AWS res medium security documentation change
Summary
Updated domain terminology from 'public domain' to 'custom domain', added section about Service Account for Microsoft Active Directory requirements, added warning about valid email addresses for AD users, and expanded compatible OS versions to include Windows 10/11
Security assessment
The addition of Service Account requirements specifies necessary permissions (read access and Computer object creation) for AD integration, which directly impacts security configuration. The warning about valid email addresses enforces proper user provisioning. These changes help prevent privilege escalation and misconfiguration risks.
Diff
diff --git a/res/archive/release-minus-2/ug/prerequisites.md b/res/archive/release-minus-2/ug/prerequisites.md index dd72816a7..258123a57 100644 --- a//res/archive/release-minus-2/ug/prerequisites.md +++ b//res/archive/release-minus-2/ug/prerequisites.md @@ -5 +5 @@ -Create an AWS account with an administrative userCreate an Amazon EC2 SSH key pairIncrease service quotasCreate a public domain (optional)Create domain (GovCloud only)Provide external resourcesConfigure LDAPS in your environment (optional)Configure a private VPC (optional) +Create an AWS account with an administrative userCreate an Amazon EC2 SSH key pairIncrease service quotasCreate a custom domain (optional)Create domain (GovCloud only)Provide external resourcesConfigure LDAPS in your environment (optional)Service Account for Microsoft Active DirectoryConfigure a private VPC (optional) @@ -17 +17 @@ Create an AWS account with an administrative userCreate an Amazon EC2 SSH key pa - * Create a public domain (optional) + * Create a custom domain (optional) @@ -24,0 +25,2 @@ Create an AWS account with an administrative userCreate an Amazon EC2 SSH key pa + * Set up a Service Account for Microsoft Active Directory + @@ -68 +70,5 @@ Your AWS account has default quotas, formerly referred to as limits, for each AW -## Create a public domain (optional) +## Create a custom domain (optional) + +We recommend using a custom domain for the product in order to have a user-friendly URL. You may provide a custom domain and _optionally_ provide a certificate for it. + +There is a process in the External Resources stack to create a certificate for a custom domain which you provide. You can skip the steps here if you have a domain and want to use the certificate generatation capabilities of the External Resources stack. @@ -70 +76 @@ Your AWS account has default quotas, formerly referred to as limits, for each AW -We recommend using a custom domain for the product in order to have a user-friendly URL. You will need to register a domain using Amazon Route 53 or another provider and import a certificate for the domain using AWS Certificate Manager. If you already have a public domain and certificate, you may skip this step. +Or, follow these steps to register a domain using Amazon Route 53 and import a certificate for the domain using AWS Certificate Manager. @@ -140,0 +147,4 @@ Research and Engineering Studio accesses [secrets](./secrets-management.html) th +###### Warning + +You must provide a valid email address for all Active Directory (AD) users whom you want to sync. + @@ -177,0 +188,24 @@ When creating your Secret in the Secrets Manager, choose **Other type of secrets +## Set up a Service Account for Microsoft Active Directory + +If you choose Microsoft Active Directory (AD) as the identity source for RES, you have a Service Account in your AD that allows for programmatic access. You must pass a secret with the Service Account's credentials as part of your RES installation. The Service Account is responsible for the following functions: + + * Sync users from the AD: RES must sync users from the AD to allow them to log in to the web portal. The syncing process uses the service account to query the AD using LDAP(s) to determine which users and groups are available. + + * Join the AD domain: this is an optional operation for Linux virtual desktops and infrastructure hosts where the instance joins the AD domain. In RES, this is controlled with the `DisableADJoin` parameter. This parameter is set to False by default, which means that Linux virtual desktops will attempt to join the AD domain in the default configuration. + + * Connect to the AD: Linux virtual desktops and infrastructure hosts will connect to the AD domain if they do not join it (`DisableADJoin` = True). For this functionality to work, the Service Account also needs read access for users and groups in the `UsersOU` and `GroupsOU`. + + + + +The service account requires the following permissions: + + * To sync users and connect to AD → Read access for users and groups in the `UsersOU` and `GroupsOU`. + + * To join the AD domain → create `Computer` objects in the `ComputersOU`. + + + + +The script at [ https://github.com/aws-samples/aws-hpc-recipes/blob/main/recipes/res/res_demo_env/assets/service_account.ps1](https://github.com/aws-samples/aws-hpc-recipes/blob/main/recipes/res/res_demo_env/assets/service_account.ps1) provides an example of how to grant proper Service Account permissions. You can modify it based on your own AD. + @@ -236 +270 @@ Image operating system (OS) | Linux -Compatible OS Versions | Amazon Linux 2, RHEL8, or RHEL9 +Compatible OS Versions | Amazon Linux 2, RHEL8, RHEL9, or Windows 10 and 11