Hide Forgot
Document URL and section: Section 2.5.4, Permissions for Amazon Web Services https://access.redhat.com/articles/2623521 Configuring for AWS https://docs.openshift.com/container-platform/3.3/install_config/configuring_aws.html Describe the issue: As an OpenShift admin, I'm running the advanced setup of the OpenShift Platform using AWS as a cloud provider. I can complete the setup using the broadest possible IAM permission set that is allow everything. I would like to assign an IAM Role to the AWS instance (both masters and nodes) but I want to have a more restrictive set of permissions. Suggestions for improvement: Could you provide a recommended set of permissions that is required to install and run the OpenShift cluster on AWS? Also, if the masters' IAM permissions are different from the ones for the nodes, could you provide two sets - one for the masters and one for the nodes? Additional information: In the the AWS reference architecture Section 2.5.4, Permissions for Amazon Web Services, we see: "The deployment of OpenShift requires a user that has the proper permissions by the AWS IAM administrator. The user must be able to create accounts, S3 buckets, roles, policies, Route53 entries, and deploy ELBs and EC2 instances. It is helpful to have delete permissions in order to be able to redeploy the environment while testing." By implication it seems as if the required permissions would be the following: - create accounts - create S3 buckets - create roles - create policies - create Route53 entries - deploy ELBs - deploy EC2 instances However this list doesn't appear to be explicit enough for implementation, nor does it differentiate between master and node permissions. (Submitted on behalf of client.)
Hi, is there any update?
(In reply to Takayoshi Tanaka from comment #1) > Hi, is there any update? Not yet. Expect this around OCP 3.4 release.
Ashley, I would reach out to the RH person/people that manage and set up the RH-DEV environments, they might have some information that could help. Dan Walsh might be a good starting point.
Thanks, Scott! Dan, Can you please help?
@Ashley, I think I put in the wrong name, I think Dan McPherson might be a better starting point for this. thanks, Scott
Thanks, Scott. Dan, Are you able to help provide guidance? Thanks!
Not really. The only way to do this is to implement a set of desired permissions and go through everything seeing what breaks, adding the needed perms, and repeating. It's a fairly tedious process and requires development work to prove it out. If we are going to provide the guidance, it's going to take a user story. We can't just tell them what we do for rh-dev as that environment has lots of purposes.