Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 1. Prerequisites checklist for deploying Red Hat OpenShift Service on AWS classic architecture

This is a high level checklist of prerequisites needed to create a Red Hat OpenShift Service on AWS classic architecture cluster with STS.

The machine that you run the installation process from must have access to the following:

  • Amazon Web Services API and authentication service endpoints
  • Red Hat OpenShift API and authentication service endpoints (api.openshift.com and sso.redhat.com)
  • Internet connectivity to obtain installation artifacts during deployment
Important

Starting with version 1.2.7 of the ROSA command-line interface (CLI) (rosa), all OIDC provider endpoint URLs on new clusters use Amazon CloudFront and the oidc.op1.openshiftapps.com domain. This change improves access speed, reduces latency, and improves resiliency for new clusters created with the ROSA CLI 1.2.7 or later. There are no supported migration paths for existing OIDC provider configurations.

1.1. Accounts and permissions
Copy link

Ensure that you have the following accounts, credentials, and permissions.

1.1.1. AWS account
Copy link

You must have an AWS account with certain permissions before creating your cluster.

  • Create an AWS account if you do not already have one.
  • Gather the credentials required to log in to your AWS account.
  • Ensure that your AWS account has sufficient permissions to use the ROSA CLI.

  • Enable Red Hat OpenShift Service on AWS classic architecture for your AWS account on the AWS console.

  • Ensure you have not enabled restrictive tag policies. For more information, see Tag policies in the AWS documentation.

1.1.2. Red Hat account
Copy link

Create your Red Hat account to maintain your Red Hat resources.

  • Create a Red Hat account for the Red Hat Hybrid Cloud Console if you do not already have one.
  • Gather the credentials required to log in to your Red Hat account.

1.2. CLI requirements
Copy link

You need to download and install several CLI (command-line interface) tools to be able to deploy a cluster.

1.2.1. AWS CLI (aws)
Copy link

The AWS CLI tool allows you to interact with AWS resources directly.

Procedure

  1. Install the AWS Command Line Interface.
  2. Log in to your AWS account using the AWS CLI: Sign in through the AWS CLI

  3. Verify your account identity: 

     $ aws sts get-caller-identity

  4. Check whether the service role for ELB (Elastic Load Balancing) exists: 

    $ aws iam get-role --role-name "AWSServiceRoleForElasticLoadBalancing"

    If the role does not exist, create it by running the following command: 

    $ aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com"

1.2.2. ROSA command-line interface (CLI) (rosa)
Copy link

Install the ROSA CLI on in your local environment.

Procedure

  1. Install the ROSA CLI from the web console.

  2. Log in to your Red Hat account by running rosa login and following the instructions in the command output: 

    $ rosa login
To login to your Red{nbsp}Hat account, get an offline access token at https://console.redhat.com/openshift/token/rosa
? Copy the token and paste it here:

    Alternatively, you can copy the full $ rosa login --token=abc…​ command and paste that in the terminal: 

    $ rosa login --token=<abc..>

  3. Confirm you are logged in using the correct account and credentials: 

    $ rosa whoami

1.2.3. OpenShift CLI (oc)
Copy link

The OpenShift CLI (oc) is not required to deploy a Red Hat OpenShift Service on AWS classic architecture cluster, but is a useful tool for interacting with your cluster after it is deployed.

Procedure

  1. Download and install oc from the OpenShift Cluster Manager Command-line interface (CLI) tools page, or follow the instructions in the Additional resources.

  2. Verify that the OpenShift CLI has been installed correctly by running the following command: 

    $ rosa verify openshift-client

1.3. AWS infrastructure prerequisites
Copy link

Before you create your cluster, you need to have sufficient AWS quota.

Procedure

  • To verify that your AWS account has sufficient quota available to deploy a cluster, run the following command: 

    $ rosa verify quota

    This command only checks the total quota allocated to your account; it does not reflect the amount of quota already consumed from that quota. Running this command is optional because your quota is verified during cluster deployment. However, Red Hat recommends running this command to confirm your quota ahead of time so that deployment is not interrupted by issues with quota availability.

1.4. Service Control Policy (SCP) prerequisites
Copy link

Red Hat OpenShift Service on AWS classic architecture clusters are hosted in an AWS account within an AWS organizational unit. A service control policy (SCP) is created and applied to the AWS organizational unit that manages what services the AWS sub-accounts are permitted to access.

  • Ensure that your organization’s SCPs are not more restrictive than the roles and policies required by the cluster.
  • When you create a Red Hat OpenShift Service on AWS classic architecture cluster, an associated AWS OpenID Connect (OIDC) identity provider is created.

1.5. Networking prerequisites
Copy link

1.5.1. Firewall
Copy link

You must configure your firewall so that your cluster can access the required domains and ports.

1.5.3. Additional custom security groups
Copy link

During cluster creation, you can add additional custom security groups to a cluster that has an existing non-managed VPC. To do so, complete these prerequisites before you create the cluster:

  • Create the custom security groups in AWS before you create the cluster.
  • Associate the custom security groups with the VPC that you are using to create the cluster. Do not associate the custom security groups with any other VPC.
  • You may need to request additional AWS quota for Security groups per network interface.

1.5.4. Custom DNS and domains
Copy link

You can configure a custom domain name server and custom domain name for your cluster.

Prerequisites

  • By default, Red Hat OpenShift Service on AWS classic architecture clusters require you to set the domain name servers option to AmazonProvidedDNS to ensure successful cluster creation and operation.
  • To use a custom DNS server and domain name for your cluster, the Red Hat OpenShift Service on AWS classic architecture installer must be able to use VPC DNS with default DHCP options so that it can resolve internal IPs and services. This means that you must create a custom DHCP option set to forward DNS lookups to your DNS server, and associate this option set with your VPC before you create the cluster.

Procedure

  • Confirm that your VPC is using VPC Resolver by running the following command: 

    $ aws ec2 describe-dhcp-options
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top