Prerequisites

Mon, 01 Jan 0001 00:00:00 +0000

Updating the Roles and Permissions using JSON

The roles and permissions are updated using the JSONs.

From the AWS Console, navigate to IAM > Policies > Create policy > JSON, and create the following JSONs.

Note: Before using the provided JSON, replace the AWS_ACCOUNT_ID and REGION values with those of the account and region where the resources are being deployed.

Creating KMS key and S3 bucket

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "ReadOnlyAccess",
			"Effect": "Allow",
			"Action": [
				"eks:DescribeClusterVersions",
				"ec2:DescribeInstances",
				"ec2:DescribeVolumes",
				"s3:ListAllMyBuckets",
				"iam:ListUsers",
				"ec2:RunInstances",
				"ec2:DescribeInstances",
				"ec2:DescribeVolumes",
				"ec2:CreateKeyPair",
				"ec2:DescribeImages"
			],
			"Resource": "*"
		},
		{
			"Sid": "ScopedS3AndKMS",
			"Effect": "Allow",
			"Action": [
				"s3:ListBucket",
				"s3:PutEncryptionConfiguration",
				"s3:GetEncryptionConfiguration",
				"kms:CreateKey",
				"kms:PutKeyPolicy",
				"kms:GetKeyPolicy"
			],
			"Resource": [
				"arn:aws:s3:::*",
				"arn:aws:kms:*:<AWS_ACCOUNT_ID>:key/*"
			]
		},
		{
			"Sid": "SelfServiceIAM",
			"Effect": "Allow",
			"Action": [
				"iam:ListSSHPublicKeys",
				"iam:ListServiceSpecificCredentials",
				"iam:GetLoginProfile",
				"iam:ListAccessKeys",
				"iam:CreateAccessKey"
			],
			"Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:user/${aws:username}"
		},
 {
			"Sid": "EC2KeyPairPermission",
			"Effect": "Allow",
			"Action": [
				"ec2:CreateKeyPair",
				"ec2:DescribeKeyPairs"
			],
			"Resource": [
				"*"
			]
		}
	]
}

EC2 Service Policy

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "DenyEC2Instances",
			"Effect": "Deny",
			"Action": "ec2:RunInstances",
			"Resource": "arn:aws:ec2:*:*:instance/*",
			"Condition": {
				"StringLike": {
					"ec2:InstanceType": [
						"p*",
						"g*",
						"inf*",
						"trn*",
						"x*",
						"u-*",
						"z*",
						"mac*"
					]
				}
			}
		},
		{
			"Sid": "ReadOnlyDescribeListEC2RegionRestricted",
			"Effect": "Allow",
			"Action": [
				"ec2:DescribeVpcs",
				"ec2:DescribeSubnets",
				"ec2:DescribeVpcAttribute",
				"ec2:DescribeTags",
				"ec2:DescribeSecurityGroups",
				"ec2:DescribeSecurityGroupRules",
				"ec2:DescribeLaunchTemplates",
				"ec2:DescribeLaunchTemplateVersions",
				"ec2:DescribeNetworkInterfaces",
				"ec2:DescribeAccountAttributes"
			],
			"Resource": "*",
			"Condition": {
				"StringEquals": {
					"aws:RequestedRegion": [
						"<REGION>"
					]
				}
			}
		},
		{
			"Sid": "EC2LifecycleAndSecurity",
			"Effect": "Allow",
			"Action": [
				"ec2:CreateSecurityGroup",
				"ec2:DeleteSecurityGroup",
				"ec2:AuthorizeSecurityGroupIngress",
				"ec2:AuthorizeSecurityGroupEgress",
				"ec2:RevokeSecurityGroupIngress",
				"ec2:RevokeSecurityGroupEgress",
				"ec2:CreateLaunchTemplate",
				"ec2:DeleteLaunchTemplate",
				"ec2:CreateTags",
				"ec2:DeleteTags"
			],
			"Resource": [
				"arn:aws:ec2:*:*:security-group/*",
				"arn:aws:ec2:*:*:launch-template/*",
				"arn:aws:ec2:*:*:instance/*",
				"arn:aws:ec2:*:*:network-interface/*",
				"arn:aws:ec2:*:*:subnet/*",
				"arn:aws:ec2:*:*:vpc/*",
				"arn:aws:ec2:*:*:image/*",
				"arn:aws:ec2:*:*:volume/*",
				"arn:aws:ec2:*:*:snapshot/*"
			]
		}
	]
}

EKS Service Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "ReadOnlyDescribeListEKSVersionsRegionRestricted",
 "Effect": "Allow",
 "Action": [
 "eks:DescribeAddonVersions"
 ],
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "aws:RequestedRegion": [
 "<REGION>"
 ]
 }
 }
 },
 {
 "Sid": "ReadOnlyDescribeListEKS",
 "Effect": "Allow",
 "Action": [
 "eks:DescribeCluster",
 "eks:DescribeAddon",
 "eks:DescribePodIdentityAssociation",
 "eks:DescribeNodegroup",
 "eks:ListAddons",
 "eks:ListPodIdentityAssociations"
 ],
 "Resource": [
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:cluster/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:nodegroup/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:addon/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:podidentityassociation/*"
 ]
 },
 {
 "Sid": "EKSLifecycleAndTag",
 "Effect": "Allow",
 "Action": [
 "eks:CreateCluster",
 "eks:UpdateClusterVersion",
 "eks:UpdateClusterConfig",
 "eks:CreateNodegroup",
 "eks:UpdateNodegroupConfig",
 "eks:UpdateNodegroupVersion",
 "eks:DeleteNodegroup",
 "eks:CreateAddon",
 "eks:UpdateAddon",
 "eks:DeleteAddon",
 "eks:CreatePodIdentityAssociation",
 "eks:DeletePodIdentityAssociation",
 "eks:TagResource",
 "eks:ListClusters"
 ],
 "Resource": [
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:cluster/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:nodegroup/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:addon/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:podidentityassociation/*"
 ]
 },
 {
 "Sid": "AllowEKSNodegroupSLR",
 "Effect": "Allow",
 "Action": [
 "iam:GetRole",
 "iam:CreateServiceLinkedRole"
 ],
 "Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup"
 },
 {
 "Sid": "EKSDeleteClusterV6",
 "Effect": "Allow",
 "Action": "eks:DeleteCluster",
 "Resource": "arn:aws:eks:*:<AWS_ACCOUNT_ID>:cluster/*"
 }
 ]
}

IAM Service Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "DenyAdminPolicyAttachment",
 "Effect": "Deny",
 "Action": [
 "iam:AttachRolePolicy",
 "iam:PutRolePolicy"
 ],
 "Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*",
 "Condition": {
 "ArnLike": {
 "iam:PolicyARN": [
 "arn:aws:iam::aws:policy/AdministratorAccess",
 "arn:aws:iam::aws:policy/PowerUserAccess",
 "arn:aws:iam::aws:policy/*FullAccess"
 ]
 }
 }
 },
 {
 "Sid": "DenyInlinePolicyEscalation",
 "Effect": "Deny",
 "Action": [
 "iam:PutRolePolicy",
 "iam:PutUserPolicy",
 "iam:PutGroupPolicy"
 ],
 "Resource": "*"
 },
 {
 "Sid": "ReadOnlyDescribeListIAMScoped",
 "Effect": "Allow",
 "Action": [
 "iam:GetRole",
 "iam:ListRolePolicies",
 "iam:ListAttachedRolePolicies",
 "iam:ListInstanceProfilesForRole",
 "iam:GetInstanceProfile",
 "iam:GetPolicy",
 "iam:GetPolicyVersion",
 "iam:ListPolicyVersions",
 "iam:ListAccessKeys"
 ],
 "Resource": [
 "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*",
 "arn:aws:iam::<AWS_ACCOUNT_ID>:instance-profile/eks-*",
 "arn:aws:iam::<AWS_ACCOUNT_ID>:policy/eks-*"
 ]
 },
 {
 "Sid": "ReadOnlyDescribeListUnavoidableStar",
 "Effect": "Allow",
 "Action": "iam:ListRoles",
 "Resource": "*"
 },
 {
 "Sid": "IAMLifecycleRolesPoliciesInstanceProfiles",
 "Effect": "Allow",
 "Action": [
 "iam:CreateRole",
 "iam:TagRole",
 "iam:CreatePolicy",
 "iam:DeletePolicy",
 "iam:DeletePolicyVersion",
 "iam:TagPolicy",
 "iam:AttachRolePolicy",
 "iam:DetachRolePolicy",
 "iam:CreateInstanceProfile",
 "iam:TagInstanceProfile",
 "iam:AddRoleToInstanceProfile",
 "iam:RemoveRoleFromInstanceProfile",
 "iam:DeleteInstanceProfile"
 ],
 "Resource": [
 "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*",
 "arn:aws:iam::<AWS_ACCOUNT_ID>:policy/eks-*",
 "arn:aws:iam::<AWS_ACCOUNT_ID>:instance-profile/eks-*"
 ]
 },
 {
 "Sid": "EKSDeleteRoles",
 "Effect": "Allow",
 "Action": "iam:DeleteRole",
 "Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks*"
 },
 {
 "Sid": "PassRoleOnlyToEKS",
 "Effect": "Allow",
 "Action": "iam:PassRole",
 "Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*",
 "Condition": {
 "StringEquals": {
 "iam:PassedToService": [
 "eks.amazonaws.com",
 "ec2.amazonaws.com",
 "eks-pods.amazonaws.com",
 "pods.eks.amazonaws.com"
 ]
 }
 }
 },
 {
 "Sid": "PassRoleForEKSPodIdentityRoles",
 "Effect": "Allow",
 "Action": "iam:PassRole",
 "Resource": [
 "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*-karpenter-role",
 "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*-backup-recovery-utility-role"
 ]
 }
 ]
}

KMS Service Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "KMSCreateAndList",
 "Effect": "Allow",
 "Action": [
 "kms:CreateKey",
 "kms:ListAliases"
 ],
 "Resource": "*"
 },
 {
 "Sid": "KMSKeyManagementScoped",
 "Effect": "Allow",
 "Action": [
 "kms:PutKeyPolicy",
 "kms:GetKeyPolicy",
 "kms:DescribeKey",
 "kms:GenerateDataKey",
 "kms:Decrypt",
 "kms:TagResource",
 "kms:UntagResource",
 "kms:EnableKeyRotation",
 "kms:GetKeyRotationStatus",
 "kms:ListResourceTags",
 "kms:ScheduleKeyDeletion",
 "kms:CreateAlias",
 "kms:DeleteAlias"
 ],
 "Resource": [
 "arn:aws:kms:*:<AWS_ACCOUNT_ID>:key/*",
 "arn:aws:kms:*:<AWS_ACCOUNT_ID>:alias/*"
 ]
 }
 ]
}

S3 Service Policy

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "S3EncryptionConfigAndStateScoped",
 "Effect": "Allow",
 "Action": [
 "s3:ListBucket",
 "s3:GetEncryptionConfiguration",
 "s3:PutEncryptionConfiguration",
 "s3:GetObject",
 "s3:PutObject",
 "s3:DeleteObject",
 "s3:CreateBucket",
 "s3:GetBucketTagging",
 "s3:GetBucketPolicy",
 "s3:GetBucketAcl",
 "s3:GetBucketCORS",
 "s3:PutBucketTagging",
 "s3:GetBucketWebsite",
 "s3:GetBucketVersioning",
 "s3:GetAccelerateConfiguration",
 "s3:GetBucketRequestPayment",
 "s3:GetBucketLogging",
 "s3:GetLifecycleConfiguration",
 "s3:GetReplicationConfiguration",
 "s3:GetBucketObjectLockConfiguration",
 "s3:DeleteBucket"
 ],
 "Resource": "arn:aws:s3:::*",
 "Condition": {
 "StringEquals": {
 "aws:RequestedRegion": [
 "<REGION>"
 ],
 "aws:PrincipalAccount": "<AWS_ACCOUNT_ID>"
 }
 }
 }
 ]
}

Description for the JSON components

This section provides information for the permissions mentioned in the JSON file.

Preparing for PPC deployment

Mon, 01 Jan 0001 00:00:00 +0000

This section describes the steps to download and extract the recipe for deploying the PPC.

Note: If you have set up the jump box previously, then from /deployment/iac_setup/ directory, run the make clean command. This ensures that the local repository on the jump box and the clusters are cleaned up before proceeding with a new installation.

Warning: Do not install or manage multiple clusters from the same working directory. Each cluster deployment maintains its own Terraform/OpenTofu state, and reusing a directory can overwrite state files, causing loss of cluster tracking and unintended cleanup behavior.
Use a dedicated directory, and jump box, where possible, per cluster, and always verify the active kubectl context before running cleanup commands such as make clean.

Deploying PPC

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Before running the bootstrap or resiliency scripts as the root user on RHEL, ensure that /usr/local/bin (and the AWS CLI binary path, if applicable) is included in the $PATH. Alternatively, run the script using a non-root user (such as ec2-user) where /usr/local/bin is already part of the default PATH.
By default, the installation is configured to use the us-east-1 AWS region. If you plan to install the product in a different region, update the region value in the iac_setup/scripts/iac/variables.tf file before starting the installation.

Installing PPC on

Prerequisites

Updating the Roles and Permissions using JSON

Description for the JSON components

Preparing for PPC deployment

Deploying PPC

Before you begin