AWS rosa documentation change
Summary
Updated ROSAWorkerInstancePolicy to include ECR permissions for image retrieval and clarified worker node permissions. Added changelog entries for policy updates related to ECR access and network interface tagging.
Security assessment
The changes document expanded IAM policy permissions (ECR access) and tagging requirements, which are security-related configurations. However, there is no explicit evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/rosa/latest/userguide/security-iam-awsmanpol.md b/rosa/latest/userguide/security-iam-awsmanpol.md index 164a96704..cd24a4502 100644 --- a/rosa/latest/userguide/security-iam-awsmanpol.md +++ b/rosa/latest/userguide/security-iam-awsmanpol.md @@ -46 +46 @@ AWS managed policies are intended for use by ROSA with hosted control planes (HC -You can attach `ROSAWorkerInstancePolicy` to your IAM entities. Before you create a ROSA with hosted control planes cluster, you must first attach this policy to a worker IAM role. +You can attach `ROSAWorkerInstancePolicy` to your IAM entities. Before creating a cluster, you must have the ROSA worker IAM role with this policy attached. A ROSA service makes calls to other AWS services on your behalf. They do this to manage the resources that you use with each cluster. @@ -50 +50 @@ You can attach `ROSAWorkerInstancePolicy` to your IAM entities. Before you creat -This policy includes the following permissions that allow the ROSA service to complete the following tasks: +This policy includes the following permissions that allow the ROSA worker nodes to complete the following tasks: @@ -52 +52,3 @@ This policy includes the following permissions that allow the ROSA service to co - * `ec2` — Review AWS Region and Amazon EC2 instance details as part of the lifecycle management of worker nodes in a ROSA cluster. + * `ec2` — Evaluate AWS Region and Amazon EC2 instance details as part of ROSA cluster worker node lifecycle management. + + * `ecr` \- Evaluate and get images from ROSA-managed ECR repositories that are necessary for cluster installation and worker node lifecycle management. @@ -282,0 +285,2 @@ Change | Description | Date +ROSAWorkerInstancePolicy — Policy updated | ROSA updated the policy to allow worker nodes to evaluate and get images from ROSA-managed ECR repositories that are necessary for cluster installation and worker node lifecycle management. To learn more, see AWS managed policy: ROSAWorkerInstancePolicy. | March 3, 2025 +ROSANodePoolManagementPolicy — Policy updated | ROSA updated the policy to allow elastic network interfaces to be tagged similarly to EC2 instances only during ec2:RunInstances calls when the request includes the tag `red-hat-managed: true`. These permissions are necessary to support ROSA with HCP 4.17 clusters. To learn more, see AWS managed policy: ROSANodePoolManagementPolicy. | February 24, 2025