Prerequisites for Wizard-Based Deployment on AWS

If using your own VPC:

• You must create VPC Endpoints to connect to required AWS services, or

• Ensure the subnet has internet access and a NAT Gateway.

AWS does not provide a VPC endpoint for the Cost Explorer service. Without internet access, the Kyvos Resource Usage feature will not work.

Create IAM Role either:

• Automatically, using the CloudFormation template wizard_based_deployment_iam_role.json, or

• Manually, creating a role for Lambda (attached to Kyvos-created Lambda functions, containing all permissions the functions need). Download ec2_iam_policy.json and lambda_iam_policy.json from the installation folder.

If you want to use an existing S3 bucket and IAM role, or read data from an S3 bucket other than the one where Kyvos is deployed, the IAM role needs the permissions in the policy below.

To copy the IAM role of Service Account, perform the following steps.

1. Step 1: How to get the OIDC role ARN (<kyvosEksOidcrole>):

   1. Log in to the AWS Console.

   2. Search for EKS.

   3. Open the Add-ons tab.
      
      

      Open

      

       

   4. Go to the Mountpoint for Amazon S3 CSI Driver section and copy the OIDC role ARN.
      
      

      Open

      

       

2. Step 2: How to get the Node IAM role ARN (<NodeGroupRole>):

   1. Log in to the AWS Console.

   2. Search for EKS.

   3. Open the Compute tab.
      
      

      Open

      

       

   4. Go to Node Groups and click the group name.
      
      

      Open

      

       

   5. In the Details section, copy the Node IAM role ARN.
      
      

      Open

      

       

3. Open the deployment bucket permission section and add the ARN of OIDC (see, line number 11) and Node group (see, line number 9) role in the array.

   { "Version": "2008-10-17", "Statement": [ { "Sid": "Ec2LambdaRoleBucketPolicy", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::815559998352:role/NodeGroupRole-user8s10", "arn:aws:iam::815559998352:role/kyvos-ec2-role-build-automation-iam-roles-2024-3-2", "arn:aws:iam::815559998352:role/kyvosEksOidcrole-userk8s10", "arn:aws:iam::815559998352:role/kyvos-lambda-role-build-automation-iam-roles-2024-3-2" ] }, "Action": [ "s3:PutAnalyticsConfiguration", "s3:GetObjectVersionTagging", "s3:ReplicateObject", "s3:GetObjectAcl", "s3:GetBucketObjectLockConfiguration", "s3:DeleteBucketWebsite", "s3:PutLifecycleConfiguration", "s3:GetObjectVersionAcl", "s3:DeleteObject", "s3:GetBucketPolicyStatus", "s3:GetObjectRetention", "s3:GetBucketWebsite", "s3:PutReplicationConfiguration", "s3:PutObjectLegalHold", "s3:GetObjectLegalHold", "s3:GetBucketNotification", "s3:PutBucketCORS", "s3:GetReplicationConfiguration", "s3:ListMultipartUploadParts", "s3:PutObject", "s3:GetObject", "s3:PutBucketNotification", "s3:PutBucketLogging", "s3:GetAnalyticsConfiguration", "s3:PutBucketObjectLockConfiguration", "s3:GetObjectVersionForReplication", "s3:GetLifecycleConfiguration", "s3:GetInventoryConfiguration", "s3:GetBucketTagging", "s3:PutAccelerateConfiguration", "s3:DeleteObjectVersion", "s3:GetBucketLogging", "s3:ListBucketVersions", "s3:RestoreObject", "s3:ListBucket", "s3:GetAccelerateConfiguration", "s3:GetBucketPolicy", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "s3:GetObjectVersionTorrent", "s3:AbortMultipartUpload", "s3:GetBucketRequestPayment", "s3:GetObjectTagging", "s3:GetMetricsConfiguration", "s3:DeleteBucket", "s3:PutBucketVersioning", "s3:GetBucketPublicAccessBlock", "s3:ListBucketMultipartUploads", "s3:PutMetricsConfiguration", "s3:GetBucketVersioning", "s3:GetBucketAcl", "s3:PutInventoryConfiguration", "s3:GetObjectTorrent", "s3:PutBucketWebsite", "s3:PutBucketRequestPayment", "s3:PutObjectRetention", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:ReplicateDelete", "s3:GetObjectVersion", "s3:PutBucketTagging" ], "Resource": [ "arn:aws:s3:::kyvos-user8s10-47948/*", "arn:aws:s3:::kyvos-userk8s10-47948" ] } ] }

4. Add below permissions in AWS Wizard based IAM role for listing and describing EKS cluster

   "EKSPolicy": { "Type": "AWS::IAM::Policy", "Condition": "EKSClusterPermissionsInclusion", "Properties": { "PolicyName": "eks-policy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "EksDescribeKM", "Effect": "Allow", "Action": [ "eks:ListClusters", "eks:DescribeCluster", "eks:ListNodegroups", "eks:DescribeNodegroup", "eks:DescribeAddon" ], "Resource": "*" }, {

5. You must have the Access Key and Secret Key to access the Kyvos bundle. Contact Kyvos Support for details.

6. Valid Kyvos license file.

7. Create an EKS cluster using CreateEks.json.

8. Run the following commands one by one on every Kyvos node to install kubectl

   curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" unzip awscliv2.zip sudo ./aws/install --bin-dir /usr/local/bin/ --install-dir /usr/local/aws-cli --update o curl -O https://s3.us-west-2.amazonaws.com/amazon-eks/1.29.3/2024-04-19/bin/linux/amd64/kubectl chmod +x ./kubectl sudo chown kyvos:kyvos kubectl sudo mv kubectl /bin/ sudo mkdir -p /home/kyvos/.kube sudo chown -R kyvos:kyvos /home/kyvos/.kube

9. Run the commands below from sudo user on Kyvos Manager node to install eksctl.

   curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$ (uname -s)_amd64.tar.gz" | tar xz -C /tmp sudo cp /tmp/eksctl /bin/

10. Once the EKS cluster is created, go to the created node then go to Security.

11. Click the eks-cluster-sg-kyvosEks-{STACK-NAME}-random number as Security group.

12. Add the following inbound rules:

13. Open the deployment bucket permission section and add the ARN of OIDC and Node group role in the array.