You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/operate/rc/subscriptions/bring-your-own-cloud/iam-resources/aws-console.md
+126-111
Original file line number
Diff line number
Diff line change
@@ -18,117 +18,117 @@ You **must not** change the configurations of provisioned resources or stop or t
18
18
19
19
## Step 1: Create the IAM instance policy
20
20
21
-
First, create a policy to use for the new instance role:
21
+
The IAM instance policy controls the permissions for the instances that Redis Cloud creates in your AWS account.
22
22
23
-
<!-- {{< video "/images/rc/create-instance-role-policy.mp4" "Create an instance role policy" >}} -->
23
+
Follow the steps to [createan IAM policy using the JSON editor](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html#access_policies_create-json-editor) with the following settings:
24
24
25
-
1. In the AWS IAM console, go to **Policies** > **Create policy**.
26
-
1. In the **JSON** tab, paste the contents of the RedisLabsInstanceRolePolicy.json policy file, shown here:
25
+
- In **Specify permissions**, select **JSON**, and then enter the contents of the RedisLabsInstanceRolePolicy.json policy file:
- In **Review and Create**, enter `RedisLabsInstanceRolePolicy` in the **Policy name** field.
107
107
108
-
1. Validate it and then select **Review Policy**.
109
-
1. Enter **RedisLabsInstanceRolePolicy** as the policy name and then select **Create Policy**.
108
+
Select **Create policy** to finish policy creation.
110
109
111
110
## Step 2: Create the service role
112
111
113
-
To create the role that uses the policy:
112
+
After creating the instance role policy, you must create a role to assign the policy.
113
+
114
+
Follow the steps to [create a role for an AWS service](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html#roles-creatingrole-service-console) with the following settings:
114
115
115
-
<!-- {{< video "/images/rc/create-cluster-node-role.mp4" "Create a cluster node role" >}} -->
116
+
- In **Select trusted entity**:
117
+
-**Trusted entity**: Select **AWS service**.
118
+
-**Service or use case**: Select **EC2**.
119
+
-**Use case**: Select **EC2**.
120
+
- In **Add permissions**, select the **RedisLabsInstanceRolePolicy** you created.
121
+
- In **Name, review, and create**, enter `redislabs-cluster-node-role` in the **Role name** field.
116
122
117
-
1. In the AWS IAM console, go to **Roles** and click **Create Role**.
118
-
1. Select **AWS Service** as the trusted entity, **EC2** as the service
119
-
and use case, and click **Next: Permissions**.
120
-
1. Enter `RedisLabsInstanceRolePolicy` in the search box to look up the policy we just created.
121
-
Select it, and click **Next: Review**.
122
-
1. Name the role `redislabs-cluster-node-role` and click **Create Role**.
123
+
Select **Create role** to finish role creation.
123
124
124
125
## Step 3: Create the user policy
125
126
126
-
Now create a policy to assign to the user:
127
+
The user policy controls the permissions for the user that Redis Cloud uses to manage your AWS account.
127
128
128
-
<!-- {{< video "/images/rc/create-instance-user-policy.mp4" "Create an instance user policy" >}} -->
129
+
Follow the steps to [createan IAM policy using the JSON editor](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html#access_policies_create-json-editor) with the following settings:
129
130
130
-
1. In the AWS IAM console, go to **Policies** > **Create policy**.
131
-
1. In the **JSON** tab, paste the contents of the RedisLabsIAMUserRestrictedPolicy.json policy file.
131
+
- In **Specify permissions**, select **JSON**, and then enter the contents of the RedisLabsIAMUserRestrictedPolicy.json policy file:
@@ -360,35 +360,50 @@ Now create a policy to assign to the user:
360
360
```
361
361
{{< /expand >}}
362
362
363
-
1. Validate the policy and click **Review Policy**.
364
-
1. Enter `RedislabsIAMUserRestrictedPolicy` as the policy name and click **Create Policy**.
363
+
- In **Review and Create**, enter `RedislabsIAMUserRestrictedPolicy` in the **Policy name** field.
364
+
365
+
Select **Create policy** to finish policy creation.
365
366
366
367
## Step 4: Create the programmatic access user
367
368
368
-
Create a user and attach the policy you created:
369
+
After you create the user policy, you must create a programmatic access user and attach the policy to it.
370
+
371
+
Follow the steps to [create a user on the AWS console](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html), with the following settings:
372
+
373
+
- In **Specify user details**, For **User name**, enter `redislabs-user`.
-**Permissions policies**: Select the **RedislabsIAMUserRestrictedPolicy** you created from the list.
377
+
378
+
Select **Create user** to create the user.
369
379
370
-
<!-- {{< video "/images/rc/create-programmatic-user.mp4" "Create programmatic user" >}} -->
380
+
After you create the user, you need to add an access key for the user.
371
381
372
-
1. In the AWS IAM console, go to **Users** > select **Add user**.
373
-
1. Name it `redislabs-user` and check only the **Programmatic access** checkbox.
374
-
1. Click **Next: Permissions**.
375
-
1. Select **Attach existing policies directly** and select
376
-
**RedislabsIAMUserRestrictedPolicy** from the list.
377
-
1. Click **Next: Review**.
378
-
1. Click **Create user**.
379
-
1. Download the user credentials and store them in a secure location.
382
+
Follow the steps to [create an access key](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-keys-admin-managed.html#admin-create-access-key) for the user you just created. Save the access key ID and secret access key in a secure location.
380
383
381
384
## Step 5: Create the console access role
382
385
383
-
Last, create a role and attach the policy you created:
386
+
The console access role controls the permissions for the user that Redis Cloud uses to access the AWS console.
387
+
388
+
Follow the steps to [Create a role for an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) with the following settings:
-**Account ID**: Enter account number `168085023892` (Redis Cloud's AWS account).
394
+
-**Options**: Select **Require MFA**.
395
+
{{< warning >}}
396
+
Do not check the **Require external ID** checkbox.
397
+
{{< /warning >}}
398
+
- In **Add permissions**, select the **RedisLabsInstanceRolePolicy** you created.
399
+
- In **Name, review, and create**, enter `redislabs-role` in the **Role name** field.
400
+
401
+
Select **Create role** to finish role creation. Save the Role name for later.
402
+
403
+
## Next steps
384
404
385
-
<!--{{< video "/images/rc/create-console-access-role.mp4" "Create console access user" >}} -->
405
+
When you've finished creating all of the resources, you can [create a Cloud Account]({{< relref "/operate/rc/subscriptions/bring-your-own-cloud/cloud-account-settings" >}}) in the Redis Cloud console. To do this, you'll need the following information:
386
406
387
-
1. In the AWS IAM console, go to **Roles** > select **Create role**.
388
-
1. Select **Another AWS account**.
389
-
1. Under **Account ID**, enter account number `168085023892` (Redis Cloud's AWS account).
390
-
1. Under Options, check the **Require MFA** checkbox only. *Do not check Require external ID*.
391
-
1. Click **Next: Permissions**.
392
-
1. Attach the policy **RedisLabsIAMUserRestrictedPolicy** to the role.
393
-
1. Click **Next: Review**.
394
-
1. Name the role `redislabs-role` and then click **Create role**.
407
+
-**Access Key ID**: The Access Key ID for the [programmatic user you created](#step-4-create-the-programmatic-access-user).
408
+
-**Secret Access Key**: The Secret Access Key for the [programmatic user you created](#step-4-create-the-programmatic-access-user).
409
+
-**IAM Role Name**: The name of the [console access role you created](#step-5-create-the-console-access-role).
Copy file name to clipboardExpand all lines: content/operate/rc/subscriptions/bring-your-own-cloud/iam-resources/cloudformation.md
+31-41
Original file line number
Diff line number
Diff line change
@@ -8,67 +8,57 @@ categories:
8
8
- rc
9
9
linkTitle: CloudFormation
10
10
---
11
-
The following link uses [AWS CloudFormation](https://aws.amazon.com/cloudformation/) to create a stack using the AWS console:
11
+
You can use [AWS CloudFormation](https://aws.amazon.com/cloudformation/) to create the IAM resources for Redis Cloud Bring your Own Cloud (BYOC).
12
+
13
+
{{< warning >}}
14
+
We use the provided credentials to configure your AWS environment and provision required resources.
15
+
16
+
You **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]({{< relref "/operate/rc/subscriptions/bring-your-own-cloud/cloud-account-settings#avoid-service-disruption" >}}) for more details.
17
+
{{< /warning >}}
18
+
19
+
## Create resources using CloudFormation on the AWS Console
20
+
21
+
The following link uses CloudFormation to create a stack using the AWS console:
You can then use the `Outputs` tab to find the data needed to complete the creation of a Cloud Account. For the `accessSecretKey` (i.e. user's access key) and `consolePassword` (user's console password) you'll have to follow the links to the AWS Secrets Manager service, and use that to find the secret values. These values, being secrets, aren't displayed directly by CloudFormation.
27
+
When the stack finishes, select the stack and then the **Outputs** tab. You need the following information to [create a Cloud Account]({{< relref "/operate/rc/subscriptions/bring-your-own-cloud/cloud-account-settings" >}}) in the Redis Cloud console:
28
+
29
+
-**Access Key ID**: The `accessKeyId` output.
30
+
-**Secret Access Key**: Follow the link to AWS Secrets Manager in the `accessSecretKey` output and select **Retrieve secret value**.
31
+
-**IAM Role Name**: The `IAMRoleName` output.
18
32
19
-
You can use the AWS command-line interface (CLI) if you prefer:
33
+
## Create resources using CloudFormation through AWS CLI
34
+
35
+
You can also use the AWS command-line interface (CLI) to create the stack:
The data needed to complete the creation of a Cloud Account is shown as `Output Key` and `Output Value` pairs.
38
48
39
-
For the two secrets (`accessSecretKey` and `consolePassword`) you'll need to use the AWS secretmanager CLI - the value you'll need has a key of `SecretString`:
49
+
After the stack finishes, you can retrieve the outputs from the `Outputs` section of the response.
The `consolePassword` is a JSON object containing a single member whose key is `password` and whose value is the password. This can be a bit complex to parse out. Here's an example output:
You need the following information to [create a Cloud Account]({{< relref "/operate/rc/subscriptions/bring-your-own-cloud/cloud-account-settings" >}}) in the Redis Cloud console:
65
52
66
-
The JSON object is the value (less the single quotes) of the `SecretString` key. i.e. it is <nobr>`{"password":"S3cr3tP@$$w0rd"}`</nobr>.
53
+
-**Access Key ID**: The `accessKeyId` output.
54
+
-**Secret Access Key**: Extract the secret ID from the `accessSecretKey` output. The secret ID is the `name` query parameter in the `accessSecretKey` output.
67
55
68
-
The password is the value associated with that key (less the double quotes): `S3cr3tP@$$w0rd`.
56
+
For example, if the `accessSecretKey` output is `https://console.aws.amazon.com/secretsmanager/home?region=<region>/secret?name=/redislabsuser/secret_access_key`, then the secret ID is `/redislabsuser/secret_access_key`.
69
57
70
-
{{< warning >}}
71
-
We use the provided credentials to configure your AWS environment and provision required resources.
58
+
Use the secret ID to retrieve the secret value using the AWS secretsmanager CLI:
72
59
73
-
You **must not** change the configurations of provisioned resources or stop or terminate provisioned instances. If you do, your databases will be inaccessible and Redis will not be able to ensure database stability. See [Avoid service disruption]({{< relref "/operate/rc/subscriptions/bring-your-own-cloud/cloud-account-settings#avoid-service-disruption" >}}) for more details.
0 commit comments