--
@@ -106,48 +134,180 @@ $ aws iam attach-role-policy --role-name <role_name> --policy-arn \ <1>
106134
--
107135
+
108136
. Create the `VPC endpoint role`.
109-
.. Create a custom policy file to allow for necessary shared VPC permissions that uses the name `SharedVPCPolicy`:
137+
.. Create a custom policy file to allow for necessary shared VPC permissions that uses the name `VPCEPolicy`:
110138
+
111139
[source,terminal]
112140
----
113-
$ cat <<EOF > /tmp/shared-vpc-policy.json
141+
$ cat <<EOF > /tmp/vpce.json
114142
{
115-
"Version": "2012-10-17",
116-
"Statement": [
117-
{
118-
"Effect": "Allow",
119-
"Action": [
120-
"ec2:CreateVpcEndpoint",
121-
"ec2:DescribeVpcEndpoints",
122-
"ec2:ModifyVpcEndpoint",
123-
"ec2:DeleteVpcEndpoints",
124-
"ec2:CreateTags",
125-
"ec2:CreateSecurityGroup",
126-
"ec2:AuthorizeSecurityGroupIngress",
127-
"ec2:AuthorizeSecurityGroupEgress",
128-
"ec2:DeleteSecurityGroup",
129-
"ec2:RevokeSecurityGroupIngress",
130-
"ec2:RevokeSecurityGroupEgress",
131-
"ec2:DescribeSecurityGroups",
132-
"ec2:DescribeVpcs",
133-
"route53:ListHostedZones",
134-
"route53:ChangeResourceRecordSets",
135-
"route53:ListResourceRecordSets"
136-
],
137-
"Resource": "*"
143+
"Version" : "2012-10-17",
144+
"Statement" : [
145+
{
146+
"Sid" : "ReadPermissions",
147+
"Effect" : "Allow",
148+
"Action" : [
149+
"ec2:DescribeVpcEndpoints",
150+
"ec2:DescribeVpcs",
151+
"ec2:DescribeSecurityGroups"
152+
],
153+
"Resource" : "*"
154+
},
155+
{
156+
"Sid" : "CreateSecurityGroups",
157+
"Effect" : "Allow",
158+
"Action" : [
159+
"ec2:CreateSecurityGroup"
160+
],
161+
"Resource" : [
162+
"arn:aws:ec2:*:*:security-group*/*"
163+
],
164+
"Condition" : {
165+
"StringEquals" : {
166+
"aws:RequestTag/red-hat-managed" : "true"
138167
}
139-
]
168+
}
169+
},
170+
{
171+
"Sid" : "DeleteSecurityGroup",
172+
"Effect" : "Allow",
173+
"Action" : [
174+
"ec2:DeleteSecurityGroup"
175+
],
176+
"Resource" : [
177+
"arn:aws:ec2:*:*:security-group*/*"
178+
],
179+
"Condition" : {
180+
"StringEquals" : {
181+
"aws:ResourceTag/red-hat-managed" : "true"
182+
}
183+
}
184+
},
185+
{
186+
"Sid" : "SecurityGroupIngressEgress",
187+
"Effect" : "Allow",
188+
"Action" : [
189+
"ec2:AuthorizeSecurityGroupIngress",
190+
"ec2:AuthorizeSecurityGroupEgress",
191+
"ec2:RevokeSecurityGroupIngress",
192+
"ec2:RevokeSecurityGroupEgress"
193+
],
194+
"Resource" : [
195+
"arn:aws:ec2:*:*:security-group*/*"
196+
],
197+
"Condition" : {
198+
"StringEquals" : {
199+
"aws:ResourceTag/red-hat-managed" : "true"
200+
}
201+
}
202+
},
203+
{
204+
"Sid" : "CreateSecurityGroupsVPCNoCondition",
205+
"Effect" : "Allow",
206+
"Action" : [
207+
"ec2:CreateSecurityGroup"
208+
],
209+
"Resource" : [
210+
"arn:aws:ec2:*:*:vpc/*"
211+
]
212+
},
213+
{
214+
"Sid" : "VPCEndpointWithCondition",
215+
"Effect" : "Allow",
216+
"Action" : [
217+
"ec2:CreateVpcEndpoint"
218+
],
219+
"Resource" : [
220+
"arn:aws:ec2:*:*:vpc-endpoint/*"
221+
],
222+
"Condition" : {
223+
"StringEquals" : {
224+
"aws:RequestTag/red-hat-managed" : "true"
225+
}
226+
}
227+
},
228+
{
229+
"Sid" : "VPCEndpointResourceTagCondition",
230+
"Effect" : "Allow",
231+
"Action" : [
232+
"ec2:CreateVpcEndpoint"
233+
],
234+
"Resource" : [
235+
"arn:aws:ec2:*:*:security-group*/*"
236+
],
237+
"Condition" : {
238+
"StringEquals" : {
239+
"aws:ResourceTag/red-hat-managed" : "true"
240+
}
241+
}
242+
},
243+
{
244+
"Sid" : "VPCEndpointNoCondition",
245+
"Effect" : "Allow",
246+
"Action" : [
247+
"ec2:CreateVpcEndpoint"
248+
],
249+
"Resource" : [
250+
"arn:aws:ec2:*:*:vpc/*",
251+
"arn:aws:ec2:*:*:subnet/*",
252+
"arn:aws:ec2:*:*:route-table/*"
253+
]
254+
},
255+
{
256+
"Sid" : "ManageVPCEndpointWithCondition",
257+
"Effect" : "Allow",
258+
"Action" : [
259+
"ec2:ModifyVpcEndpoint",
260+
"ec2:DeleteVpcEndpoints"
261+
],
262+
"Resource" : [
263+
"arn:aws:ec2:*:*:vpc-endpoint/*"
264+
],
265+
"Condition" : {
266+
"StringEquals" : {
267+
"aws:ResourceTag/red-hat-managed" : "true"
268+
}
269+
}
270+
},
271+
{
272+
"Sid" : "ModifyVPCEndpoingNoCondition",
273+
"Effect" : "Allow",
274+
"Action" : [
275+
"ec2:ModifyVpcEndpoint"
276+
],
277+
"Resource" : [
278+
"arn:aws:ec2:*:*:subnet/*"
279+
]
280+
},
281+
{
282+
"Sid" : "CreateTagsRestrictedActions",
283+
"Effect" : "Allow",
284+
"Action" : [
285+
"ec2:CreateTags"
286+
],
287+
"Resource" : [
288+
"arn:aws:ec2:*:*:vpc-endpoint/*",
289+
"arn:aws:ec2:*:*:security-group/*"
290+
],
291+
"Condition" : {
292+
"StringEquals" : {
293+
"ec2:CreateAction" : [
294+
"CreateVpcEndpoint",
295+
"CreateSecurityGroup"
296+
]
297+
}
298+
}
299+
}
300+
]
140301
}
141-
EOF
142302
----
143303
+
144304
.. Create the policy in AWS:
145305
+
146306
[source,terminal]
147307
----
148308
$ aws iam create-policy \
149-
--policy-name SharedVPCPolicy \
150-
--policy-document file:///tmp/shared-vpc-policy.json
309+
--policy-name VPCEPolicy \
310+
--policy-document file:///tmp/vpce-role.json
151311
----
152312
+
153313
You will attach this policy to a role necessary for the shared VPC permissions.
@@ -156,7 +316,7 @@ You will attach this policy to a role necessary for the shared VPC permissions.
156316
+
157317
[source,terminal]
158318
----
159-
$ cat <<EOF > /tmp/shared-vpc-role.json
319+
$ cat <<EOF > /tmp/vpce-role.json
160320
{
161321
"Version": "2012-10-17",
162322
"Statement": [
@@ -181,19 +341,19 @@ EOF
181341
[source,terminal]
182342
----
183343
$ aws iam create-role --role-name <role_name> \ <1>
184-
--assume-role-policy-document file:///tmp/shared-vpc-role.json
344+
--assume-role-policy-document file:///tmp/vpce-role.json
185345
----
186346
+
187347
--
188348
<1> Replace _<role_name>_ with the name of the role you want to create.
189349
--
190350
+
191-
.. Attach the custom `SharedVPCPolicy` permissions policy:
351+
.. Attach the custom `VPCEPolicy` permissions policy:
192352
+
193353
[source, terminal]
194354
----
195355
$ aws iam attach-role-policy --role-name <role_name> --policy-arn \ <1>
196-
arn:aws:iam::<AWS_account_ID>:policy/SharedVPCPolicy <2>
356+
arn:aws:iam::<AWS_account_ID>:policy/VPCEPolicy <2>
197357
----
198358
+
199359
--

‎modules/rosa-hcp-sharing-vpc-dns-and-roles.adoc‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,5 +101,4 @@ The shared information resembles these examples:
101101
* ``my-rosa-cluster.14eo.p1.openshiftapps.com``
102102
* ``arn:aws:iam::111122223333:role/ManagedOpenShift-Installer-Role``
103103
* ``arn:aws:iam::111122223333:role/my-rosa-cluster-openshift-ingress-operator-cloud-credentials``
104-
* ``arn:aws:iam::962993289388:role/route53-scoped"
105-
*arn:aws:iam962993289388:role/vpc-endpoint-service"
104+
* ``arn:aws:iam::111122223333:role/my-rosa-cluster-control-plane-operator``

0 commit comments

Comments
 (0)