기술 자료

​
​

Development

User Acquisition

Monetization

산업 분야

Self-Hosted Deployment

Amazon Web Services

Microsoft Azure

On premises

vpctl

Self-Hosted Deployment

이 페이지는 선택한 언어로 제공되지 않습니다.
​
​
Self-Hosted Deployment
  • Overview
  • Amazon Web Services
    • Release notes
    • Installation
      • Infrastructure overview
      • Prerequisites
      • Deployment
      • Postdeployment
      • Security
      • Costs
    • Maintenance
  • Microsoft Azure
  • On premises
  • Administration
  • Security
  • vpctl
  1. Self-Hosted Deployment (previously called Unity Virtual Private Cloud)
  3. Self-Hosted Deployment in Amazon Web Services
  5. Installation

Security

Enforce security for Self-Hosted Deployment in Amazon Web Services
읽는 시간 8분
최근 업데이트: 한 달 전

Identity and access management (IAM)

Deployment requires an 
AdministratorAccess
policy in the target Amazon Web Services (AWS) account.
중요
Don't use the AWS account root user as part of the deployment or operation of the solution.
The configuration includes a combination of roles and policies, which AWS and the customer manage. The principle of least privilege applies. Users can perform only the necessary actions on the deployed resources.

IAM policies

Claim

Required

Description

cluster_autoscaler
Optional
Allows the cluster autoscaler to scale Amazon Elastic Kubernetes Service (EKS) nodes.
flexlm_logs
Optional
Allows the FlexLM instance to create log groups and to stream logs to Amazon CloudWatch.
mongo_ebs
Optional
Allows the MongoDB instance to attach and detach Amazon Elastic Block Storage (EBS) volumes.
mongo_logs
Optional
Allows the MongoDB instance to create log groups and to stream logs to CloudWatch.
read_config_secret
Optional
Allows the external-secrets deployment to communicate with AWS Secrets Manager secret to read the configuration.

IAM roles

Claim

Required

Description

cloudwatch_observability
Optional
Allows the EKS CloudWatch Agent to send logs to CloudWatch.
cluster_autoscaler
Optional
Allows the cluster autoscaler to scale EKS nodes.
dlm_lifecycle_role
Optional
Allows for MongoDB snapshots to be taken and stored.
ebs_csi_driver
Optional
Allows EKS to create persistent EBS volumes.
efs_csi_driver
Optional
Allows EKS to create persistent Amazon Elastic File System (EFS) volumes.
eks_cluster
Optional
Required if the EKS cluster is enabled.
external_secrets
Optional
Required if the EKS cluster is enabled. Used for reading configuration secrets.
flexlm
Optional
Required for FlexLM licensing.
services_node_group
Optional
Required if the EKS cluster is enabled.

Networking

The deployed security groups require a configuration that allows ingress from only the specified required resources:
  • IP address ranges, in Classless Inter-Domain Routing ranges (CIDR) notation
  • Ports
  • Protocols
This configuration includes communication to and from these resources:
  • The EKS cluster
  • Amazon Relational Database Service (RDS) Postgres
  • The Amazon Elastic Load Balancers
Modify these Terraform variables:

Variable

Description

internal_ingress_cidrs
When you create a security group, this variable restricts network access between the resources. The default value is 
0.0.0.0/0
, but you must restrict it based on your network configuration.
allowed_ingress_cidrs
When using Traefik with the LoadBalancer configuration, you might want to allow access to the Frontend Dashboard. To allow traffic from specific ranges IP addresses for the security group, modify this variable with a list of allowed IP address ranges in CIDR notation.

Public access

To expose the private resources to the public internet while limiting access, the default deployment process provisions these resources:
  • An external load balancer, to be used as ingress.
    To disable the loader balancer functionality, change the Terraform variable traefik_service_type from 
    LoadBalancer
    to 
    NodePort
    .
  • A list of allowed IP address ranges in Classless Inter-Domain Routing ranges (CIDR) notation, to limit access.
    To manage this list, use the Terraform variable allowed_ingress_cidrs.

Secrets

AWS Secrets Manager stores all application secrets and infrastructure secrets in a single secret. The name of the secret is configured in the Terraform variable aws_secretsmanager_secret_config_name. The default value is 
asset-solutions/configuration
. The secret is a .json file with these keys:

Key name

Description

automation_connectionstring_db
An Npgsql Postgres connection string for the automation database.
image_pull_secrets_dockerconfigjson
Credentials for pulling from the Self-Hosted Deployment container registry.
keycloak_mini_usf_clientsecret
A client secret key that the mini-usf uses service to communicate with Keycloak. During rotation, first update this key from the Keycloak admin console.
linksharing_service_connection_string
The Npgsql Postgres connection string for the link-sharing database.
mongo_db_connection_string
The connection string that is required for communicating with MongoDB.
postgres_server
The hostname for the Postgres server. This key is taken from the RDS Postgres instance.
postgres_user
The username for the Postgres instance.
postgres_user_password
The password for the Postgres instance.
redis_connection_host
The hostname for the Redis instance or the Valkey instance.
redis_connection_host_and_port
The hostname and the port for the Redis instance or the Valkey instance.
redis_connection_password
The password for Redis or Valkey.
uvcs_authorization
The authorization header that is required for communicating with Unity Version Control (UVCS).
workspace_service_connection_strings
The Npgsql Postgres connection string for the workspace database.

Data storage

Sensitive data

The following data stores contain customer data:

Data Store

Description

Storage backend (UVCS)
Used to store customer assets
Elasticsearch
Used for search in asset metadata
Redis or Valkey
Used to cache the temporary assets and metadata
MongoDB/PSMDB
Used to store asset metadata
RDS Postgres
Used to persist the Keycloak users, roles, sessions, and admin events Used to store Unity Cloud Automation events

Encryption

The following AWS resources use encryption with keys that AWS manages. AWS Key Management Service (KMS) generates and encrypts the data key that resources use for encryption.

Amazon Simple Storage Service

The process uses Amazon Simple Storage Service (Amazon S3) to store the Terraform backend. Amazon S3 uses the default server-side encryption (SSE-S3).

Amazon Elastic File System

The process uses EFS to persist volumes within Kubernetes. EFS uses the AES-256 encryption algorithm to secure data and metadata at rest.
The process uses the Container Storage Interface (CSI) Driver for Amazon EFS to encrypt data in transit.

Amazon Elastic Block Storage

The process uses EBS for persistent volumes within the following machines, including snapshots:
  • Kubernetes machines
  • Amazon Elastic Compute Cloud (EC2) machines that are deployed outside of Kubernetes
Amazon EBS encryption automatically encrypts data at rest and data in transit between the instance and the attached EBS volume.

Amazon Relational Database Service Postgres

The process encrypts data and backups both at rest and in transit.

MongoDB

Both MongoDB deployment options handle encryption in transit and encryption at rest:
  • If using a MongoDB VM, refer to the MongoDB Atlas encryption documentation.
  • If using PSMDB, refer to the Percona Operator TLS documentation for transport encryption and the data at rest encryption documentation.
Copyright © 2026 Unity Technologies
법률 정보개인정보 처리방침쿠키Documentation Terms of Use개인 정보 판매 또는 공유 금지개인정보 보호 선택(쿠키 설정)

'Unity', Unity 로고 및 기타 Unity 상표는 미국 및 기타 지역 내 Unity Technologies 또는 그 계열사의 상표 또는 등록상표입니다(자세한 내용은 여기에서 확인하세요). 기타 명칭 또는 브랜드는 해당 소유자의 상표입니다.

일부 페이지는 편의를 위해 기계 번역되었으며 부정확한 내용이 있을 수 있습니다. 정보가 상충되는 경우, 영어 버전을 우선으로 참조하세요.

  • 보고 있는 페이지

    • Identity and access management (IAM)

      • IAM policies

      • IAM roles

    • Networking

    • Public access

    • Secrets

    • Data storage

      • Sensitive data

      • Encryption

        • Amazon Simple Storage Service

        • Amazon Elastic File System

        • Amazon Elastic Block Storage

        • Amazon Relational Database Service Postgres

      • MongoDB

이 페이지의 문제 보고