Security
Enforce security for Self-Hosted Deployment in Amazon Web Services.
阅读时间5 分钟最后更新于 14 天前
Identity and access management (IAM)
Deployment requires an AdministratorAccess policy in the target Amazon Web Services (AWS) account.
重要
Don't use the AWS account root user as part of the deployment or operation of the solution.
The configuration includes a combination of roles and policies, which AWS and the customer manage. The principle of least privilege applies. Users can perform only the necessary actions on the deployed resources.
IAM policies
Claim | Required | Description |
|---|---|---|
| Optional | Allows the cluster autoscaler to scale Amazon Elastic Kubernetes Service (EKS) nodes. |
| Optional | Allows the FlexLM instance to create log groups and to stream logs to Amazon CloudWatch. |
| Optional | Allows the MongoDB instance to attach and detach Amazon Elastic Block Storage (EBS) volumes. |
| Optional | Allows the MongoDB instance to create log groups and to stream logs to CloudWatch. |
| Optional | Required if Percona Server for MongoDB (PSMDB) is enabled. Allows the PSMDB operator to read and write backups in the PSMDB backup Amazon Simple Storage Service (Amazon S3) bucket. |
| Optional | Allows the external-secrets deployment to communicate with AWS Secrets Manager secret to read the configuration. |
IAM roles
Claim | Required | Description |
|---|---|---|
| Optional | Allows the cluster autoscaler to scale EKS nodes. |
| Optional | Allows for MongoDB snapshots to be taken and stored. |
| Optional | Allows EKS to create persistent EBS volumes. |
| Optional | Allows EKS to create persistent Amazon Elastic File System (EFS) volumes. |
| Optional | Required if the EKS cluster is enabled. |
| Optional | Required if the EKS cluster is enabled. Used for reading configuration secrets. |
| Optional | Required for FlexLM licensing. |
| Optional | Required if the MongoDB instance is enabled. Attached to the MongoDB EC2 instance, with the |
| Optional | Required if PSMDB is enabled. The PSMDB operator uses this role through EKS Pod Identity to store backups in Amazon S3. |
| Optional | Required if the EKS cluster is enabled. |
Networking
The deployed security groups require a configuration that allows ingress from only the specified required resources:
- IP address ranges, in Classless Inter-Domain Routing ranges (CIDR) notation
- Ports
- Protocols
This configuration includes communication to and from these resources:
- The EKS cluster
- Amazon Relational Database Service (RDS) Postgres
- The Amazon Elastic Load Balancers
Modify these Terraform variables:
Variable | Description |
|---|---|
| When you create a security group, this variable restricts network access between the resources. The default value is |
| When using Traefik with the LoadBalancer configuration, you might want to allow access to the Frontend Dashboard. To allow traffic from specific ranges IP addresses for the security group, modify this variable with a list of allowed IP address ranges in CIDR notation. |
Public access
To expose the private resources to the public internet while limiting access, the default deployment process provisions these resources:
-
An external load balancer, to be used as ingress.To disable the loader balancer functionality, change the Terraform variable traefik_service_type fromto
LoadBalancer.NodePort -
A list of allowed IP address ranges in Classless Inter-Domain Routing ranges (CIDR) notation, to limit access.To manage this list, use the Terraform variable allowed_ingress_cidrs.
Secrets
AWS Secrets Manager stores all application secrets and infrastructure secrets in a single secret. The name of the secret is configured in the Terraform variable . The default value is . The secret is a .json file with these keys:
aws\_secretsmanager\_secret\_config\_nameasset-solutions/configurationKey name | Description |
|---|---|
| An Npgsql Postgres connection string for the automation database. |
| Credentials for pulling from the Self-Hosted Deployment container registry. |
| A client secret key that the mini-usf uses service to communicate with Keycloak. During rotation, first update this key from the Keycloak admin console. |
| The Npgsql Postgres connection string for the link-sharing database. |
| The connection string that is required for communicating with MongoDB. |
| The hostname for the Postgres server. This key is taken from the RDS Postgres instance. |
| The username for the Postgres instance. |
| The password for the Postgres instance. |
| The hostname for the Redis instance or the Valkey instance. |
| The hostname and the port for the Redis instance or the Valkey instance. |
| The password for Redis or Valkey. |
| The authorization header that is required for communicating with Unity Version Control (UVCS). |
| The Npgsql Postgres connection string for the workspace database. |
Data storage
Sensitive data
The following data stores contain customer data:
Data Store | Description |
|---|---|
| Storage backend (UVCS) | Used to store customer assets |
| Elasticsearch | Used for search in asset metadata |
| Redis or Valkey | Used to cache the temporary assets and metadata |
| MongoDB/PSMDB | Used to store asset metadata |
| RDS Postgres | Used to persist the Keycloak users, roles, sessions, and admin events Used to store Unity Cloud Automation events |
Encryption
The following AWS resources use encryption with keys that AWS manages. AWS Key Management Service (KMS) generates and encrypts the data key that resources use for encryption.
Amazon Simple Storage Service
The process uses Amazon Simple Storage Service (Amazon S3) to store the Terraform backend. Amazon S3 uses the default server-side encryption (SSE-S3).
Amazon Elastic File System
The process uses EFS to persist volumes within Kubernetes. EFS uses the AES-256 encryption algorithm to secure data and metadata at rest.
The process uses the Container Storage Interface (CSI) Driver for Amazon EFS to encrypt data in transit.
Amazon Elastic Block Storage
The process uses EBS for persistent volumes within the following machines, including snapshots:
- Kubernetes machines
- Amazon Elastic Compute Cloud (EC2) machines that are deployed outside of Kubernetes
Amazon EBS encryption automatically encrypts data at rest and data in transit between the instance and the attached EBS volume.
Amazon Relational Database Service Postgres
The process encrypts data and backups both at rest and in transit.
MongoDB
Both MongoDB deployment options handle encryption in transit and encryption at rest:
- If using a MongoDB VM, refer to the MongoDB Atlas encryption documentation.
- If using PSMDB, refer to the Percona Operator TLS documentation for transport encryption and the data at rest encryption documentation.