Prerequisites
The following prerequisites apply to both resource-management paths. Both paths require access to the OCI registry to install the Helm chart.
Ensure that the target EKS cluster is accessible and has a supported PPC installation.
For more information, refer to PPC installation.
Ensure that the jumpbox can connect to the required registries. If not already authenticated, then log in to the required registry.
For connecting and deploying from the Protegrity Container Registry (PCR), use the following command and the credentials obtained from the My.Protegrity portal during account creation:
helm registry login registry.protegrity.com:9443
- For connecting and deploying to the local registry, use your local credentials and local registry endpoint as required.
Required Tools
Ensure that the following tools are available on the jump box on which Policy Workbench is installed.
| Tool | Version | Description |
|---|---|---|
| OpenTofu | >=1.10.0 | Used to run the installer. This is only required for module-managed Workbench resources. |
| AWS CLI | Any version | Must be configured with credentials that have EKS and IAM permissions. The default region must also be set using either the AWS_DEFAULT_REGION or the AWS_REGION environment variables or the ~/.aws/config configuration file. |
| kubectl | Any version | Required for validating the deployment. It must be configured for the target PPC cluster where Policy Workbench is deployed. |
| Helm | Version 3.8.0 or later | Required for deploying Policy Workbench. |
Permissions
This section lists the permissions that are required to install Policy Workbench.
IAM Permissions
The following IAM permissions are required to provision AWS resources for Policy Workbench. For module-managed Workbench resources, these permissions are required by the AWS identity used to run the OpenTofu module. For self-managed Workbench resources, they are required by the identity used to provision the resources through your infrastructure automation or CLI commands.
| Permission | Purpose |
|---|---|
iam:CreatePolicy, iam:DeletePolicy, and iam:GetPolicy | Create and manage the AWS KMS access policy. |
iam:CreateRole, iam:DeleteRole, iam:GetRole, and iam:UpdateAssumeRolePolicy | Create and manage the AWS KMS pod identity role. |
iam:AttachRolePolicy and iam:DetachRolePolicy | Attach the AWS KMS policy to the role. |
iam:PassRole | Allow the provisioning identity to pass the KMGW IAM role to EKS when creating the Pod Identity association. Scope this permission to the KMGW role ARN. |
EKS Permissions
The following EKS permissions are required to install Policy Workbench. In the OpenTofu-based installation, these permissions are used automatically by the module. In the in-cluster installation, the platform team must have these permissions to provision the resources manually.
| Permission | Purpose |
|---|---|
eks:DescribeCluster | Read the cluster details. |
eks:DescribeAddon | Verify that the eks-podidentity-agent is installed. |
eks:CreatePodIdentityAssociation, eks:DeletePodIdentityAssociation, and eks:DescribePodIdentityAssociation | Associate the AWS KMS role with the Policy Workbench service account. |
Other Permissions
Helm deployment: The installer needs OCI registry access and Kubernetes RBAC to install or upgrade the chart. Helm access does not grant AWS or keystore access.
KMGW runtime: The KMGW pod uses the workbench-kms service account with a pod identity association to access the configured keystore. Grant this service account only the keystore permissions required by the configured backend. These permissions are separate from those required by the OpenTofu or Helm operator.
Feedback
Was this page helpful?