Chapter 4. Tutorial: Verifying permissions for a ROSA STS deployment To proceed with the deployment of a ROSA cluster, an account must support the required roles and permissions. AWS Service Control Policies (SCPs) cannot block the API calls made by the installer or Operator roles. Details about the IAM resources required for an STS-enabled installation of ROSA can be found here: About IAM resources Details about the IAM resources required for an STS-enabled installation of ROSA can be found here: About IAM resources for ROSA clusters that use STS This guide is validated for ROSA v4.11.X. 4.1. Prerequisites AWS CLI ROSA CLI v1.2.6 jq CLI AWS role with required permissions 4.2. Verifying ROSA permissions To verify the permissions required for ROSA, we can run the script included in the following section without ever creating any AWS resources. The script uses the rosa , aws , and jq CLI commands to create files in the working directory that will be used to verify permissions in the account connected to the current AWS configuration. The AWS Policy Simulator is used to verify the permissions of each role policy against the API calls extracted by jq ; results are then stored in a text file appended with .results . This script is designed to verify the permissions for the current account and region. 4.3. Usage Instructions To use the script, run the following commands in a bash terminal (the -p option defines a prefix for the roles): USD mkdir scratch USD cd scratch USD cat << 'EOF' > verify-permissions.sh #!/bin/bash while getopts 'p:' OPTION; do case "USDOPTION" in p) PREFIX="USDOPTARG" ;; ?) echo "script usage: USD(basename \USD0) [-p PREFIX]" >&2 exit 1 ;; esac done shift "USD((USDOPTIND -1))" rosa create account-roles --mode manual --prefix USDPREFIX INSTALLER_POLICY=USD(cat sts_installer_permission_policy.json | jq ) CONTROL_PLANE_POLICY=USD(cat sts_instance_controlplane_permission_policy.json | jq) WORKER_POLICY=USD(cat sts_instance_worker_permission_policy.json | jq) SUPPORT_POLICY=USD(cat sts_support_permission_policy.json | jq) simulatePolicy () { outputFile="USD{2}.results" echo USD2 aws iam simulate-custom-policy --policy-input-list "USD1" --action-names USD(jq '.Statement | map(select(.Effect == "Allow"))[].Action | if type == "string" then . else .[] end' "USD2" -r) --output text > USDoutputFile } simulatePolicy "USDINSTALLER_POLICY" "sts_installer_permission_policy.json" simulatePolicy "USDCONTROL_PLANE_POLICY" "sts_instance_controlplane_permission_policy.json" simulatePolicy "USDWORKER_POLICY" "sts_instance_worker_permission_policy.json" simulatePolicy "USDSUPPORT_POLICY" "sts_support_permission_policy.json" EOF USD chmod +x verify-permissions.sh USD ./verify-permissions.sh -p SimPolTest After the script completes, review each results file to ensure that none of the required API calls are blocked: USD for file in USD(ls *.results); do echo USDfile; cat USDfile; done The output will look similar to the following: sts_installer_permission_policy.json.results EVALUATIONRESULTS autoscaling:DescribeAutoScalingGroups allowed * MATCHEDSTATEMENTS PolicyInputList.1 IAM Policy ENDPOSITION 6 195 STARTPOSITION 17 3 EVALUATIONRESULTS ec2:AllocateAddress allowed * MATCHEDSTATEMENTS PolicyInputList.1 IAM Policy ENDPOSITION 6 195 STARTPOSITION 17 3 EVALUATIONRESULTS ec2:AssociateAddress allowed * MATCHEDSTATEMENTS PolicyInputList.1 IAM Policy ... Note If any actions are blocked, review the error provided by AWS and consult with your Administrator to determine if SCPs are blocking the required API calls.

Commands:
mkdir scratch cd scratch cat << 'EOF' > verify-permissions.sh #!/bin/bash while getopts 'p:' OPTION; do case "USDOPTION" in p) PREFIX="USDOPTARG" ;; ?) echo "script usage: USD(basename \USD0) [-p PREFIX]" >&2 exit 1 ;; esac done shift "USD((USDOPTIND -1))" rosa create account-roles --mode manual --prefix USDPREFIX INSTALLER_POLICY=USD(cat sts_installer_permission_policy.json | jq ) CONTROL_PLANE_POLICY=USD(cat sts_instance_controlplane_permission_policy.json | jq) WORKER_POLICY=USD(cat sts_instance_worker_permission_policy.json | jq) SUPPORT_POLICY=USD(cat sts_support_permission_policy.json | jq) simulatePolicy () { outputFile="USD{2}.results" echo USD2 aws iam simulate-custom-policy --policy-input-list "USD1" --action-names USD(jq '.Statement | map(select(.Effect == "Allow"))[].Action | if type == "string" then . else .[] end' "USD2" -r) --output text > USDoutputFile } simulatePolicy "USDINSTALLER_POLICY" "sts_installer_permission_policy.json" simulatePolicy "USDCONTROL_PLANE_POLICY" "sts_instance_controlplane_permission_policy.json" simulatePolicy "USDWORKER_POLICY" "sts_instance_worker_permission_policy.json" simulatePolicy "USDSUPPORT_POLICY" "sts_support_permission_policy.json" EOF chmod +x verify-permissions.sh ./verify-permissions.sh -p SimPolTest
for file in USD(ls *.results); do echo USDfile; cat USDfile; done
sts_installer_permission_policy.json.results EVALUATIONRESULTS autoscaling:DescribeAutoScalingGroups allowed * MATCHEDSTATEMENTS PolicyInputList.1 IAM Policy ENDPOSITION 6 195 STARTPOSITION 17 3 EVALUATIONRESULTS ec2:AllocateAddress allowed * MATCHEDSTATEMENTS PolicyInputList.1 IAM Policy ENDPOSITION 6 195 STARTPOSITION 17 3 EVALUATIONRESULTS ec2:AssociateAddress allowed * MATCHEDSTATEMENTS PolicyInputList.1 IAM Policy