Permission requirements for your cloud account
Code Pipes uses your cloud resources (GCP, AWS, etc.) to deploy your infrastructure and applications.
In order to let Code Pipes use these resources, you need to create a cloud account for Code Pipes to use on your behalf, and then set certain permissions, as described below.
GCP
Enable these APIs:
-
Cloud Build API
-
Cloud Resource Manager API
-
Cloud Key Management Service (KMS) API
-
Cloud Pub/Sub API
-
Cloud Build API
Set these permissions on your user service account:
-
Cloud KMS CryptoKey Encrypter/Decrypter
-
Editor
Set these permissions on your Cloud Build service account:
- Cloud KMS CryptoKey Decrypter
For the Code Pipes serverless demo, you also need:
- Cloud Run Admin
AWS
Create an IAM user with access and secret keys.
Add these permissions:
-
AmazonS3FullAccess
-
SecretsManagerReadWrite
-
AmazonSNSFullAccess policy
-
CloudWatchEventsFullAccess
-
Add AmazonSQSFullAccess
-
Add IAMFullAccess
-
AWSCodeBuildAdminAccess
-
AmazonElasticContainerRegistryPublicReadOnly
For the Code Pipes serverless demo, you also need this permission:
- AWSAppRunnerFullAccess
Required AWS permissions for Kubernetes deployments
The following permissions are needed by TF EKS:
-
AWS Auth Configmap to provide access to worker nodes
-
Cluster Role and Policies
-
Node Role and Policies
Edit aws-auth ConfigMap to provide access to worker nodes
When you create an Amazon EKS cluster, to grant AWS users or roles the ability to interact with your cluster, you need to edit the aws-auth ConfigMap within Kubernetes and create a Kubernetes rolebinding or clusterrolebinding with the name of a group that you specify in the aws-auth ConfigMap.
Since the EKS service does not provide a cluster-level API parameter or resource to automatically configure the underlying Kubernetes cluster you need to allow worker nodes to join the cluster via AWS IAM role authentication.
To do this, add the worker and cluster role arn in your aws-auth configmap:
{
rolearn : role_arn
username : "${role_arn}-user"
groups : ["system:bootstrappers", "system:masters"]
}
Cluster role and policies
Kubernetes clusters managed by Amazon EKS make calls to other AWS services on your behalf to manage the resources that you use with the service. For that, you need to create the cluster role policy.
The following policy is added when you create your clusters. This allows you to assume a role for the EKS service, and allows authenticated users (via root) in your account to be able to access the cluster.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "eks.amazonaws.com"
},
"Action": "sts:AssumeRole"
},
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
},
"Action": "sts:AssumeRole"
}
]
}
You also need to attach the following policies to the cluster, so that the cluster can perform EKS and Load Balancer related actions:
"arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
"arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
"arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
"arn:aws:iam::aws:policy/AmazonVPCFullAccess"
Node role and policies
The Amazon EKS node kubelet daemon makes calls to AWS APIs on your behalf.
Nodes receive permissions for these API calls through an IAM instance profile and associated policies.
Before you can launch nodes and register them into a cluster, you must create an IAM role for those nodes to use when they are launched. This requirement applies to nodes launched with the Amazon EKS optimized AMI provided by Amazon, or with any other node AMIs that you intend to use.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
You also attach the following policies to the node for it to perform EC2 and Load Balancer related activities:
"arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
"arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
"arn:aws:iam::aws:policy/AmazonVPCFullAccess"
You can also create and attach an AWS Load Balancer Controller policy that manages AWS Elastic Load Balancers for a Kubernetes cluster. The controller provisions the following resources:
-
An AWS Application Load Balancer (ALB) when you create a Kubernetes Ingress.
-
An AWS Network Load Balancer (NLB) when you create a Kubernetes service of type LoadBalancer. In the past, the Kubernetes in-tree load balancer was used for instance targets, but the AWS Load balancer Controller was used for IP targets. With the AWS Load Balancer Controller version 2.3.0 or later, you can create Network Load Balancers using either target type. For more information about NLB target types, see Target type in the User Guide for Network Load Balancers.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInternetGateways",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeInstances",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeTags",
"ec2:GetCoipPoolUsage",
"ec2:DescribeCoipPools",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeListenerCertificates",
"elasticloadbalancing:DescribeSSLPolicies",
"elasticloadbalancing:DescribeRules",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:DescribeTags",
"route53:ListHostedZones",
"route53:ListResourceRecordSets",
"route53:ChangeResourceRecordSets"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cognito-idp:DescribeUserPoolClient",
"acm:ListCertificates",
"acm:DescribeCertificate",
"iam:ListServerCertificates",
"iam:GetServerCertificate",
"waf-regional:GetWebACL",
"waf-regional:GetWebACLForResource",
"waf-regional:AssociateWebACL",
"waf-regional:DisassociateWebACL",
"wafv2:GetWebACL",
"wafv2:GetWebACLForResource",
"wafv2:AssociateWebACL",
"wafv2:DisassociateWebACL",
"shield:GetSubscriptionState",
"shield:DescribeProtection",
"shield:CreateProtection",
"shield:DeleteProtection"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupIngress"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"StringEquals": {
"ec2:CreateAction": "CreateSecurityGroup"
},
"Null": {
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"Null": {
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupIngress",
"ec2:DeleteSecurityGroup"
],
"Resource": "*",
"Condition": {
"Null": {
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
}
}
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:CreateTargetGroup"
],
"Resource": "*",
"Condition": {
"Null": {
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
}
}
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:CreateRule",
"elasticloadbalancing:DeleteRule"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags"
],
"Resource": [
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
],
"Condition": {
"Null": {
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
}
}
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags"
],
"Resource": [
"arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
"arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:SetIpAddressType",
"elasticloadbalancing:SetSecurityGroups",
"elasticloadbalancing:SetSubnets",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:DeleteTargetGroup"
],
"Resource": "*",
"Condition": {
"Null": {
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
}
}
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets"
],
"Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:SetWebAcl",
"elasticloadbalancing:ModifyListener",
"elasticloadbalancing:AddListenerCertificates",
"elasticloadbalancing:RemoveListenerCertificates",
"elasticloadbalancing:ModifyRule"
],
"Resource": "*"
}
]
}
POLICY
}
resource "aws_iam_role_policy_attachment" "node-AWSLoadBalancerControllerIAMPolicy" {
policy_arn = aws_iam_policy.AWSLoadBalancerControllerIAMPolicy.arn
role = aws_iam_role.node.name
}
resource "aws_iam_policy" "AWSVisualEditorPolicy" {
name = "AWSVisualEditorPolicy-${random_string.role.id}"
path = "/"
description = "Policy for AWS Load Balancer Controller for k8s Ingress"
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "eks:*",
"Resource": "*"
}
]
}
Updated about 1 year ago