Security and compliance

Red Hat OpenShift Service on AWS 4

Configuring security context constraints on AWS clusters

Red Hat OpenShift Documentation Team

Abstract

This document provides instructions for configuring security context constraints.

Chapter 1. Specifying the TLS for your cluster

Red Hat OpenShift Service on AWS supports the Modern Transport Layer Security (TLS) 1.3 security profile, allowing you to use TLS 1.3 for enhanced security of your client-facing ingress endpoint.

1.1. TLS support for your clusters

With Red Hat OpenShift Service on AWS, you can use the Modern Transport Layer Security (TLS) 1.3 security profile for managed endpoints, giving you authority over the API server and OAuth endpoints. Even when Red Hat manages the underlying control plane infrastructure, you still have control. By using this TLS 1.3profile, you ensure that administrative and automation tools, such as the oc command line tool and the CI/CD integration, use TLS 1.3 for all communications.

Chapter 2. Adding additional constraints for IP-based AWS role assumption

Create an identity-based policy that denies requests from non-allowlisted IP addresses. Restricting role access can improve your AWS account security.

2.1. Creating an identity-based IAM policy

Create an Identity and Access Management (IAM) policy that denies access to all AWS actions if the request is made from an IP address not provided by Red Hat.

Prerequisites

Procedure

  1. Sign in to the AWS Management Console using your AWS account credentials.
  2. Navigate to the IAM service.
  3. In the IAM console, select Policies from the left navigation menu.
  4. Click Create policy.
  5. Select the JSON tab to define the policy using JSON format.

  6. To get the IP addresses required for the JSON policy document, run the following command: 

    $ ocm get /api/clusters_mgmt/v1/trusted_ip_addresses
    Note

    These IP addresses are not permanent and can change. Regularly review the API output and update the JSON policy document.

  7. Copy and paste the following policy_document.json file into the editor: 

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": []
                },
                "Bool": {
                    "aws:ViaAWSService": "false"
                }
            }
        }
    ]
}
  8. Copy and paste all of the IP addresses, which you got in Step 6, into the "aws:SourceIp": [] array in your policy_document.json file.
  9. Click Review and create.
  10. Provide a name and description for the policy, and review the details for accuracy.

  11. Click Create policy to save the policy.

    Note

    Set the aws:ViaAWSService condition key to false to ensure that subsequent calls succeed after your initial call. For example, if you do not set aws:ViaAWSService to false and run aws ec2 describe-instances, some follow-up calls can fail. It applies to subsequent calls that you make within the AWS API server to retrieve information about the Elastic Block Store (EBS) volumes attached to the EC2 instance. The subsequent calls fail because they originate from AWS IP addresses that are not included in the AllowList.

2.2. Attaching the identity-based IAM policy

After you create an Identity and Access Management (IAM) policy, attach it to the relevant IAM users, groups, or roles in your AWS account. The policy prevents IP-based role assumption for these entities.

Procedure

  1. Navigate to the IAM console in the AWS Management Console.

  2. Select the default IAM ManagedOpenShift-Support-Role role to attach the policy.

    Note

    You can change the default IAM ManagedOpenShift-Support-Role role. For more information about roles, see This page is not included, but the link has been rewritten to point to the nearest parent document.Red Hat support access.

  3. In the Permissions tab, select Add Permissions or Create inline policy from the Add Permissions drop-down list.

  4. Search for the policy you created earlier by:

    1. Entering the policy name.
    2. Filtering by the appropriate category.

  5. Select the policy and click Attach policy.

    Important

    To prevent IP-based role assumption, keep the allowlisted IPs up-to-date. Outdated IPs can block Red Hat site reliability engineering (SRE) from accessing your account and affect your Service Level Agreement (SLA).

2.3. Additional resources

Legal Notice

Copyright © Red Hat.
Except as otherwise noted below, the text of and illustrations in this documentation are licensed by Red Hat under the Creative Commons Attribution–Share Alike 3.0 Unported license . If you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, the Red Hat logo, JBoss, Hibernate, and RHCE are trademarks or registered trademarks of Red Hat, LLC. or its subsidiaries in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
XFS is a trademark or registered trademark of Hewlett Packard Enterprise Development LP or its subsidiaries in the United States and other countries.
The OpenStack® Word Mark and OpenStack logo are trademarks or registered trademarks of the Linux Foundation, used under license.
All other trademarks are the property of their respective owners.