AWS res medium security documentation change
Summary
Updated domain terminology from 'public domain' to 'custom domain', added Windows OS support, and introduced new section for Microsoft AD Service Account setup with detailed permissions requirements
Security assessment
Added explicit warning about requiring valid email addresses for AD user sync and detailed service account permission requirements. The service account documentation specifies security-sensitive permissions (read access to UsersOU/GroupsOU and computer object creation rights) which could lead to privilege escalation if misconfigured. The email requirement warning prevents sync failures that could cause account lockouts.
Diff
diff --git a/res/archive/release-minus-3/ug/prerequisites.md b/res/archive/release-minus-3/ug/prerequisites.md index 053fb455a..5f7abc017 100644 --- a//res/archive/release-minus-3/ug/prerequisites.md +++ b//res/archive/release-minus-3/ug/prerequisites.md @@ -5 +5 @@ -Create an AWS account with an administrative userCreate an Amazon EC2 SSH key pairIncrease service quotasCreate a public domain (optional)Create domain (GovCloud only)Provide external resourcesConfigure LDAPS in your environment (optional)Configure a private VPC (optional) +Create an AWS account with an administrative userCreate an Amazon EC2 SSH key pairIncrease service quotasCreate a custom domain (optional)Create domain (GovCloud only)Provide external resourcesConfigure LDAPS in your environment (optional)Service Account for Microsoft Active DirectoryConfigure a private VPC (optional) @@ -17 +17 @@ Create an AWS account with an administrative userCreate an Amazon EC2 SSH key pa - * Create a public domain (optional) + * Create a custom domain (optional) @@ -24,0 +25,2 @@ Create an AWS account with an administrative userCreate an Amazon EC2 SSH key pa + * Set up a Service Account for Microsoft Active Directory + @@ -68 +70,5 @@ Your AWS account has default quotas, formerly referred to as limits, for each AW -## Create a public domain (optional) +## Create a custom domain (optional) + +We recommend using a custom domain for the product in order to have a user-friendly URL. You may provide a custom domain and _optionally_ provide a certificate for it. + +There is a process in the External Resources stack to create a certificate for a custom domain which you provide. You can skip the steps here if you have a domain and want to use the certificate generatation capabilities of the External Resources stack. @@ -70 +76 @@ Your AWS account has default quotas, formerly referred to as limits, for each AW -We recommend using a custom domain for the product in order to have a user-friendly URL. You will need to register a domain using Amazon Route 53 or another provider and import a certificate for the domain using AWS Certificate Manager. If you already have a public domain and certificate, you may skip this step. +Or, follow these steps to register a domain using Amazon Route 53 and import a certificate for the domain using AWS Certificate Manager. @@ -140,0 +147,4 @@ Research and Engineering Studio accesses [secrets](./secrets-management.html) th +###### Warning + +You must provide a valid email address for all Active Directory (AD) users whom you want to sync. + @@ -177,0 +188,24 @@ When creating your Secret in the Secrets Manager, choose **Other type of secrets +## Set up a Service Account for Microsoft Active Directory + +If you choose Microsoft Active Directory (AD) as the identity source for RES, you have a Service Account in your AD that allows for programmatic access. You must pass a secret with the Service Account's credentials as part of your RES installation. The Service Account is responsible for the following functions: + + * Sync users from the AD: RES must sync users from the AD to allow them to log in to the web portal. The syncing process uses the service account to query the AD using LDAP(s) to determine which users and groups are available. + + * Join the AD domain: this is an optional operation for Linux virtual desktops and infrastructure hosts where the instance joins the AD domain. In RES, this is controlled with the `DisableADJoin` parameter. This parameter is set to False by default, which means that Linux virtual desktops will attempt to join the AD domain in the default configuration. + + * Connect to the AD: Linux virtual desktops and infrastructure hosts will connect to the AD domain if they do not join it (`DisableADJoin` = True). For this functionality to work, the Service Account also needs read access for users and groups in the `UsersOU` and `GroupsOU`. + + + + +The service account requires the following permissions: + + * To sync users and connect to AD → Read access for users and groups in the `UsersOU` and `GroupsOU`. + + * To join the AD domain → create `Computer` objects in the `ComputersOU`. + + + + +The script at [ https://github.com/aws-samples/aws-hpc-recipes/blob/main/recipes/res/res_demo_env/assets/service_account.ps1](https://github.com/aws-samples/aws-hpc-recipes/blob/main/recipes/res/res_demo_env/assets/service_account.ps1) provides an example of how to grant proper Service Account permissions. You can modify it based on your own AD. + @@ -236 +270 @@ Image operating system (OS) | Linux -Compatible OS Versions | Amazon Linux 2, RHEL8, or RHEL9 +Compatible OS Versions | Amazon Linux 2, RHEL8, RHEL9, or Windows 10 and 11