Installing PPC on Amazon Web Services (AWS) on

Prerequisites

Mon, 01 Jan 0001 00:00:00 +0000

Updating the Roles and Permissions using JSON

The roles and permissions are updated using the JSONs.

From the AWS Console, navigate to IAM > Policies > Create policy > JSON, and create the following JSONs.

Note: Before using the provided JSON, replace the AWS_ACCOUNT_ID and REGION values with those of the account and region where the resources are being deployed.

Creating KMS key and S3 bucket.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "ReadOnlyAccess",
			"Effect": "Allow",
			"Action": [
				"eks:DescribeClusterVersions",
				"ec2:DescribeInstances",
				"ec2:DescribeVolumes",
				"s3:ListAllMyBuckets",
				"iam:ListUsers",
				"ec2:RunInstances",
				"ec2:DescribeInstances",
				"ec2:DescribeVolumes",
				"ec2:CreateKeyPair",
				"ec2:DescribeImages"
			],
			"Resource": "*"
		},
		{
			"Sid": "ScopedS3AndKMS",
			"Effect": "Allow",
			"Action": [
				"s3:ListBucket",
				"s3:PutEncryptionConfiguration",
				"s3:GetEncryptionConfiguration",
				"kms:CreateKey",
				"kms:PutKeyPolicy",
				"kms:GetKeyPolicy"
			],
			"Resource": [
				"arn:aws:s3:::*",
				"arn:aws:kms:*:<AWS_ACCOUNT_ID>:key/*"
			]
		},
		{
			"Sid": "SelfServiceIAM",
			"Effect": "Allow",
			"Action": [
				"iam:ListSSHPublicKeys",
				"iam:ListServiceSpecificCredentials",
				"iam:GetLoginProfile",
				"iam:ListAccessKeys",
				"iam:CreateAccessKey"
			],
			"Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:user/${aws:username}"
		},
 {
			"Sid": "EC2KeyPairPermission",
			"Effect": "Allow",
			"Action": [
				"ec2:CreateKeyPair",
				"ec2:DescribeKeyPairs"
			],
			"Resource": [
				"*"
			]
		}
	]
}

Creating EC2 Service Policy.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "DenyEC2Instances",
			"Effect": "Deny",
			"Action": "ec2:RunInstances",
			"Resource": "arn:aws:ec2:*:*:instance/*",
			"Condition": {
				"StringLike": {
					"ec2:InstanceType": [
						"p*",
						"g*",
						"inf*",
						"trn*",
						"x*",
						"u-*",
						"z*",
						"mac*"
					]
				}
			}
		},
		{
			"Sid": "ReadOnlyDescribeListEC2RegionRestricted",
			"Effect": "Allow",
			"Action": [
				"ec2:DescribeVpcs",
				"ec2:DescribeSubnets",
				"ec2:DescribeVpcAttribute",
				"ec2:DescribeTags",
				"ec2:DescribeSecurityGroups",
				"ec2:DescribeSecurityGroupRules",
				"ec2:DescribeLaunchTemplates",
				"ec2:DescribeLaunchTemplateVersions",
				"ec2:DescribeNetworkInterfaces",
				"ec2:DescribeAccountAttributes"
			],
			"Resource": "*",
			"Condition": {
				"StringEquals": {
					"aws:RequestedRegion": [
						"<REGION>"
					]
				}
			}
		},
		{
			"Sid": "EC2LifecycleAndSecurity",
			"Effect": "Allow",
			"Action": [
				"ec2:CreateSecurityGroup",
				"ec2:DeleteSecurityGroup",
				"ec2:AuthorizeSecurityGroupIngress",
				"ec2:AuthorizeSecurityGroupEgress",
				"ec2:RevokeSecurityGroupIngress",
				"ec2:RevokeSecurityGroupEgress",
				"ec2:CreateLaunchTemplate",
				"ec2:DeleteLaunchTemplate",
				"ec2:CreateTags",
				"ec2:DeleteTags"
			],
			"Resource": [
				"arn:aws:ec2:*:*:security-group/*",
				"arn:aws:ec2:*:*:launch-template/*",
				"arn:aws:ec2:*:*:instance/*",
				"arn:aws:ec2:*:*:network-interface/*",
				"arn:aws:ec2:*:*:subnet/*",
				"arn:aws:ec2:*:*:vpc/*",
				"arn:aws:ec2:*:*:image/*",
				"arn:aws:ec2:*:*:volume/*",
				"arn:aws:ec2:*:*:snapshot/*"
			]
		}
	]
}

Creating EKS Service Policy.

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "ReadOnlyDescribeListEKSVersionsRegionRestricted",
 "Effect": "Allow",
 "Action": [
 "eks:DescribeAddonVersions"
 ],
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "aws:RequestedRegion": [
 "<REGION>"
 ]
 }
 }
 },
 {
 "Sid": "ReadOnlyDescribeListEKS",
 "Effect": "Allow",
 "Action": [
 "eks:DescribeCluster",
 "eks:DescribeAddon",
 "eks:DescribePodIdentityAssociation",
 "eks:DescribeNodegroup",
 "eks:ListAddons",
 "eks:ListPodIdentityAssociations"
 ],
 "Resource": [
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:cluster/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:nodegroup/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:addon/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:podidentityassociation/*"
 ]
 },
 {
 "Sid": "EKSLifecycleAndTag",
 "Effect": "Allow",
 "Action": [
 "eks:CreateCluster",
 "eks:UpdateClusterVersion",
 "eks:UpdateClusterConfig",
 "eks:CreateNodegroup",
 "eks:UpdateNodegroupConfig",
 "eks:UpdateNodegroupVersion",
 "eks:DeleteNodegroup",
 "eks:CreateAddon",
 "eks:UpdateAddon",
 "eks:DeleteAddon",
 "eks:CreatePodIdentityAssociation",
 "eks:DeletePodIdentityAssociation",
 "eks:TagResource",
 "eks:ListClusters"
 ],
 "Resource": [
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:cluster/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:nodegroup/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:addon/*",
 "arn:aws:eks:*:<AWS_ACCOUNT_ID>:podidentityassociation/*"
 ]
 },
 {
 "Sid": "AllowEKSNodegroupSLR",
 "Effect": "Allow",
 "Action": [
 "iam:GetRole",
 "iam:CreateServiceLinkedRole"
 ],
 "Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/aws-service-role/eks-nodegroup.amazonaws.com/AWSServiceRoleForAmazonEKSNodegroup"
 },
 {
 "Sid": "EKSDeleteClusterV6",
 "Effect": "Allow",
 "Action": "eks:DeleteCluster",
 "Resource": "arn:aws:eks:*:<AWS_ACCOUNT_ID>:cluster/*"
 }
 ]
}

Creating IAM Service Policy.

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "DenyAdminPolicyAttachment",
 "Effect": "Deny",
 "Action": [
 "iam:AttachRolePolicy",
 "iam:PutRolePolicy"
 ],
 "Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*",
 "Condition": {
 "ArnLike": {
 "iam:PolicyARN": [
 "arn:aws:iam::aws:policy/AdministratorAccess",
 "arn:aws:iam::aws:policy/PowerUserAccess",
 "arn:aws:iam::aws:policy/*FullAccess"
 ]
 }
 }
 },
 {
 "Sid": "DenyInlinePolicyEscalation",
 "Effect": "Deny",
 "Action": [
 "iam:PutRolePolicy",
 "iam:PutUserPolicy",
 "iam:PutGroupPolicy"
 ],
 "Resource": "*"
 },
 {
 "Sid": "ReadOnlyDescribeListIAMScoped",
 "Effect": "Allow",
 "Action": [
 "iam:GetRole",
 "iam:ListRolePolicies",
 "iam:ListAttachedRolePolicies",
 "iam:ListInstanceProfilesForRole",
 "iam:GetInstanceProfile",
 "iam:GetPolicy",
 "iam:GetPolicyVersion",
 "iam:ListPolicyVersions",
 "iam:ListAccessKeys"
 ],
 "Resource": [
 "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*",
 "arn:aws:iam::<AWS_ACCOUNT_ID>:instance-profile/eks-*",
 "arn:aws:iam::<AWS_ACCOUNT_ID>:policy/eks-*"
 ]
 },
 {
 "Sid": "ReadOnlyDescribeListUnavoidableStar",
 "Effect": "Allow",
 "Action": "iam:ListRoles",
 "Resource": "*"
 },
 {
 "Sid": "IAMLifecycleRolesPoliciesInstanceProfiles",
 "Effect": "Allow",
 "Action": [
 "iam:CreateRole",
 "iam:TagRole",
 "iam:CreatePolicy",
 "iam:DeletePolicy",
 "iam:DeletePolicyVersion",
 "iam:TagPolicy",
 "iam:AttachRolePolicy",
 "iam:DetachRolePolicy",
 "iam:CreateInstanceProfile",
 "iam:TagInstanceProfile",
 "iam:AddRoleToInstanceProfile",
 "iam:RemoveRoleFromInstanceProfile",
 "iam:DeleteInstanceProfile"
 ],
 "Resource": [
 "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*",
 "arn:aws:iam::<AWS_ACCOUNT_ID>:policy/eks-*",
 "arn:aws:iam::<AWS_ACCOUNT_ID>:instance-profile/eks-*"
 ]
 },
 {
 "Sid": "EKSDeleteRoles",
 "Effect": "Allow",
 "Action": "iam:DeleteRole",
 "Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks*"
 },
 {
 "Sid": "PassRoleOnlyToEKS",
 "Effect": "Allow",
 "Action": "iam:PassRole",
 "Resource": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*",
 "Condition": {
 "StringEquals": {
 "iam:PassedToService": [
 "eks.amazonaws.com",
 "ec2.amazonaws.com",
 "eks-pods.amazonaws.com",
 "pods.eks.amazonaws.com"
 ]
 }
 }
 },
 {
 "Sid": "PassRoleForEKSPodIdentityRoles",
 "Effect": "Allow",
 "Action": "iam:PassRole",
 "Resource": [
 "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*-karpenter-role",
 "arn:aws:iam::<AWS_ACCOUNT_ID>:role/eks-*-backup-recovery-utility-role"
 ]
 }
 ]
}

Creating KMS Service Policy.

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "KMSCreateAndList",
 "Effect": "Allow",
 "Action": [
 "kms:CreateKey",
 "kms:ListAliases"
 ],
 "Resource": "*"
 },
 {
 "Sid": "KMSKeyManagementScoped",
 "Effect": "Allow",
 "Action": [
 "kms:PutKeyPolicy",
 "kms:GetKeyPolicy",
 "kms:DescribeKey",
 "kms:GenerateDataKey",
 "kms:Decrypt",
 "kms:TagResource",
 "kms:UntagResource",
 "kms:EnableKeyRotation",
 "kms:GetKeyRotationStatus",
 "kms:ListResourceTags",
 "kms:ScheduleKeyDeletion",
 "kms:CreateAlias",
 "kms:DeleteAlias"
 ],
 "Resource": [
 "arn:aws:kms:*:<AWS_ACCOUNT_ID>:key/*",
 "arn:aws:kms:*:<AWS_ACCOUNT_ID>:alias/*"
 ]
 }
 ]
}

Creating AWS S3 Service Policy.

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "S3EncryptionConfigAndStateScoped",
 "Effect": "Allow",
 "Action": [
 "s3:ListBucket",
 "s3:GetEncryptionConfiguration",
 "s3:PutEncryptionConfiguration",
 "s3:GetObject",
 "s3:PutObject",
 "s3:DeleteObject",
 "s3:CreateBucket",
 "s3:GetBucketTagging",
 "s3:GetBucketPolicy",
 "s3:GetBucketAcl",
 "s3:GetBucketCORS",
 "s3:PutBucketTagging",
 "s3:GetBucketWebsite",
 "s3:GetBucketVersioning",
 "s3:GetAccelerateConfiguration",
 "s3:GetBucketRequestPayment",
 "s3:GetBucketLogging",
 "s3:GetLifecycleConfiguration",
 "s3:GetReplicationConfiguration",
 "s3:GetBucketObjectLockConfiguration",
 "s3:DeleteBucket",
 "s3:PutBucketVersioning",
 "s3:ListBucketVersions",
 "s3:DeleteObjectVersion",
 "s3:GetObjectTagging"
 ],
 "Resource": "arn:aws:s3:::*",
 "Condition": {
 "StringEquals": {
 "aws:RequestedRegion": [
 "<REGION>"
 ],
 "aws:PrincipalAccount": "<AWS_ACCOUNT_ID>"
 }
 }
 }
 ]
}

Description for the JSON components

This section provides information for the permissions mentioned in the JSON file.

Preparing for PPC deployment

Mon, 01 Jan 0001 00:00:00 +0000

If the jump box is already set previously, run the ./bootstrap.sh --cloud aws destroy command in the directory where the cluster is installed. This ensures that the local repository on the jump box and the clusters are cleaned up before proceeding with a new installation.

Warning: Do not install or manage multiple clusters from the same working directory. Each cluster deployment maintains its own Terraform/OpenTofu state, and reusing a directory can overwrite state files, causing loss of cluster tracking and unintended cleanup behavior.
Use a dedicated directory, and jump box, where possible, per cluster, and always verify the active kubectl context before running cleanup commands such as ./bootstrap.sh --cloud aws destroy.

Installing Features and Protectors

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Ensure that PPC is successfully installed before installing the features or protectors.

Installing Features

The following table lists the available features.

Feature	Description
Data Discovery	Installing Data Discovery
Semantic Guardrails	Installing Semantic Guardrails
Protegrity Agent	Installing Protegrity Agent
Anonymization	Installing Anonymization
Synthetic Data	Installing Synthetic Data

Installing Protectors

The following table lists the available protectors.

Protector	Description
Application Protector	Installing Application Protector
Repository Protector	Installing Repository Protector
Application Protector Java Container	Installing Application Protector Java Container
Rest Container	Installing Rest Container
Cloud Protector	Installing Cloud Protector

Upgrading the PPC

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Before starting an upgrade, ensure the following conditions are met:

Access to the jump box associated with the PPC v1.0.0 cluster is required. This must be the same jump box used during the PPC v1.0.0 installation.
Maintain both, previous and current installation directories. Do not delete the original cluster deployment directory, as it contains the Terraform state files required for managing the deployment.
Create a Velero backup and an OpenSearch snapshot to ensure data recovery is possible, in case of an upgrade failure.

Backing up the PPC

Mon, 01 Jan 0001 00:00:00 +0000

Protegrity Provisioned Cluster (PPC) supports backup of Insight indexes and cluster configurations. Use the procedures below to update the scheduled backups of your PPC deployment.

Backing up Velero backup schedule

To take a backup at an interval of 10 minutes, the cron job must be executed before the schedule. This ensures that the latest configurations are included and are available in the Storage Account.
By default, the cron job is executed after every 3 hours and schedule is executed after every 3.5 hours.

Restoring the PPC

Mon, 01 Jan 0001 00:00:00 +0000

Before you begin

Before starting a restore, ensure the following conditions are met:

An existing backup is available. Backups are taken automatically as part of the default installation using scheduled backup mechanisms. These backups are stored in an AWS S3 bucket configured during the original installation.
Access to the original backup AWS S3 bucket. During restore, the same S3 bucket that was used during the original installation must be specified.

Accessing PPC using a Linux machine

Mon, 01 Jan 0001 00:00:00 +0000

Access to the PPC cluster from a separate Linux machine may be required in the following situations:

The original jump box used during installation is no longer available or has been decommissioned.
A different team member or administrator needs cluster access without setting up a new jump box.
Operational tasks, such as troubleshooting or monitoring, are being performed from a dedicated management machine.
The organization requires cluster access to be restricted to specific machines for security or compliance reasons.

Before you begin

Ensure that the following prerequisites are met.

Restoring the SSH keys and PCT from backed up Terraform state file

Mon, 01 Jan 0001 00:00:00 +0000

This section describes the procedure to rebuild a usable PPC v1.1.0 deployment workspace on a jump box from an existing cluster and a backed up Terraform state file.

Before you Begin

Ensure the following requirements are met.

The state file from all the following modules must be available on the AWS S3 backup bucket.