Security and compliance

Procedure

1. Sign in to the AWS Management Console using your AWS account credentials.
2. Navigate to the IAM service.
3. In the IAM console, select Policies from the left navigation menu.
4. Click Create policy.
5. Select the JSON tab to define the policy using JSON format.

6. To get the IP addresses required for the JSON policy document, run the following command:

   $ ocm get /api/clusters_mgmt/v1/trusted_ip_addresses

   Note

   These IP addresses are not permanent and can change. Regularly review the API output and update the JSON policy document.

7. Copy and paste the following policy_document.json file into the editor:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Deny",
               "Action": "*",
               "Resource": "*",
               "Condition": {
                   "NotIpAddress": {
                       "aws:SourceIp": []
                   },
                   "Bool": {
                       "aws:ViaAWSService": "false"
                   }
               }
           }
       ]
   }

8. Copy and paste all of the IP addresses, which you got in Step 6, into the "aws:SourceIp": [] array in your policy_document.json file.
9. Click Review and create.
10. Provide a name and description for the policy, and review the details for accuracy.

11. Click Create policy to save the policy.

    Note

    Set the aws:ViaAWSService condition key to false to ensure that subsequent calls succeed after your initial call. For example, if you do not set aws:ViaAWSService to false and run aws ec2 describe-instances, some follow-up calls can fail. It applies to subsequent calls that you make within the AWS API server to retrieve information about the Elastic Block Store (EBS) volumes attached to the EC2 instance. The subsequent calls fail because they originate from AWS IP addresses that are not included in the AllowList.

Procedure

1. Navigate to the IAM console in the AWS Management Console.

2. Select the default IAM ManagedOpenShift-Support-Role role to attach the policy.

   Note

   You can change the default IAM ManagedOpenShift-Support-Role role. For more information about roles, see Red Hat support access.

3. In the Permissions tab, select Add Permissions or Create inline policy from the Add Permissions drop-down list.

4. Search for the policy you created earlier by:

   1. Entering the policy name.
   2. Filtering by the appropriate category.

5. Select the policy and click Attach policy.

   Important

   To prevent IP-based role assumption, keep the allowlisted IPs up-to-date. Outdated IPs can block Red Hat site reliability engineering (SRE) from accessing your account and affect your Service Level Agreement (SLA).

Procedure

1. To enable the log forwarder delivery capability, prepare the IAM policy by creating an assume-role-policy.json file. Apply the following IAM policy sample:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::859037107838:role/ROSA-CentralLogDistributionRole-241c1a86"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }

2. To enable the log forwarder distribution capability, create an IAM role that must include the CustomerLogDistribution name by running the following command:

   $ aws iam create-role \
       --role-name CustomerLogDistribution-RH \
       --assume-role-policy-document file://assume-role-policy.json

Procedure

1. Create the CloudWatch log group by running the following command:

   $ aws logs create-log-group –log-group-name <your_log_group_name>

2. In your Red Hat OpenShift Service on AWS cluster, configure the log forwarder to use the CloudWatch log group by applying the following JSON sample:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "CreatePutLogs",
               "Effect": "Allow",
               "Action": [
                   "logs:CreateLogStream",
                   "logs:PutLogEvents"
               ],
               "Resource": "<your_log_group_arn>:*"
           },
           {
               "Sid": "DescribeLogs",
               "Effect": "Allow",
               "Action": [
                   "logs:DescribeLogGroups",
                   "logs:DescribeLogStreams"
               ],
               "Resource": "*"
           }
       ]
   }

3. Attach the policy to the CloudWatch role by running the following command:

   $ aws iam put-role-policy \
       --role-name CustomerLogDistribution-RH \
       --policy-name Allow-CloudWatch-Writes \
       --policy-document file://cloudwatch-policy.json

4. Configure your Red Hat OpenShift Service on AWS cluster to forward logs to the CloudWatch log group by applying the following sample YAML list. Specify an application, or group, or both:

   cloudwatch:
     cloudwatch_log_role_arn: "arn:aws:iam::123456789012:role/RosaCloudWatch"
     cloudwatch_log_group_name: "rosa-logs"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

   where:

   <example_app1>

   Add one or more applications. For a list of applications, see the table in "Determining what log groups to use".

   <example_group1>

   Add one or more of the following groups: api, authentication, controller manager, scheduler.

5. Enable the log forwarder to send logs to your Red Hat OpenShift Service on AWS cluster.

   1. To enable control plane log forwarding on a new cluster, include the log forwarding configuration by running the following command:

      $ rosa create cluster --log-fwd-config="<path_to_file>.yaml"

   2. To enable control plane log forwarding on an existing cluster, include the log forwarding configuration by running the following command:

      $ rosa create log-forwarder -c <cluster> --log-fwd-config="<path_to_file>.yaml" -o yaml

6. Optional: For an example for forwarding logs to the CloudWatch log group, apply the following sample YAML:

   cloudwatch:
     cloudwatch_log_role_arn: "cloudwatch-log-role-arn"
     cloudwatch_log_group_name: "cloudwatch-group-name"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

Procedure

1. Create the S3 bucket by running the following command:

   $ aws s3api create-bucket \
       --bucket <your_s3_bucket_name> \
       --region <your_aws_region> \
       --create-bucket-configuration LocationConstraint=<cluster_aws_region>

2. Configure the policy for the S3 bucket by applying the following S3 bucket policy sample:

    "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowCentralLogDistributionWrite",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::859037107838:role/ROSA-CentralLogDistributionRole-241c1a86"
               },
               "Action": "s3:PutObject",
               "Resource": "arn:aws:s3:::<your_s3_bucket_name>/*",
               "Condition": {
                   "StringEquals": {
                       "s3:x-amz-acl": "bucket-owner-full-control"
                   }
               }
           }
       ]
   }

3. Attach the policy to the S3 role by running the following command:

   $ aws s3api put-bucket-policy \
       --bucket <your_s3_bucket_name> \
       --policy file://s3-bucket-policy.json

4. Configure your Red Hat OpenShift Service on AWS cluster to forward logs to the S3 bucket by applying the following sample YAML list. Specify an application, or group, or both:

   s3:
     s3_config_bucket_name: "my-log-bucket"
     s3_config_bucket_prefix: "my-bucket-prefix"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

   <example_app1>

   Add one or more applications. For a list of applications, see the table in "Determining what log groups to use".

   <example_group1>

   Add one or more of the following groups: api, authentication, controller manager, scheduler.

5. Enable the log forwarder to send logs to your Red Hat OpenShift Service on AWS cluster.

   1. To enable control plane log forwarding on a new cluster, include the log forwarding configuration by running the following command:

      $ rosa create cluster --log-fwd-config="<path_to_file>.yaml"

   2. To enable control plane log forwarding on an existing cluster, include the log forwarding configuration by running the following command:

      $ rosa create log-forwarder -c <cluster> --log-fwd-config="<path_to_file>.yaml" -o yaml

6. Optional: For an example for forwarding logs to the S3 bucket, apply the following sample YAML:

   s3:
     s3_config_bucket_name: "s3-bucket-name"
     s3_config_bucket_prefix: "s3-bucket-prefix"
     groups:
       - "<example_group1>"