Created attachment 1962765 [details]
Updates to /usr/lib/ocf/resource.d/heartbeat/awsvip to use AWSPOLICY

Description of problem:

Currently you have to configure aws cli to use awsvip and fence_aws . This means you have to apply credentials to be able use awsvip and fence_aws. If you attach policies as noted above to the EC2, you can then use these agents without have to configure aws cli. AWS policies will control the access to these resources making it more secure . This also makes it possible to use cloud-init to automatically build PCS cluster in AWS, etc.

By using policy to control access AWS CLI, you do not need to incorporate your AWS credentials in your openshift configuration or within the EC2.
To me this is a problem. I can control access to the PCS Fence with policy which is more secure, etc. Not to mention the risk of you're credentials being compromised.

Version-Release number of selected component (if applicable):

resource-agents-4.9.0-29.el8_7.3.x86_64

Additional info:

example command to add awsvip to PCS cluster:

pcs resource create vipaws awsvip aws_ip_region=us-east-1 profile=AWSPOLICY secondary_private_ip=10.0.1.100 --group aws

The policy below when attached to role/profile attached to EC2 allows fence_aws and awsvip resource to be managed via policy, no cli confguration need. To apply AWS policy to manage awsvip and aws fence with Policy.

Note: The policy below can be restricted to specific EC2s.

To apply AWS PCS related policy using AWS CLI:

aws --profile AWS_PROFILE iam create-role --role-name PCS-iam-role --assume-role-policy-document file://./aws_role_ec2_trustpolicy.json
aws --profile AWS_PROFILE iam create-instance-profile --instance-profile-name PCS-iam-profile
aws --profile AWS_PROFILE iam add-role-to-instance-profile --role-name PCS-iam-role --instance-profile-name PCS-iam-profile
aws --profile AWS_PROFILE iam create-policy --policy-name PCS-pcs-policy --policy-document file://./aws_role_pcs_policy.json

1. 1. 1. To test in EC2 :

1. 1. 1. fence_aws -o status -r us-east-1 -n `curl -s http://169.254.169.254/latest/meta-data/instance-id`

1. 1. 1. aws_role_ec2_trustpolicy.json

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal":

{ "Service": "ec2.amazonaws.com" }

,
"Action": "sts:AssumeRole"
}
]
}

1. 1. 1. aws_role_pcs_policy.json

{
"Version": "2012-10-17",
"Statement": [

{ "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "ec2:RebootInstances", "ec2:DescribeInstances", "ec2:StartInstances", "ec2:DescribeTags", "ec2:DescribeInstanceAttribute", "ec2:UnassignPrivateIpAddresses", "ec2:ModifyInstanceAttribute", "ec2:AssignPrivateIpAddresses", "ec2:StopInstances" ], "Resource": "*" }

]
}