Chapter 7. Configure Red Hat OpenShift Service on AWS account roles with an AWS STS external ID

Procedure

1. Ensure that your external ID string meets the AWS requirements.

   Note

   External IDs are not automatically generated by the CLI.

2. Generate your account-wide roles and policies with your unique external ID by running the following command:

   $ rosa create account-roles --mode auto --external-id "my-secure-unique-id-123" --yes

3. Optional: If you prefer to review the JSON policy documents before applying them to AWS, run the command in manual mode instead:

   $ rosa create account-roles --mode manual --external-id "my-secure-unique-id-123"

   1. Review the STS JSON trust policy files that you generated. Create a role and attach a policy for each of the following role and policy pairs:

      • sts_installer_trust_policy.json for the Installer role
      • sts_support_trust_policy.json for the Support role
      • sts_worker_trust_policy.json for the worker node instance role. This role does not include an external ID because it is only assumed within the account of the cluster.

   2. For each role, create the account role by running the aws iam create-role command provided to you. For example, to create the Support role:

      $ aws iam create-role \
          --assume-role-policy-document file://sts_support_trust_policy.json \
          --role-name ManagedOpenShift-HCP-ROSA-Support-Role \
          --tags Key=red-hat-managed,Value=true Key=rosa_hcp_policies,Value=true Key=rosa_role_type,Value=support Key=rosa_managed_policies,Value=true Key=rosa_openshift_version,Value=4.22 Key=rosa_role_prefix,Value=ManagedOpenShift

   3. For each role, attach the role policy by running the aws iam attach-role-policy command provided to you. For example, to attach the Support role policy:

      $ aws iam attach-role-policy \
          --policy-arn arn:aws:iam::aws:policy/service-role/ROSASRESupportPolicy \
          --role-name ManagedOpenShift-HCP-ROSA-Support-Role

   4. Continue to attach policies to the remaining roles by running these same commands.

4. Create the Red Hat OpenShift Service on AWS cluster by using the interactive mode or the flags for automation. Choose one of the following methods:

   1. For the interactive mode, run the following command:

      $ rosa create cluster --interactive

      1. Answer the questions that the CLI gives you.

      2. Select the Amazon Resource Name (ARN) of the account roles that have the external ID defined in their trust policies, for example:

         arn:aws:iam::<aws_account_id>:role/externalid-HCP-ROSA-Installer-Role

   2. For the automation flags, if you have more than one external ID in a single trust policy, then you must manually set the external ID flag. Run the following command:

      $ rosa create cluster --cluster-name my-rosa-cluster \
          --sts \
          --mode auto \
          --external-id "my-secure-unique-id-123" \
          --yes --hosted-cp

      Note
      • Setting the --external-id field is optional unless you have more than one external ID in a single trust policy.
      • If you pass the --external-id flag during cluster creation, the CLI validates that the specified value exists across your Installer and Support role policies.

Verification

1. Verify that the external ID is applied to your cluster specification by querying the cluster description:

   $ rosa describe cluster --cluster my-rosa-cluster

2. In the output metadata, confirm that the External ID field reflects your custom identifier:

   Name:         my-rosa-cluster
   ID:           1abc2def3ghi4jklmnopqstuv
   External ID:  my-secure-unique-id-123
   Control Plane: Customer Hosted (HCP)
   ...

Procedure

1. Delete the existing account roles by running the following command. Replace ManagedOpenShift with your custom prefix if you used a custom prefix:

   Important

   Deleting account roles affects all clusters that use those roles. Before proceeding, ensure that no other clusters depend on these account roles.

   $ rosa delete account-roles -p ManagedOpenShift --mode auto --yes

2. When you get confirmation that you successfully deleted the account roles, re-create account roles with your external ID by running the following command:

   $ rosa create account-roles --mode auto --external-id "my-secure-unique-id-123" --yes

3. Continue with your cluster creation process.

Verification

1. Verify that the re-created account roles contain the correct external ID by running the following command for each role:

   $ aws iam get-role --role-name ManagedOpenShift-HCP-ROSA-Installer-Role --query 'Role.AssumeRolePolicyDocument'

2. In the output, confirm that the sts:ExternalId value matches your external ID string.