Repository: openshift/openshift-docs
Pull request #89008: OSDOCS-13408: AWS EFS Cross Account Support with ROSA Classic/HCP Cluster
Author: login: fmcdonal
Labels: name: peer-review-needed
description: Signifies that the peer review team needs to review this PR
name: lgtm
description: Indicates that a PR is ready to be merged.
name: size/L
description: Denotes a PR that changes 100-499 lines, ignoring generated files.
name: jira/valid-reference
description: Indicates that this PR references a valid Jira ticket of any type.
name: branch/enterprise-4.18
name: branch/enterprise-4.19
Created: 2025-02-20T19:40:02Z | Merged: 2025-04-15T12:31:05Z

Version(s):
4.18

Issue:
https://issues.redhat.com/browse/OSDOCS-13408

Link to docs preview:
Previews here
ROSA: https://89008--ocpdocs-pr.netlify.app/openshift-rosa/latest/storage/container_storage_interface/persistent-storage-csi-aws-efs#persistent-storage-csi-efs-cross-account_persistent-storage-csi-aws-efs
HCP: https://89008--ocpdocs-pr.netlify.app/openshift-rosa-hcp/latest/storage/container_storage_interface/persistent-storage-csi-aws-efs.html#persistent-storage-csi-efs-cross-account_persistent-storage-csi-aws-efs

QE review:
- [ ] QE has approved this change.
<!--- QE approval is required to merge a PR except for changes that do not impact the meaning of the docs. --->



Diff:
diff --git a/modules/persistent-storage-csi-efs-cross-account.adoc b/modules/persistent-storage-csi-efs-cross-account.adoc
index 8aed1be99d63..3ef7820fc51b 100644
--- a/modules/persistent-storage-csi-efs-cross-account.adoc
+++ b/modules/persistent-storage-csi-efs-cross-account.adoc
@@ -7,7 +7,7 @@
 [id="persistent-storage-csi-efs-cross-account_{context}"]
 = AWS EFS CSI cross account support
 
-Cross account support allows you to have an {product-title} cluster in one AWS account and mount your file system in another AWS account using the AWS Elastic File System (EFS) Container Storage Interface (CSI) driver.
+Cross account support allows you to have an {product-title} cluster in one AWS account and mount your file system in another AWS account by using the AWS Elastic File System (EFS) Container Storage Interface (CSI) driver.
 
 [NOTE]
 ====
@@ -60,7 +60,7 @@ To use AWS EFS across accounts:
 
 .. Find the Security Group used by the AWS EFS volume by filtering for the group ID copied earlier.
 
-.. On the *Inbound rules* tab, click  *Edit inbound rules*, and then add a new rule to allow {product-title} nodes to access the AWS EFS volumes (that is, use NFS ports from the cluster):
+.. On the *Inbound rules* tab, click *Edit inbound rules*, and then add a new rule to allow {product-title} nodes to access the AWS EFS volumes (that is, use NFS ports from the cluster):
 +
 * *Type*: NFS
 * *Protocol*: TCP
@@ -68,6 +68,7 @@ To use AWS EFS across accounts:
 * *Source*: Custom/IP address range of your {product-title} cluster nodes (for example, “10.0.0.0/16”)
 
 .. Save the rule.
+
 +
 [NOTE]
 ====
@@ -105,41 +106,336 @@ Ensure the two VPCs are using different network CIDRs, and after creating the VP
 ... Under *Destination*, enter the CIDR for the VPC in account B, which for this example is 172.20.0.0/16.
 
 ... Under *Target*, use the peer connection type point from the created peer connection.
+// this is where the changes for ROSA starts to line 396
+ifdef::openshift-rosa,openshift-rosa-hcp[]
+. Prepare the **AWS account A** IAM roles and policies.
++
+[NOTE]
+====
+This process requires **two separate** AWS accounts.
+====
+
+.. Create an IAM policy for the EFS CSI driver.
 
-. Create an IAM role, for example, “my-efs-acrossaccount-role” in AWS account B, which has a trust relationship with AWS account A, and add an inline AWS EFS policy with permissions to call “my-efs-acrossaccount-driver-policy”.
 +
-This role is used by the CSI driver's controller service running on the {product-title} cluster in AWS account A to determine the mount targets for your file system in AWS account B.
+[NOTE]
+====
+This has additional permission's compared to a single account EFS CSI policy.
+====
+
 +
 [source, json]
 ----
-# Trust relationships trusted entity trusted account A configuration on my-efs-acrossaccount-role in account B
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "elasticfilesystem:DescribeAccessPoints",
+                "elasticfilesystem:DescribeFileSystems",
+                "elasticfilesystem:DescribeMountTargets",
+                "elasticfilesystem:TagResource",
+                "elasticfilesystem:ClientMount",
+                "elasticfilesystem:ClientRootAccess",
+                "elasticfilesystem:ClientWrite",
+                "elasticfilesystem:DescribeMountTargets",
+                "ec2:DescribeAvailabilityZones"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Effect": "Allow",
+            "Action": [
+                "elasticfilesystem:CreateAccessPoint"
+            ],
+            "Resource": "*",
+            "Condition": {
+                "StringLike": {
+                    "aws:RequestTag/efs.csi.aws.com/cluster": "true"
+                }
+            }
+        },
+        {
+            "Effect": "Allow",
+            "Action": "elasticfilesystem:DeleteAccessPoint",
+            "Resource": "*",
+            "Condition": {
+                "StringEquals": {
+                    "aws:ResourceTag/efs.csi.aws.com/cluster": "true"
+                }
+            }
+        },
+        {
+            "Effect": "Allow",
+            "Action": "sts:AssumeRole",
+            "Resource": "arn:aws:iam::${AWS_ACCOUNT_B_ID}:role/cross-account-efs-role"
+        }
+    ]
+}
+----
+
+.. Create the policy.
++
+[source,terminal]
+----
+$ aws iam create-policy --policy-name "${CLUSTER_NAME}-rosa-efs-csi" \
+   --policy-document file://<path-to-file>.json \
+   --query 'Policy.Arn' --output text
+----
 
+.. Create a trust policy.
++
+[source, json]
+----
 {
     "Version": "2012-10-17",
     "Statement": [
         {
             "Effect": "Allow",
             "Principal": {
-                "AWS": "arn:aws:iam::301721915996:root"
+                "Federated": "arn:aws:iam::${AWS_ACCOUNT_A_ID}:oidc-provider/${OIDC_PROVIDER}"
             },
-            "Action": "sts:AssumeRole",
-            "Condition": {}
+            "Action": "sts:AssumeRoleWithWebIdentity",
+            "Condition": {
+                "StringEquals": {
+                    "${OIDC_PROVIDER}:sub": [
+                        "system:serviceaccount:openshift-cluster-csi-drivers:aws-efs-csi-driver-operator",
+                        "system:serviceaccount:openshift-cluster-csi-drivers:aws-efs-csi-driver-controller-sa"
+                    ]
+                }
+            }
         }
     ]
 }
+----
 
-# my-cross-account-assume-policy policy attached to my-efs-acrossaccount-role in account B
+.. Create a role for the EFS CSI Driver Operator.
++
+[source, terminal]
+----
+$ aws iam create-role \
+  --role-name "${CLUSTER_NAME}-aws-efs-csi-operator" \
+  --assume-role-policy-document file://<path-to-file>.json \
+  --query "Role.Arn" --output text
+----
 
+.. Attach the policies to the role.
++
+[source, terminal]
+----
+$ aws iam attach-role-policy \
+   --role-name "${CLUSTER_NAME}-aws-efs-csi-operator" \
+   --policy-arn ${ACCOUNT_A_POLICY_ARN}
+----
+
++
+This role that the EFS CSI controller uses can now assume a role inside account B.
+
+. Prepare the **AWS account B** IAM roles and policies.
+
+.. Create an IAM policy.
++
+[source, json]
+----
 {
     "Version": "2012-10-17",
-    "Statement": {
-        "Effect": "Allow",
-        "Action": "sts:AssumeRole",
-        "Resource": "arn:aws:iam::589722580343:role/my-efs-acrossaccount-role"
-    }
+    "Statement": [
+        {
+            "Sid": "VisualEditor0",
+            "Effect": "Allow",
+            "Action": [
+                "ec2:DescribeNetworkInterfaces",
+                "ec2:DescribeSubnets"
+            ],
+            "Resource": "*"
+        },
+        {
+            "Sid": "VisualEditor1",
+            "Effect": "Allow",
+            "Action": [
+                "elasticfilesystem:DescribeMountTargets",
+                "elasticfilesystem:DeleteAccessPoint",
+                "elasticfilesystem:ClientMount",
+                "elasticfilesystem:DescribeAccessPoints",
+                "elasticfilesystem:ClientWrite",
+                "elasticfilesystem:ClientRootAccess",
+                "elasticfilesystem:DescribeFileSystems",
+                "elasticfilesystem:CreateAccessPoint",
+                "elasticfilesystem:TagResource"
+            ],
+            "Resource": "*"
+        }
+    ]
+}
+----
+
+.. Create the policy.
++
+[source,terminal]
+----
+$ aws iam create-policy --policy-name "cross-account-rosa-efs-csi" \
+   --policy-document file://<path-to-file>.json \
+   --query 'Policy.Arn' --output text
+----
+
+.. Create a trust policy.
++
+[source, json]
+----
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::${AWS_ACCOUNT_A_ID}:root"
+            },
+            "Action": "sts:AssumeRole",
+            "Condition": {}
+        }
+    ]
 }
+----
+
+.. Create the role for the EFS CSI Driver Operator to assume.
++
+[source,terminal]
+----
+$ aws iam create-role \
+  --role-name "cross-account-efs-role" \
+  --assume-role-policy-document file://<path-to-file>.json \
+  --query "Role.Arn" --output text
+----
+
+.. Attach the policies to the role.
++
+[source, terminal]
+----
+$ aws iam attach-role-policy \
+--role-name "cross-account-efs-role" \
+--policy-arn ${ACCOUNT_B_POLICY_ARN}
+----
+
+. Deploy the AWS EFS CSI Operator in **AWS account A**.
+
+.. Create a `secret` to tell the AWS EFS Operator which IAM role to request.
++
+[source, yaml]
+----
+apiVersion: v1
+kind: Secret
+metadata:
+ name: aws-efs-cloud-credentials
+ namespace: openshift-cluster-csi-drivers
+stringData:
+  credentials: |-
+    [default]
+    role_arn = ${ACCOUNT_A_ROLE_ARN}
+    web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
+----
+
+.. Install the EFS Operator.
++
+[source, yaml]
+----
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  generateName: openshift-cluster-csi-drivers-
+  namespace: openshift-cluster-csi-drivers
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  labels:
+    operators.coreos.com/aws-efs-csi-driver-operator.openshift-cluster-csi-drivers: ""
+  name: aws-efs-csi-driver-operator
+  namespace: openshift-cluster-csi-drivers
+spec:
+  channel: stable
+  installPlanApproval: Automatic
+  name: aws-efs-csi-driver-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace
+----
+
+.. Check if the operator is running.
++
+[source, terminal]
+----
+$ oc get deployment aws-efs-csi-driver-operator -n openshift-cluster-csi-drivers
+----
+
+.. Install the AWS EFS CSI driver.
++
+[source, yaml]
+----
+apiVersion: operator.openshift.io/v1
+kind: ClusterCSIDriver
+metadata:
+    name: efs.csi.aws.com
+spec:
+  managementState: Managed
+----
+
+.. Check if the CSI driver is running.
++
+[source, terminal]
+----
+$ oc get daemonset aws-efs-csi-driver-node -n openshift-cluster-csi-drivers
+----
+
+.. Create a new secret that will tell the CSI driver the role name in Account B to assume.
++
+[source, terminal]
+----
+$ oc create secret generic cross-account-arn \
+  -n openshift-cluster-csi-drivers \
+  --from-literal=awsRoleArn="arn:aws:iam::${AWS_ACCOUNT_B_ID}:role/cross-account-efs-role"
+----
+
+.. Allow the EFS CSI controller to read this secret.
++
+[source, terminal]
+----
+$ oc -n openshift-cluster-csi-drivers create role access-secrets --verb=get,list,watch --resource=secrets
+$ oc -n openshift-cluster-csi-drivers create rolebinding --role=access-secrets default-to-secrets --serviceaccount=openshift-cluster-csi-drivers:aws-efs-csi-driver-controller-sa
+----
+
+.. Create a storage class for the EFS volume.
++
+[source, yaml]
+----
+# The cross account efs volume storageClass
+kind: StorageClass
+apiVersion: storage.k8s.io/v1
+metadata:
+  name: efs-sc
+provisioner: efs.csi.aws.com
+parameters:
+  provisioningMode: efs-ap
+  fileSystemId: ${EFS_FILESYSTEM_ID}
+  directoryPerms: "700"
+  gidRangeStart: "1000"
+  gidRangeEnd: "2000"
+  basePath: "/dynamic_provisioning"
+  csi.storage.k8s.io/provisioner-secret-name: cross-account-arn
+  csi.storage.k8s.io/provisioner-secret-namespace: openshift-cluster-csi-drivers
+----
+endif::openshift-rosa,openshift-rosa-hcp[]
+
+// ROSA solution ends here
+
+ifdef::openshift-enterprise[]
 
-# my-efs-acrossaccount-driver-policy attached to my-efs-acrossaccount-role in account B
+. Create an IAM role, for example, “my-efs-acrossaccount-role” in AWS account B, which has a trust relationship with AWS account A, and add an inline AWS EFS policy with permissions to call “my-efs-acrossaccount-driver-policy”.
++
+This role is used by the CSI driver's controller service running on the {product-title} cluster in AWS account A to determine the mount targets for your file system in AWS account B.
++
+[source, json]
+----
+# Trust relationships trusted entity trusted account A configuration on my-efs-acrossaccount-role in account B
 
 {
     "Version": "2012-10-17",
@@ -210,11 +506,13 @@ $ oc -n openshift-cluster-csi-drivers create rolebinding --role=access-secrets d
 ----
 
 . Create a `filesystem` policy for the file system (AWS EFS volume) in account B, which allows AWS account A to perform a mount on it.
+
 +
 [NOTE]
-----
+====
 This step is not mandatory, but can be safer for AWS EFS volume usage.
-----
+====
+
 +
 [source, json]
 ----
@@ -266,23 +564,19 @@ This step is not mandatory, but can be safer for AWS EFS volume usage.
 kind: StorageClass
 apiVersion: storage.k8s.io/v1
 metadata:
-  name: efs-cross-account-mount-sc
+name: efs-cross-account-mount-sc
 provisioner: efs.csi.aws.com
 mountOptions:
-  - tls
+- tls
 parameters:
-  provisioningMode: efs-ap
-  fileSystemId: fs-00f6c3ae6f06388bb
-  directoryPerms: "700"
-  gidRangeStart: "1000"
-  gidRangeEnd: "2000"
-  basePath: "/account-a-data"
-  csi.storage.k8s.io/provisioner-secret-name: my-efs-cross-account
-  csi.storage.k8s.io/provisioner-secret-namespace: openshift-cluster-csi-drivers
+provisioningMode: efs-ap
+fileSystemId: fs-00f6c3ae6f06388bb
+directoryPerms: "700"
+gidRangeStart: "1000"
+gidRangeEnd: "2000"
+basePath: "/account-a-data"
+csi.storage.k8s.io/provisioner-secret-name: my-efs-cross-account
+csi.storage.k8s.io/provisioner-secret-namespace: openshift-cluster-csi-drivers
 volumeBindingMode: Immediate
 ----
-
-
-
-
-
+endif::openshift-enterprise[]
\ No newline at end of file
diff --git a/storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc b/storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc
index a38512dd8016..743e90678de3 100644
--- a/storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc
+++ b/storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc
@@ -70,11 +70,9 @@ include::modules/persistent-storage-csi-efs-driver-install.adoc[leveloffset=+2]
 include::modules/storage-create-storage-class.adoc[leveloffset=+1]
 include::modules/storage-create-storage-class-console.adoc[leveloffset=+2]
 include::modules/storage-create-storage-class-cli.adoc[leveloffset=+2]
-
-ifndef::openshift-dedicated,openshift-rosa[]
+ifndef::openshift-dedicated[]
 include::modules/persistent-storage-csi-efs-cross-account.adoc[leveloffset=+1]
-endif::openshift-dedicated,openshift-rosa[]
-
+endif::openshift-dedicated[]
 include::modules/persistent-storage-csi-efs-create-volume.adoc[leveloffset=+1]
 
 include::modules/persistent-storage-csi-dynamic-provisioning-aws-efs.adoc[leveloffset=+1]


Reviews:
user: login: arendej
body: In addition to some of the changes I've called out, all the policies should have proper json-like indentation.
It's odd that the preview shows indentation but the source does not.
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-11T23:16:17Z
user: login: fmcdonal
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T12:10:26Z
user: login: arendej
body: lgtm
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T14:29:53Z
user: login: EricPonvelle
body: Small suggestions
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T17:33:03Z
user: login: EricPonvelle
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T17:34:40Z
user: login: fmcdonal
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-14T18:41:12Z
user: login: EricPonvelle
body: /lgtm
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-15T12:30:53Z

Review comments:
diff_hunk: @@ -105,42 +107,133 @@ Ensure the two VPCs are using different network CIDRs, and after creating the VP
 ... Under *Destination*, enter the CIDR for the VPC in account B, which for this example is 172.20.0.0/16.
 
 ... Under *Target*, use the peer connection type point from the created peer connection.
+// this is where the changes for ROSA starts to line 396
+ifdef::openshift-rosa,openshift-rosa-hcp[]
+. Prepare the AWS account A IAM roles and policies:
+
+.. Create an IAM policy for the EFS CSI driver.
 
-. Create an IAM role, for example, “my-efs-acrossaccount-role” in AWS account B, which has a trust relationship with AWS account A, and add an inline AWS EFS policy with permissions to call “my-efs-acrossaccount-driver-policy”.
 +
-This role is used by the CSI driver's controller service running on the {product-title} cluster in AWS account A to determine the mount targets for your file system in AWS account B.
+[NOTE]
+====
+This has additional permission`s compared to a single account EFS CSI policy.
path: modules/persistent-storage-csi-efs-cross-account.adoc
user: login: arendej
body: that apostrophe looks out of place
created_at: 2025-04-11T23:11:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -164,30 +257,256 @@ This role is used by the CSI driver's controller service running on the {product
                 "elasticfilesystem:ClientWrite",
                 "elasticfilesystem:ClientRootAccess",
                 "elasticfilesystem:DescribeFileSystems",
-                "elasticfilesystem:CreateAccessPoint"
+                "elasticfilesystem:CreateAccessPoint",
+                "elasticfilesystem:TagResource"
             ],
-            "Resource": [
-                "arn:aws:elasticfilesystem:*:589722580343:access-point/*",
-                "arn:aws:elasticfilesystem:*:589722580343:file-system/*"
-            ]
+            "Resource": "*"
         }
     ]
 }
 ----
 
+.. Create the policy.
++
+[source, json]
+----
+aws iam create-policy --policy-name "cross-account-rosa-efs-csi" \
+   --policy-document file://<path-to-file>.json \
+   --query 'Policy.Arn' --output text
+----
+
+.. Create a trust policy.
++
+[source, json]
+----
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::${AWS_ACCOUNT_A_ID}:root"
+            },
+            "Action": "sts:AssumeRole",
+            "Condition": {}
+        }
+    ]
+}
+----
+
+.. Create the role for the EFS CSI Driver Operator to assume.
++
+[source, json]
+----
+aws iam create-role \
+  --role-name "cross-account-efs-role" \
+  --assume-role-policy-document file://<path-to-file>.json \
+  --query "Role.Arn" --output text
+----
+
+.. Attach the policies to the role.
++
+[source, json]
+----
+aws iam attach-role-policy \
+--role-name "cross-account-efs-role" \
+--policy-arn ${ACCOUNT_B_POLICY_ARN}
+----
+
+. Deploy the AWS EFS CSI operator.
+
+.. Create a `secret` to tell the AWS EFS Operator which IAM role to request.
++
+[source, json]
+----
+apiVersion: v1
+kind: Secret
+metadata:
+ name: aws-efs-cloud-credentials
+ namespace: openshift-cluster-csi-drivers
+stringData:
+  credentials: |-
+    [default]
+    role_arn = ${ACCOUNT_A_ROLE_ARN}
+    web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
+----
+
+.. Install the EFS Operator.
++
+[source, json]
+----
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  generateName: openshift-cluster-csi-drivers-
+  namespace: openshift-cluster-csi-drivers
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  labels:
+    operators.coreos.com/aws-efs-csi-driver-operator.openshift-cluster-csi-drivers: ""
+  name: aws-efs-csi-driver-operator
+  namespace: openshift-cluster-csi-drivers
+spec:
+  channel: stable
+  installPlanApproval: Automatic
+  name: aws-efs-csi-driver-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace
+----
+
+.. Check if the Operator is running.
++
+[source, json]
+----
+oc get deployment aws-efs-csi-driver-operator -n openshift-cluster-csi-drivers
+----
+
+.. Install the AWS EFS CSI driver.
++
+[source, json]
+----
+apiVersion: operator.openshift.io/v1
+kind: ClusterCSIDriver
+metadata:
+    name: efs.csi.aws.com
+spec:
+  managementState: Managed
+----
+
+.. Check if the CSI driver is running.
++
+[source, json]
+----
+oc get daemonset aws-efs-csi-driver-node -n openshift-cluster-csi-drivers
+----
+
+.. Create a new secret that will tell the CSI Driver the role name in Account B to assume.
path: modules/persistent-storage-csi-efs-cross-account.adoc
user: login: arendej
body: Driver is not a proper name. Can be lower-case.
created_at: 2025-04-11T23:12:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -164,30 +257,256 @@ This role is used by the CSI driver's controller service running on the {product
                 "elasticfilesystem:ClientWrite",
                 "elasticfilesystem:ClientRootAccess",
                 "elasticfilesystem:DescribeFileSystems",
-                "elasticfilesystem:CreateAccessPoint"
+                "elasticfilesystem:CreateAccessPoint",
+                "elasticfilesystem:TagResource"
             ],
-            "Resource": [
-                "arn:aws:elasticfilesystem:*:589722580343:access-point/*",
-                "arn:aws:elasticfilesystem:*:589722580343:file-system/*"
-            ]
+            "Resource": "*"
         }
     ]
 }
 ----
 
+.. Create the policy.
++
+[source, json]
+----
+aws iam create-policy --policy-name "cross-account-rosa-efs-csi" \
+   --policy-document file://<path-to-file>.json \
+   --query 'Policy.Arn' --output text
+----
+
+.. Create a trust policy.
++
+[source, json]
+----
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {
+                "AWS": "arn:aws:iam::${AWS_ACCOUNT_A_ID}:root"
+            },
+            "Action": "sts:AssumeRole",
+            "Condition": {}
+        }
+    ]
+}
+----
+
+.. Create the role for the EFS CSI Driver Operator to assume.
++
+[source, json]
+----
+aws iam create-role \
+  --role-name "cross-account-efs-role" \
+  --assume-role-policy-document file://<path-to-file>.json \
+  --query "Role.Arn" --output text
+----
+
+.. Attach the policies to the role.
++
+[source, json]
+----
+aws iam attach-role-policy \
+--role-name "cross-account-efs-role" \
+--policy-arn ${ACCOUNT_B_POLICY_ARN}
+----
+
+. Deploy the AWS EFS CSI operator.
+
+.. Create a `secret` to tell the AWS EFS Operator which IAM role to request.
++
+[source, json]
+----
+apiVersion: v1
+kind: Secret
+metadata:
+ name: aws-efs-cloud-credentials
+ namespace: openshift-cluster-csi-drivers
+stringData:
+  credentials: |-
+    [default]
+    role_arn = ${ACCOUNT_A_ROLE_ARN}
+    web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
+----
+
+.. Install the EFS Operator.
++
+[source, json]
+----
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  generateName: openshift-cluster-csi-drivers-
+  namespace: openshift-cluster-csi-drivers
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  labels:
+    operators.coreos.com/aws-efs-csi-driver-operator.openshift-cluster-csi-drivers: ""
+  name: aws-efs-csi-driver-operator
+  namespace: openshift-cluster-csi-drivers
+spec:
+  channel: stable
+  installPlanApproval: Automatic
+  name: aws-efs-csi-driver-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace
+----
+
+.. Check if the Operator is running.
path: modules/persistent-storage-csi-efs-cross-account.adoc
user: login: arendej
body: I don't think Operator is a proper noun here
created_at: 2025-04-11T23:14:15Z
author_association: CONTRIBUTOR
diff_hunk: @@ -105,42 +107,133 @@ Ensure the two VPCs are using different network CIDRs, and after creating the VP
 ... Under *Destination*, enter the CIDR for the VPC in account B, which for this example is 172.20.0.0/16.
 
 ... Under *Target*, use the peer connection type point from the created peer connection.
+// this is where the changes for ROSA starts to line 396
+ifdef::openshift-rosa,openshift-rosa-hcp[]
+. Prepare the AWS account A IAM roles and policies:
+
+.. Create an IAM policy for the EFS CSI driver.
 
-. Create an IAM role, for example, “my-efs-acrossaccount-role” in AWS account B, which has a trust relationship with AWS account A, and add an inline AWS EFS policy with permissions to call “my-efs-acrossaccount-driver-policy”.
 +
-This role is used by the CSI driver's controller service running on the {product-title} cluster in AWS account A to determine the mount targets for your file system in AWS account B.
+[NOTE]
+====
+This has additional permission`s compared to a single account EFS CSI policy.
path: modules/persistent-storage-csi-efs-cross-account.adoc
user: login: fmcdonal
body: resolved, this is an OCP doc and must not have been captured before thanks
created_at: 2025-04-14T12:10:26Z
author_association: CONTRIBUTOR
diff_hunk: @@ -7,8 +7,9 @@
 [id="persistent-storage-csi-efs-cross-account_{context}"]
 = AWS EFS CSI cross account support
 
-Cross account support allows you to have an {product-title} cluster in one AWS account and mount your file system in another AWS account using the AWS Elastic File System (EFS) Container Storage Interface (CSI) driver.
+Cross account support allows you to have an {product-title} cluster in one AWS account and mount your file system in another AWS account by using the AWS Elastic File System (EFS) Container Storage Interface (CSI) driver.
 
++
path: modules/persistent-storage-csi-efs-cross-account.adoc
user: login: EricPonvelle
body: Remove this `+`. You can only use the `+` if the paragraph is formatted. But also, you cannot have a line break.

![image](https://github.com/user-attachments/assets/450d104f-dd55-4bcd-8831-c670422498ab)

created_at: 2025-04-14T16:22:30Z
author_association: CONTRIBUTOR
diff_hunk: @@ -105,41 +107,331 @@ Ensure the two VPCs are using different network CIDRs, and after creating the VP
 ... Under *Destination*, enter the CIDR for the VPC in account B, which for this example is 172.20.0.0/16.
 
 ... Under *Target*, use the peer connection type point from the created peer connection.
+// this is where the changes for ROSA starts to line 396
+ifdef::openshift-rosa,openshift-rosa-hcp[]
+. Prepare the AWS account A IAM roles and policies:
path: modules/persistent-storage-csi-efs-cross-account.adoc
user: login: EricPonvelle
body: ```suggestion
. Prepare the **AWS account A IAM roles** and policies:
```

I think you need to specify these roles differently. It looks like a typo on my first pass, maybe bold all of the "Account A" and "Account B" titles to stand out a bit better?
created_at: 2025-04-14T16:39:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -105,41 +107,331 @@ Ensure the two VPCs are using different network CIDRs, and after creating the VP
 ... Under *Destination*, enter the CIDR for the VPC in account B, which for this example is 172.20.0.0/16.
 
 ... Under *Target*, use the peer connection type point from the created peer connection.
+// this is where the changes for ROSA starts to line 396
+ifdef::openshift-rosa,openshift-rosa-hcp[]
+. Prepare the AWS account A IAM roles and policies:
path: modules/persistent-storage-csi-efs-cross-account.adoc
user: login: EricPonvelle
body: See this page for examples of how we make the two accounts VERY clear: https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/install_rosa_classic_clusters/rosa-shared-vpc-config#rosa-shared-vpc-config
created_at: 2025-04-14T17:34:40Z
author_association: CONTRIBUTOR
diff_hunk: @@ -105,41 +107,331 @@ Ensure the two VPCs are using different network CIDRs, and after creating the VP
 ... Under *Destination*, enter the CIDR for the VPC in account B, which for this example is 172.20.0.0/16.
 
 ... Under *Target*, use the peer connection type point from the created peer connection.
+// this is where the changes for ROSA starts to line 396
+ifdef::openshift-rosa,openshift-rosa-hcp[]
+. Prepare the AWS account A IAM roles and policies:
path: modules/persistent-storage-csi-efs-cross-account.adoc
user: login: fmcdonal
body: Thanks for suggestion, bolded..
created_at: 2025-04-14T18:41:12Z
author_association: CONTRIBUTOR

PR comments:
user: login: openshift-ci-robot
created_at: 2025-02-20T19:40:06Z
body: @fmcdonal: This pull request references [OSDOCS-13408](https://issues.redhat.com//browse/OSDOCS-13408) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/89008):

>Version(s):
>4.17
>
>Issue:
>https://issues.redhat.com/browse/OSDOCS-13408
>
>Link to docs preview:
><!--- Add direct link(s) to the exact page(s) with updated content from the preview build. --->
>
>QE review:
>- [ ] QE has approved this change.
><!--- QE approval is required to merge a PR except for changes that do not impact the meaning of the docs. --->
>


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fopenshift-docs).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: ocpdocs-previewbot
created_at: 2025-02-20T19:57:16Z
body: 🤖 Tue Apr 15 10:48:53 - Prow CI generated the docs preview:

https://89008--ocpdocs-pr.netlify.app/openshift-dedicated/latest/storage/container_storage_interface/persistent-storage-csi-aws-efs.html
https://89008--ocpdocs-pr.netlify.app/openshift-enterprise/latest/storage/container_storage_interface/persistent-storage-csi-aws-efs.html
https://89008--ocpdocs-pr.netlify.app/openshift-rosa-hcp/latest/storage/container_storage_interface/persistent-storage-csi-aws-efs.html
https://89008--ocpdocs-pr.netlify.app/openshift-rosa/latest/storage/container_storage_interface/persistent-storage-csi-aws-efs.html
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-04-11T20:08:46Z
body: @fmcdonal: This pull request references [OSDOCS-13408](https://issues.redhat.com//browse/OSDOCS-13408) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/89008):

>Version(s):
>4.17+
>
>Issue:
>https://issues.redhat.com/browse/OSDOCS-13408
>
>Link to docs preview:
><!--- Add direct link(s) to the exact page(s) with updated content from the preview build. --->
>
>QE review:
>- [ ] QE has approved this change.
><!--- QE approval is required to merge a PR except for changes that do not impact the meaning of the docs. --->
>


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fopenshift-docs).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: openshift-ci-robot
created_at: 2025-04-14T11:26:10Z
body: @fmcdonal: This pull request references [OSDOCS-13408](https://issues.redhat.com//browse/OSDOCS-13408) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/89008):

>Version(s):
>4.17+
>
>Issue:
>https://issues.redhat.com/browse/OSDOCS-13408
>
>Link to docs preview:
>Previews here
>ROSA: https://89008--ocpdocs-pr.netlify.app/openshift-rosa/latest/storage/container_storage_interface/persistent-storage-csi-aws-efs#persistent-storage-csi-efs-cross-account_persistent-storage-csi-aws-efs
>HCP: https://89008--ocpdocs-pr.netlify.app/openshift-rosa-hcp/latest/storage/container_storage_interface/persistent-storage-csi-aws-efs.html#persistent-storage-csi-efs-cross-account_persistent-storage-csi-aws-efs
>
>QE review:
>- [ ] QE has approved this change.
><!--- QE approval is required to merge a PR except for changes that do not impact the meaning of the docs. --->
>


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fopenshift-docs).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: fmcdonal
created_at: 2025-04-14T15:04:48Z
body: @arendej thanks for your effort, the comments about json indentation was applicable to the OCP part of the source and not ROSA but I resolved them as part of this PR also, thanks for highlighting
author_association: CONTRIBUTOR
user: login: fmcdonal
created_at: 2025-04-14T16:28:18Z
body: /label peer-review-needed
author_association: CONTRIBUTOR
user: login: openshift-ci-robot
created_at: 2025-04-14T16:37:05Z
body: @fmcdonal: This pull request references [OSDOCS-13408](https://issues.redhat.com//browse/OSDOCS-13408) which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/89008):

>Version(s):
>4.18
>
>Issue:
>https://issues.redhat.com/browse/OSDOCS-13408
>
>Link to docs preview:
>Previews here
>ROSA: https://89008--ocpdocs-pr.netlify.app/openshift-rosa/latest/storage/container_storage_interface/persistent-storage-csi-aws-efs#persistent-storage-csi-efs-cross-account_persistent-storage-csi-aws-efs
>HCP: https://89008--ocpdocs-pr.netlify.app/openshift-rosa-hcp/latest/storage/container_storage_interface/persistent-storage-csi-aws-efs.html#persistent-storage-csi-efs-cross-account_persistent-storage-csi-aws-efs
>
>QE review:
>- [ ] QE has approved this change.
><!--- QE approval is required to merge a PR except for changes that do not impact the meaning of the docs. --->
>


Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fopenshift-docs).  If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
</details>
author_association: NONE
user: login: rhn-support-pmagotra
created_at: 2025-04-15T10:49:31Z
body: LGTM
author_association: NONE
user: login: openshift-ci[bot]
created_at: 2025-04-15T10:49:43Z
body: @fmcdonal: all tests **passed!**


[Full PR test history](https://prow.ci.openshift.org/pr-history?org=openshift&repo=openshift-docs&pr=89008). [Your PR dashboard](https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:fmcdonal).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
author_association: NONE
user: login: EricPonvelle
created_at: 2025-04-15T12:31:17Z
body: /cherrypick enterprise-4.18
author_association: CONTRIBUTOR
user: login: EricPonvelle
created_at: 2025-04-15T12:31:22Z
body: /cherrypick enterprise-4.19
author_association: CONTRIBUTOR
user: login: openshift-cherrypick-robot
created_at: 2025-04-15T12:32:14Z
body: @EricPonvelle: new pull request created: #92187

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/89008#issuecomment-2804896103):

>/cherrypick enterprise-4.18


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: openshift-cherrypick-robot
created_at: 2025-04-15T12:32:17Z
body: @EricPonvelle: new pull request created: #92188

<details>

In response to [this](https://github.com/openshift/openshift-docs/pull/89008#issuecomment-2804896349):

>/cherrypick enterprise-4.19


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE