Skip to content

Commit e48c02b

Browse files
mletaliemletalie
committed
ROSA CLI permissions
1 parent 55a9f2d commit e48c02b

File tree

6 files changed

+583
-0
lines changed

6 files changed

+583
-0
lines changed

‎_topic_maps/_topic_map_rosa.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -516,6 +516,9 @@ Topics:
516516
File: rosa-checking-acct-version-cli
517517
- Name: Checking logs with the ROSA CLI
518518
File: rosa-checking-logs-cli
519+
- Name: Least privilege permissions for ROSA CLI commands
520+
File: rosa-cli-permission-examples
521+
519522
---
520523
Name: Red Hat OpenShift Cluster Manager
521524
Dir: ocm

‎cli_reference/rosa_cli/rosa-cli-permission-examples.adoc‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
include::_attributes/attributes-openshift-dedicated.adoc[]
3+
[id="rosa-cli-permission-examples"]
4+
= Least privilege permissions for ROSA CLI commands
5+
:context: rosa-cli-permission-examples
6+
toc::[]
7+
8+
You can create roles with permissions that adhere to the principal of least privilege, in which the users assigned the roles have no other permissions assigned to them outside the scope of the specific action they need to perform. These policies contain only the minimum required permissions needed to perform specific actions by using the {product-title} (ROSA) command line interface (CLI).
9+
10+
[NOTE]
11+
====
12+
The examples listed cover several of the most common ROSA CLI commands.
13+
For more information regarding ROSA CLI commands, see xref:../../cli_reference/rosa_cli/rosa-manage-objects-cli.adoc#rosa-common-commands_rosa-managing-objects-cli[Common commands and arguments].
14+
====
15+
16+
For more information about configuring permissions, policies, and roles in the AWS console, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html[AWS Identity and Access Management] in the AWS documentation.
17+
18+
include::modules/rosa-cli-hcp-classic-examples.adoc[leveloffset=+1]
19+
include::modules/rosa-cli-hcp-examples.adoc[leveloffset=+1]
20+
include::modules/rosa-cli-classic-examples.adoc[leveloffset=+1]
21+
include::modules/rosa-cli-no-permissions-required.adoc[leveloffset=+1]
22+
[role="_additional-resources"]
23+
[id="additional-resources_min-permissions-required"]
24+
== Additional resources
25+
26+
* For more information about AWS roles, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html[IAM roles].
27+
* For more information about AWS policies and permissions, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html[Policies and permissions in IAM].

‎modules/rosa-cli-classic-examples.adoc‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_cli/rosa-cli-permission-examples.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="rosa-cli-classic-examples_{context}"]
7+
= Least privilege permissions for common ROSA Classic CLI commands
8+
9+
The following examples show the least privilege permissions needed for the most common ROSA CLI commands when building ROSA Classic clusters.
10+
11+
[id="rosa-min-permissions-required-classic_{context}"]
12+
== Create a cluster
13+
14+
Run the following command with the specified permissions to create a ROSA Classic cluster with least privilege permissions.
15+
16+
.Input
17+
[source,terminal]
18+
----
19+
$ rosa create cluster
20+
----
21+
.Minimum permissions
22+
[source,json]
23+
----
24+
25+
{
26+
"Version": "2012-10-17",
27+
"Statement": [
28+
{
29+
"Sid": "CreateCluster",
30+
"Effect": "Allow",
31+
"Action": [
32+
"iam:GetRole",
33+
"iam:ListRoleTags",
34+
"iam:ListRoles"
35+
],
36+
"Resource": "*"
37+
}
38+
]
39+
}
40+
41+
----
42+
43+
[id="rosa-create-account-operator-roles-classic_{context}"]
44+
== Create account roles and Operator roles
45+
46+
Run the following command with the specified permissions to create account and Operator roles in `auto' mode.
47+
48+
.Input
49+
[source,terminal]
50+
----
51+
$ rosa create account-roles --mode auto
52+
----
53+
.Minimum permissions
54+
[source,json]
55+
----
56+
57+
{
58+
"Version": "2012-10-17",
59+
"Statement": [
60+
{
61+
"Sid": "CreateAccountOperatorRoles",
62+
"Effect": "Allow",
63+
"Action": [
64+
"iam:GetRole",
65+
"iam:UpdateAssumeRolePolicy",
66+
"iam:ListRoleTags",
67+
"iam:GetPolicy",
68+
"iam:TagRole",
69+
"iam:ListRoles",
70+
"iam:CreateRole",
71+
"iam:AttachRolePolicy",
72+
"iam:TagPolicy",
73+
"iam:CreatePolicy",
74+
"iam:ListPolicyTags"
75+
],
76+
"Resource": "*"
77+
}
78+
]
79+
}
80+
81+
----

‎modules/rosa-cli-hcp-classic-examples.adoc‎

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_cli/rosa-cli-permission-examples.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="rosa-cli-hcp-classic-examples_{context}"]
7+
= Least privilege permissions for common ROSA CLI commands
8+
9+
The following required minimum permissions for the listed ROSA CLI commands are applicable for hosted control plane (HCP) and Classic clusters.
10+
11+
[id="rosa-create-OIDC-providers-hcp-classic_{context}"]
12+
== Create an OpenID Connect (OIDC) provider
13+
Run the following command with the specified permissions to create your OIDC provider by using `auto` mode.
14+
15+
.Input
16+
[source,terminal]
17+
----
18+
$ rosa create oidc-config --mode auto
19+
----
20+
.Minimum permissions
21+
[source,json]
22+
----
23+
{
24+
"Version": "2012-10-17",
25+
"Statement": [
26+
{
27+
"Sid": "CreateOidcConfig",
28+
"Effect": "Allow",
29+
"Action": [
30+
"iam:TagOpenIDConnectProvider",
31+
"iam:CreateOpenIDConnectProvider"
32+
],
33+
"Resource": "*"
34+
}
35+
]
36+
}
37+
----
38+
39+
[id="rosa-list-account-roles-hcp-classic_{context}"]
40+
== List your account roles
41+
Run the following command with the specified permissions to list your account roles.
42+
43+
.Input
44+
[source,terminal]
45+
----
46+
$ rosa list account-roles
47+
----
48+
.Minimum permissions
49+
[source,json]
50+
----
51+
{
52+
"Version": "2012-10-17",
53+
"Statement": [
54+
{
55+
"Sid": "ListAccountRoles",
56+
"Effect": "Allow",
57+
"Action": [
58+
"iam:ListRoleTags",
59+
"iam:ListRoles"
60+
],
61+
"Resource": "*"
62+
}
63+
]
64+
}
65+
----
66+
67+
[id="rosa-list-operator-roles-hcp-classic_{context}"]
68+
== List your Operator roles
69+
Run the following command with the specified permissions to list your Operator roles.
70+
71+
.Input
72+
[source,terminal]
73+
----
74+
$ rosa list operator-roles
75+
----
76+
.Minimum permissions
77+
[source,json]
78+
----
79+
{
80+
"Version": "2012-10-17",
81+
"Statement": [
82+
{
83+
"Sid": "ListOperatorRoles",
84+
"Effect": "Allow",
85+
"Action": [
86+
"iam:ListRoleTags",
87+
"iam:ListAttachedRolePolicies",
88+
"iam:ListRoles",
89+
"iam:ListPolicyTags"
90+
],
91+
"Resource": "*"
92+
}
93+
]
94+
}
95+
96+
----
97+
98+
[id="rosa-list-OIDC-providers-hcp-classic_{context}"]
99+
== List your OIDC providers
100+
101+
Run the following command with the specified permissions to list your OIDC providers.
102+
103+
.Input
104+
[source,terminal]
105+
----
106+
$ rosa list oidc-providers
107+
----
108+
.Minimum permissions
109+
[source,json]
110+
----
111+
{
112+
"Version": "2012-10-17",
113+
"Statement": [
114+
{
115+
"Sid": "ListOidcProviders",
116+
"Effect": "Allow",
117+
"Action": [
118+
"iam:ListOpenIDConnectProviders",
119+
"iam:ListOpenIDConnectProviderTags"
120+
],
121+
"Resource": "*"
122+
}
123+
]
124+
}
125+
----
126+
127+
[id="rosa-verify-quota-hcp-classic_{context}"]
128+
== Verify your quota
129+
130+
Run the following command with the specified permissions to verify your quota.
131+
132+
.Input
133+
[source,terminal]
134+
----
135+
$ rosa verify quota
136+
----
137+
.Minimum permissions
138+
[source,json]
139+
----
140+
{
141+
"Version": "2012-10-17",
142+
"Statement": [
143+
{
144+
"Sid": "VerifyQuota",
145+
"Effect": "Allow",
146+
"Action": [
147+
"elasticloadbalancing:DescribeAccountLimits",
148+
"servicequotas:ListServiceQuotas"
149+
],
150+
"Resource": "*"
151+
}
152+
]
153+
}
154+
155+
----
156+
157+
[id="rosa-delete-account-roles-hcp-classic_{context}"]
158+
== Delete your account roles
159+
160+
Run the following command with the specified permissions to delete the account roles in `auto` mode.
161+
162+
.Input
163+
[source,terminal]
164+
----
165+
$ rosa delete account-roles -–mode auto
166+
----
167+
.Minimum permissions
168+
[source,json]
169+
----
170+
{
171+
"Version": "2012-10-17",
172+
"Statement": [
173+
{
174+
"Sid": "DeleteAccountRoles",
175+
"Effect": "Allow",
176+
"Action": [
177+
"iam:GetRole",
178+
"iam:ListInstanceProfilesForRole",
179+
"iam:DetachRolePolicy",
180+
"iam:ListAttachedRolePolicies",
181+
"iam:ListRoles",
182+
"iam:DeleteRole",
183+
"iam:ListRolePolicies"
184+
],
185+
"Resource": "*"
186+
}
187+
]
188+
}
189+
190+
----
191+
192+
[id="rosa-delete-operator-roles-hcp-classic_{context}"]
193+
== Delete your Operator roles
194+
195+
Run the following command with the specified permissions to delete your Operator roles in `auto` mode.
196+
197+
.Input
198+
[source,terminal]
199+
----
200+
$ rosa delete operator-roles -–mode auto
201+
----
202+
.Minimum permissions
203+
[source,json]
204+
----
205+
206+
{
207+
"Version": "2012-10-17",
208+
"Statement": [
209+
{
210+
"Sid": "DeleteOperatorRoles",
211+
"Effect": "Allow",
212+
"Action": [
213+
"iam:GetRole",
214+
"iam:DetachRolePolicy",
215+
"iam:ListAttachedRolePolicies",
216+
"iam:ListRoles",
217+
"iam:DeleteRole"
218+
],
219+
"Resource": "*"
220+
}
221+
]
222+
}
223+
224+
----
225+
226+
[id="rosa-delete-oidc-config-hcp-classic_{context}"]
227+
== Delete your OIDC configuration
228+
229+
Run the following command with the specified permissions to delete your OIDC configuration by using `auto` mode.
230+
231+
.Input
232+
[source,terminal]
233+
----
234+
$ rosa delete oidc-config -–mode auto
235+
----
236+
.Minimum permissions
237+
[source,json]
238+
----
239+
240+
{
241+
"Version": "2012-10-17",
242+
"Statement": [
243+
{
244+
"Sid": "DeleteOidcConfig",
245+
"Effect": "Allow",
246+
"Action": [
247+
"iam:ListOpenIDConnectProviders",
248+
"iam:DeleteOpenIDConnectProvider"
249+
],
250+
"Resource": "*"
251+
}
252+
]
253+
}
254+
255+
----
256+

0 commit comments

Comments
 (0)