AWS managed policies for ROSA

An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.

Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they’re available for all AWS customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.

You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services. For more information, see AWS managed policies in the IAM User Guide.

AWS managed policy: ROSAManageSubscription

You can attach the ROSAManageSubscription policy to your IAM entities. Before you enable ROSA in the AWS ROSA console, you must first attach this policy to a console role.

This policy grants the AWS Marketplace permissions required for you to manage the ROSA subscription.

Permissions details

This policy includes the following permissions.

To view the full JSON policy document, see ROSAManageSubscription in the AWS Managed Policy Reference Guide.

ROSA with HCP account policies

This section provides details about the account policies that are required for ROSA with hosted control planes (HCP). These AWS managed policies add permissions used by ROSA with HCP IAM roles. The permissions are required for Red Hat site reliability engineering (SRE) technical support, cluster installation, and control plane and compute functionality.

AWS managed policy: ROSAWorkerInstancePolicy

You can attach ROSAWorkerInstancePolicy to your IAM entities. Before you create a ROSA with hosted control planes cluster, you must first attach this policy to a worker IAM role.

Permissions details

This policy includes the following permissions that allow the ROSA service to complete the following tasks:

To view the full JSON policy document, see ROSAWorkerInstancePolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: ROSASRESupportPolicy

You can attach ROSASRESupportPolicy to your IAM entities.

Before you create a ROSA with hosted control planes cluster, you must first attach this policy to a support IAM role. This policy grants required permissions to Red Hat site reliability engineers (SREs) to directly observe, diagnose, and support AWS resources associated with ROSA clusters, including the ability to change ROSA cluster node state.

Permissions details

This policy includes the following permissions that allow Red Hat SREs to complete the following tasks:

To view the full JSON policy document, see ROSASRESupportPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: ROSAInstallerPolicy

You can attach ROSAInstallerPolicy to your IAM entities.

Before you create a ROSA with hosted control planes cluster, you must first attach this policy to an IAM role named [Prefix]-ROSA-Worker-Role. This policy allows entities to add any role that follows the [Prefix]-ROSA-Worker-Role pattern to an instance profile. This policy grants necessary permissions to the installer to manage AWS resources that support ROSA cluster installation.

Permissions details

This policy includes the following permissions that allow the installer to complete the following tasks:

To view the full JSON policy document, see ROSAInstallerPolicy in the AWS Managed Policy Reference Guide.

ROSA with HCP operator policies

This section provides details about the operator policies that are required for ROSA with hosted control planes (HCP). You can attach these AWS managed policies to the operator roles needed to use ROSA with HCP. The permissions are required to allow OpenShift operators to manage ROSA with HCP cluster nodes.

AWS managed policy: ROSAAmazonEBSCSIDriverOperatorPolicy

You can attach ROSAAmazonEBSCSIDriverOperatorPolicy to your IAM entities. You must attach this policy to an operator IAM role to allow a ROSA with hosted control planes cluster to make calls to other AWS services. A unique set of operator roles is required for each cluster.

This policy grants necessary permissions to the Amazon EBS CSI Driver Operator to install and maintain the Amazon EBS CSI driver on a ROSA cluster. For more information about the operator, see aws-ebs-csi-driver operator in the OpenShift GitHub documentation.

Permissions details

This policy includes the following permissions that allow the Amazon EBS Driver Operator to complete the following tasks:

To view the full JSON policy document, see ROSAAmazonEBSCSIDriverOperatorPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: ROSAIngressOperatorPolicy

You can attach ROSAIngressOperatorPolicy to your IAM entities. You must attach this policy to an operator IAM role to allow a ROSA with hosted control planes cluster to make calls to other AWS services. A unique set of operator roles is required for each cluster.

This policy grants required permissions to the Ingress Operator to provision and manage load balancers and DNS configurations for ROSA clusters. The policy allows read access to tag values. The operator then filters the tag values for Route 53 resources to discover hosted zones. For more information about the operator, see OpenShift Ingress Operator in the OpenShift GitHub documentation.

Permissions details

This policy includes the following permissions that allow the Ingress Operator to complete the following tasks:

To view the full JSON policy document, see ROSAIngressOperatorPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: ROSAImageRegistryOperatorPolicy

You can attach ROSAImageRegistryOperatorPolicy to your IAM entities. You must attach this policy to an operator IAM role to allow a ROSA with hosted control planes cluster to make calls to other AWS services. A unique set of operator roles is required for each cluster.

This policy grants required permissions to the Image Registry Operator to provision and manage resources for the ROSA in-cluster image registry and dependent services, including S3. This is required so that the operator can install and maintain the internal registry of a ROSA cluster. For more information about the operator, see Image Registry Operator in the OpenShift GitHub documentation.

Permissions details

This policy includes the following permissions that allow the Image Registry Operator to complete the following actions:

To view the full JSON policy document, see ROSAImageRegistryOperatorPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: ROSACloudNetworkConfigOperatorPolicy

You can attach ROSACloudNetworkConfigOperatorPolicy to your IAM entities. You must attach this policy to an operator IAM role to allow a ROSA with hosted control planes cluster to make calls to other AWS services. A unique set of operator roles is required for each cluster.

This policy grants required permissions to the Cloud Network Config Controller Operator to provision and manage networking resources for the ROSA cluster networking overlay. The operator uses these permissions to manage private IP addresses for Amazon EC2 instances as part of the ROSA cluster. For more information about the operator, see Cloud-network-config-controller in the OpenShift GitHub documentation.

Permissions details

This policy includes the following permissions that allow the Cloud Network Config Controller Operator to complete the following tasks:

To view the full JSON policy document, see ROSACloudNetworkConfigOperatorPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: ROSAKubeControllerPolicy

You can attach ROSAKubeControllerPolicy to your IAM entities. You must attach this policy to an operator IAM role to allow a ROSA with hosted control planes cluster to make calls to other AWS services. A unique set of operator roles is required for each cluster.

This policy grants required permissions to the kube controller to manage Amazon EC2, Elastic Load Balancing, and AWS KMS resources for a ROSA with hosted control planes cluster. For more information about this controller, see Controller architecture in the OpenShift documentation.

Permissions details

This policy includes the following permissions that allow the kube controller to complete the following tasks:

To view the full JSON policy document, see ROSAKubeControllerPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: ROSANodePoolManagementPolicy

You can attach ROSANodePoolManagementPolicy to your IAM entities. You must attach this policy to an operator IAM role to allow a ROSA with hosted control planes cluster to make calls to other AWS services. A unique set of operator roles is required for each cluster.

This policy grants required permissions to the NodePool controller to describe, run, and terminate Amazon EC2 instances managed as worker nodes. This policy also grants permissions to allow for disk encryption of the worker node root volume using AWS KMS keys. For more information about this controller, see Controller architecture in the OpenShift documentation.

Permissions details

This policy includes the following permissions that allow the NodePool controller to complete the following tasks:

To view the full JSON policy document, see ROSANodePoolManagementPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: ROSAKMSProviderPolicy

You can attach ROSAKMSProviderPolicy to your IAM entities. You must attach this policy to an operator IAM role to allow a ROSA with hosted control planes cluster to make calls to other AWS services. A unique set of operator roles is required for each cluster.

This policy grants required permissions to the built-in AWS Encryption Provider to manage AWS KMS keys that support etcd data encryption. This policy allows Amazon EC2 to use KMS keys that the AWS Encryption Provider provides to encrypt and decrypt etcd data. For more information about this provider, see AWS Encryption Provider in the Kubernetes GitHub documentation.

Permissions details

This policy includes the following permissions that allow the AWS Encryption Provider to complete the following tasks:

To view the full JSON policy document, see ROSAKMSProviderPolicy in the AWS Managed Policy Reference Guide.

AWS managed policy: ROSAControlPlaneOperatorPolicy

You can attach ROSAControlPlaneOperatorPolicy to your IAM entities. You must attach this policy to an operator IAM role to allow a ROSA with hosted control planes cluster to make calls to other AWS services. A unique set of operator roles is required for each cluster.

This policy grants required permissions to the Control Plane Operator to manage Amazon EC2 and Route 53 resources for ROSA with hosted control planes clusters. For more information about this operator, see Controller architecture in the OpenShift documentation.

Permissions details

This policy includes the following permissions that allow the Control Plane Operator to complete the following tasks:

To view the full JSON policy document, see ROSAControlPlaneOperatorPolicy in the AWS Managed Policy Reference Guide.

ROSA updates to AWS managed policies

View details about updates to AWS managed policies for ROSA since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the Document history page.