Security and compliance

Procedure

1. Sign in to the AWS Management Console using your AWS account credentials.
2. Navigate to the IAM service.
3. In the IAM console, select Policies from the left navigation menu.
4. Click Create policy.
5. Select the JSON tab to define the policy using JSON format.

6. To get the IP addresses that you need to enter into the JSON policy document, run the following command:

   $ ocm get /api/clusters_mgmt/v1/trusted_ip_addresses

   Copy to Clipboard Toggle word wrap
   Note

   These IP addresses are not permanent and are subject to change. You must continuously review the API output and make the necessary updates in the JSON policy document.

7. Copy and paste the following policy_document.json file into the editor:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Deny",
               "Action": "*",
               "Resource": "*",
               "Condition": {
                   "NotIpAddress": {
                       "aws:SourceIp": []
                   },
                   "Bool": {
                       "aws:ViaAWSService": "false"
                   }
               }
           }
       ]
   }

   Copy to Clipboard Toggle word wrap
8. Copy and paste all of the IP addresses, which you got in Step 6, into the "aws:SourceIp": [] array in your policy_document.json file.
9. Click Review and create.
10. Provide a name and description for the policy, and review the details for accuracy.
11. Click Create policy to save the policy.

Procedure

1. Navigate to the IAM console in the AWS Management Console.

2. Select the default IAM ManagedOpenShift-Support-Role role to which you want to attach the policy.

   Note

   You can change the default IAM ManagedOpenShift-Support-Role role. For more information about roles, see Red Hat support access.

3. In the Permissions tab, select Add Permissions or Create inline policy from the Add Permissions drop-down list.

4. Search for the policy you created earlier by:

   1. Entering the policy name.
   2. Filtering by the appropriate category.
5. Select the policy and click Attach policy.

Procedure

1. To enable the log forwarder delivery capability, prepare the IAM policy by creating an assume-role-policy.json file. Apply the following IAM policy sample:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::859037107838:role/ROSA-CentralLogDistributionRole-241c1a86"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }

   Copy to Clipboard Toggle word wrap

2. To enable the log forwarder distribution capability, create an IAM role that must include the CustomerLogDistribution name by running the following command:

   $ aws iam create-role \
       --role-name CustomerLogDistribution-RH \
       --assume-role-policy-document file://assume-role-policy.json

   Copy to Clipboard Toggle word wrap

Procedure

1. Create the CloudWatch log group by running the following command:

   $ aws logs create-log-group –log-group-name <your_log_group_name>

   Copy to Clipboard Toggle word wrap

2. In your Red Hat OpenShift Service on AWS cluster, configure the log forwarder to use the CloudWatch log group by applying the following JSON sample:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "CreatePutLogs",
               "Effect": "Allow",
               "Action": [
                   "logs:CreateLogStream",
                   "logs:PutLogEvents"
               ],
               "Resource": "<your_log_group_arn>:*"
           },
           {
               "Sid": "DescribeLogs",
               "Effect": "Allow",
               "Action": [
                   "logs:DescribeLogGroups",
                   "logs:DescribeLogStreams"
               ],
               "Resource": "*"
           }
       ]
   }

   Copy to Clipboard Toggle word wrap

3. Attach the policy to the CloudWatch role by running the following command:

   $ aws iam put-role-policy \
       --role-name CustomerLogDistribution-RH \
       --policy-name Allow-CloudWatch-Writes \
       --policy-document file://cloudwatch-policy.json

   Copy to Clipboard Toggle word wrap

4. Configure your Red Hat OpenShift Service on AWS cluster to forward logs to the CloudWatch log group by applying the following sample YAML list:

   cloudwatch:
     cloudwatch_log_role_arn: "arn:aws:iam::123456789012:role/RosaCloudWatch"
     cloudwatch_log_group_name: "rosa-logs"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

   Copy to Clipboard Toggle word wrap

   <example_app1>

   Add one or more applications. For a list of applications, see the table in "Determining what log groups to use".

   <example_group1>

   Add one or more of the following groups: API, Authentication, Controller Manager, Scheduler, and Other.

5. Enable the log forwarder to send logs to your Red Hat OpenShift Service on AWS cluster.

   1. To enable control plane log forwarding on a new cluster, include the log forwarding configuration by running the following command:

      $ rosa create cluster --log-fwd-config="<path_to_file>.yaml"

      Copy to Clipboard Toggle word wrap

   2. To enable control plane log forwarding on an existing cluster, include the log forwarding configuration by running the following command:

      $ rosa create log-forwarder -c <cluster> --log-fwd-config="<path_to_file>.yaml"

      Copy to Clipboard Toggle word wrap

Procedure

1. Create the S3 bucket by running the following command:

   $ aws s3api create-bucket \
       --bucket <your_s3_bucket_name> \
       --region <your_aws_region> \
       --create-bucket-configuration LocationConstraint=<cluster_aws_region>

   Copy to Clipboard Toggle word wrap

2. Configure the policy for the S3 bucket by applying the following S3 bucket policy sample:

    "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowCentralLogDistributionWrite",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::859037107838:role/ROSA-CentralLogDistributionRole-241c1a86"
               },
               "Action": "s3:PutObject",
               "Resource": "arn:aws:s3:::<your_s3_bucket_name>/*",
               "Condition": {
                   "StringEquals": {
                       "s3:x-amz-acl": "bucket-owner-full-control"
                   }
               }
           }
       ]
   }

   Copy to Clipboard Toggle word wrap

3. Attach the policy to the S3 role by running the following command:

   $ aws s3api put-bucket-policy \
       --bucket <your_s3_bucket_name> \
       --policy file://s3-bucket-policy.json

   Copy to Clipboard Toggle word wrap

4. Configure your Red Hat OpenShift Service on AWS cluster to forward logs to the S3 bucket by applying the following sample YAML list:

   s3:
     s3_config_bucket_name: "my-log-bucket"
     s3_config_bucket_prefix: "my-bucket-prefix"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

   Copy to Clipboard Toggle word wrap

   <example_app1>

   Add one or more applications. For a list of applications, see the table in "Determining what log groups to use".

   <example_group1>

   Add one or more of the following groups: API, Authentication, Controller Manager, Scheduler, and Other.

5. Enable the log forwarder to send logs to your Red Hat OpenShift Service on AWS cluster.

   1. To enable control plane log forwarding on a new cluster, include the log forwarding configuration by running the following command:

      $ rosa create cluster --log-fwd-config="<path_to_file>.yaml"

      Copy to Clipboard Toggle word wrap

   2. To enable control plane log forwarding on an existing cluster, include the log forwarding configuration by running the following command:

      $ rosa create log-forwarder -c <cluster> --log-fwd-config="<path_to_file>.yaml"

      Copy to Clipboard Toggle word wrap