Skip to content

Pipeline enablement in AWS

Purpose

The purpose of this page is to outline the steps to create an AWS IAM role to enable teams/projects to connect and deploy configuration to KaaS with the 'Pipeline Application Template', using their own ADO projects or KaaS Workspace.

Prerequisite

You must have the Cloud Group : AWS-NN-KaaS-PRD_Contributor permissions from novoAccess (should only be requested and received with adminAccount)

Process Trigger

The process is initiated by the team/project raising a ServiceNow request to be onboarded to the platform for the first time, or a non-standard service request if they are switching ADO projects. The following actions are performed by the KaaS Team or Support Partner.

Configure policies and roles in AWS

Each team must have an IAMrole with a Trust Policy and Permission policy configured, to provide granular access that ensures isolation between teams. All policies and roles should be named kaas-prod-ns--deploy (replacing teamname with specific namespace/team name)

Configure Permission Policy

  1. Go to AWS and select 'AWS-NN-KaaS-PRD', contributor access

  2. Go to 'IAM' → Policies → Create Policy, and create a new with permissions policy as specified here: Permissions Policy Note! Remember to update to specific names, as stated in the guide.

Configure Role and Trust Policy

  1. Go to AWS and select 'AWS-NN-KaaS-PRD', contributor access

  2. Go to 'IAM' → Roles → Create Role, and create a new with type 'Custom Trust Entity', using the custom trust policy specfied here: Trust Policy Note! Remember to update to specific names, as stated in the guide.

  3. Add the Permissions policy created in the permissions policy step. Once completed, you can see the ARN ID under the summary tab of the role (used in setting up service connection as described in the AWS OIDC Service Connection)

Modifying Policies

Policies should never deviate from the predefined policy templates on AWS configuration guide.

However, Projects/Teams/namespaces may change ADO project, and that can be solved by updating the Trust Policy to the new ADO project.

Also, if teams/namespaces needs to use multiple ADO projects, it is possible to configure that in the trust policy like this (updating to relevant Project and Team names);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::941447692616:oidc-provider/vstoken.dev.azure.com/59f105ea-4241-452b-a204-2c5ff4c34582"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "vstoken.dev.azure.com/59f105ea-4241-452b-a204-2c5ff4c34582:aud": "api://AzureADTokenExchange"
                },
                "StringLike": {
                    "vstoken.dev.azure.com/59f105ea-4241-452b-a204-2c5ff4c34582:sub": [
                        "vstoken.dev.azure.com/59f105ea-4241-452b-a204-2c5ff4c34582:sub": "sc://novonordiskit/{{PROJECT_NAME}}/kaas-prod-ns-{{TEAM_NAME}}-deploy",
                        "vstoken.dev.azure.com/59f105ea-4241-452b-a204-2c5ff4c34582:sub": "sc://novonordiskit/{{PROJECT_NAME}}/kaas-prod-ns-{{TEAM_NAME}}-deploy"
                    ]
                }
            }
        }
    ]
}