# Security > Enforce security for Self-Hosted Deployment in Amazon Web Services ## Identity and access management (IAM) Deployment requires an [`AdministratorAccess` policy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html) in the target Amazon Web Services (AWS) account. > **Important:** > > Don't use the AWS account root user as part of the deployment or operation of the solution. The configuration includes a combination of roles and policies, which AWS and the customer manage. The principle of least privilege applies. Users can perform only the necessary actions on the deployed resources. ### IAM policies | Claim | Required | Description | | ------------------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | **cluster\_autoscaler** | Optional | Allows the [cluster autoscaler](https://docs.aws.amazon.com/eks/latest/best-practices/cas.html) to scale Amazon Elastic Kubernetes Service (EKS) nodes. | | **flexlm\_logs** | Optional | Allows the FlexLM instance to create log groups and to stream logs to Amazon CloudWatch. | | **mongo\_ebs** | Optional | Allows the MongoDB instance to attach and detach Amazon Elastic Block Storage (EBS) volumes. | | **mongo\_logs** | Optional | Allows the MongoDB instance to create log groups and to stream logs to CloudWatch. | | **read\_config\_secret** | Optional | Allows the external-secrets deployment to communicate with AWS Secrets Manager secret to read the configuration. | ### IAM roles | Claim | Required | Description | | ----------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------- | | **cloudwatch\_observability** | Optional | Allows the EKS CloudWatch Agent to send logs to CloudWatch. | | **cluster\_autoscaler** | Optional | Allows the [cluster autoscaler](https://docs.aws.amazon.com/eks/latest/best-practices/cas.html) to scale EKS nodes. | | **dlm\_lifecycle\_role** | Optional | Allows for MongoDB snapshots to be taken and stored. | | **ebs\_csi\_driver** | Optional | Allows EKS to create persistent EBS volumes. | | **efs\_csi\_driver** | Optional | Allows EKS to create persistent Amazon Elastic File System (EFS) volumes. | | **eks\_cluster** | Optional | Required if the EKS cluster is enabled. | | **external\_secrets** | Optional | Required if the EKS cluster is enabled. Used for reading configuration secrets. | | **flexlm** | Optional | Required for FlexLM licensing. | | **services\_node\_group** | Optional | Required if the EKS cluster is enabled. | ## Networking The deployed security groups require a configuration that allows ingress from only the specified required resources: * IP address ranges, in Classless Inter-Domain Routing ranges (CIDR) notation * Ports * Protocols This configuration includes communication to and from these resources: * The EKS cluster * Amazon Relational Database Service (RDS) Postgres * The Amazon Elastic Load Balancers Modify these Terraform variables: | Variable | Description | | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **internal\_ingress\_cidrs** | When you create a security group, this variable restricts network access between the resources. The default value is `0.0.0.0/0`, but you must restrict it based on your network configuration. | | **allowed\_ingress\_cidrs** | When using Traefik with the LoadBalancer configuration, you might want to allow access to the Frontend Dashboard. To allow traffic from specific ranges IP addresses for the security group, modify this variable with a list of allowed IP address ranges in CIDR notation. | ## Public access To expose the private resources to the public internet while limiting access, the default deployment process provisions these resources: * An external load balancer, to be used as ingress. To disable the loader balancer functionality, change the Terraform variable **traefik\_service\_type** from `LoadBalancer` to `NodePort`. * A list of allowed IP address ranges in Classless Inter-Domain Routing ranges (CIDR) notation, to limit access. To manage this list, use the Terraform variable **allowed\_ingress\_cidrs**. ## Secrets AWS Secrets Manager stores all application secrets and infrastructure secrets in a single secret. The name of the secret is configured in the Terraform variable **aws\_secretsmanager\_secret\_config\_name**. The default value is `asset-solutions/configuration`. The secret is a .json file with these keys: | Key name | Description | | -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | **automation\_connectionstring\_db** | An Npgsql Postgres connection string for the automation database. | | **image\_pull\_secrets\_dockerconfigjson** | Credentials for pulling from the Self-Hosted Deployment container registry. | | **keycloak\_mini\_usf\_clientsecret** | A client secret key that the mini-usf uses service to communicate with Keycloak. During rotation, first update this key from the Keycloak admin console. | | **linksharing\_service\_connection\_string** | The Npgsql Postgres connection string for the link-sharing database. | | **mongo\_db\_connection\_string** | The connection string that is required for communicating with MongoDB. | | **postgres\_server** | The hostname for the Postgres server. This key is taken from the RDS Postgres instance. | | **postgres\_user** | The username for the Postgres instance. | | **postgres\_user\_password** | The password for the Postgres instance. | | **redis\_connection\_host** | The hostname for the Redis instance or the Valkey instance. | | **redis\_connection\_host\_and\_port** | The hostname and the port for the Redis instance or the Valkey instance. | | **redis\_connection\_password** | The password for Redis or Valkey. | | **uvcs\_authorization** | The authorization header that is required for communicating with Unity Version Control (UVCS). | | **workspace\_service\_connection\_strings** | The Npgsql Postgres connection string for the workspace database. | ## Data storage ### Sensitive data The following data stores contain customer data: | Data Store | Description | | ---------------------- | --------------------------------------------------------------------------------------------------------------------- | | Storage backend (UVCS) | Used to store customer assets | | Elasticsearch | Used for search in asset metadata | | Redis or Valkey | Used to cache the temporary assets and metadata | | MongoDB/PSMDB | Used to store asset metadata | | RDS Postgres | Used to persist the Keycloak users, roles, sessions, and admin events Used to store Unity Cloud Automation events | ### Encryption The following AWS resources use encryption with keys that AWS manages. AWS Key Management Service (KMS) generates and encrypts the data key that resources use for encryption. #### Amazon Simple Storage Service The process uses Amazon Simple Storage Service (Amazon S3) to store the Terraform backend. Amazon S3 uses the default server-side encryption (SSE-S3). #### Amazon Elastic File System The process uses EFS to persist volumes within Kubernetes. EFS uses the AES-256 encryption algorithm to [secure data and metadata at rest](https://docs.aws.amazon.com/efs/latest/ug/encryption-at-rest.html). The process uses the Container Storage Interface (CSI) Driver for Amazon EFS to [encrypt data in transit](https://docs.aws.amazon.com/efs/latest/ug/encryption-in-transit.html). #### Amazon Elastic Block Storage The process uses EBS for persistent volumes within the following machines, including snapshots: * Kubernetes machines * Amazon Elastic Compute Cloud (EC2) machines that are deployed outside of Kubernetes [Amazon EBS encryption](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html) automatically encrypts data at rest and data in transit between the instance and the attached EBS volume. #### Amazon Relational Database Service Postgres The process encrypts data and backups both [at rest](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html) and [in transit](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html#Overview.Encryption.InTransit). ### MongoDB Both MongoDB deployment options handle encryption in transit and encryption at rest: * If using a MongoDB VM, refer to the [MongoDB Atlas encryption documentation](https://www.mongodb.com/products/capabilities/security/encryption). * If using PSMDB, refer to the [Percona Operator TLS documentation](https://docs.percona.com/percona-operator-for-mongodb/TLS.html) for transport encryption and the [data at rest encryption documentation](https://docs.percona.com/percona-operator-for-mongodb/encryption.html).