Skip to content

private-ddn: update byoc permission #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 8, 2025
Merged

private-ddn: update byoc permission #175

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 44 additions & 6 deletions docs/private-ddn/creating-a-data-plane/byoc.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,16 @@ The setup involves creating an IAM role in your AWS account that establishes a t
<details>

<summary>cloudformation.yaml</summary>
```bash
```yaml
Parameters:
ExternalId:
Type: String
Default: hasura-cloud
Description: External ID for the trust relationship with Hasura Cloud
MinLength: 2
MaxLength: 1224
AllowedPattern: "[A-Za-z0-9+=,.@:\\/-]*"

Resources:
BootstrapRole:
Type: AWS::IAM::Role
Expand All @@ -69,7 +78,7 @@ Resources:
Action: sts:AssumeRole
Condition:
StringEquals:
sts:ExternalId: hasura-cloud
sts:ExternalId: !Ref ExternalId
BootstrapPolicy:
Type: AWS::IAM::Policy
Properties:
Expand All @@ -95,6 +104,8 @@ Resources:
- ec2:DescribeTags
- ec2:DescribeVpcAttribute
- ec2:DescribeVpcs
- ec2:DescribeVpcEndpointServices
- ec2:DescribeVpcEndpoints
- eks:DeleteAddon
- eks:DescribeAddon
- eks:DescribeCluster
Expand All @@ -103,6 +114,8 @@ Resources:
- iam:GetRole
- iam:GetServiceLinkedRoleDeletionStatus
- sqs:GetQueueAttributes
- rds:DescribeDBInstances
- rds:DescribeOrderableDBInstanceOptions
Resource: '*'
- Effect: Allow
Action:
Expand All @@ -116,6 +129,9 @@ Resources:
- ec2:CreateSubnet
- ec2:CreateTags
- ec2:CreateVpc
- ec2:CreateSecurityGroup
- ec2:AuthorizeSecurityGroupIngress
- ec2:CreateVpcEndpoint
- eks:CreateCluster
- eks:CreateNodegroup
- globalaccelerator:CreateAccelerator
Expand All @@ -129,6 +145,8 @@ Resources:
- events:TagResource
- iam:CreateOpenIDConnectProvider
- iam:TagOpenIDConnectProvider
- rds:CreateDBSubnetGroup
- rds:CreateDBInstance
Resource: '*'
Condition:
StringEquals:
Expand Down Expand Up @@ -161,12 +179,15 @@ Resources:
- iam:CreateInstanceProfile
- iam:CreatePolicy
- iam:CreateRole
- iam:CreatePolicyVersion
- iam:DeleteInstanceProfile
- iam:DeleteOpenIDConnectProvider
- iam:DeletePolicy
- iam:DeleteRole
- iam:DeleteServiceLinkedRole
- iam:DetachRolePolicy
- iam:UpdateAssumeRolePolicy
- iam:UpdateOpenIDConnectProviderThumbprint
- iam:GetInstanceProfile
- iam:GetOpenIDConnectProvider
- iam:GetPolicy
Expand Down Expand Up @@ -217,13 +238,15 @@ Resources:
- globalaccelerator.amazonaws.com
- eks.amazonaws.com
- eks-nodegroup.amazonaws.com
- rds.amazonaws.com
- Effect: Allow
Action:
- eks:*
- globalaccelerator:*
- sqs:*
- acm:*
- events:*
- rds:*
Resource: '*'
Condition:
StringEquals:
Expand Down Expand Up @@ -257,7 +280,8 @@ Outputs:
aws cloudformation create-stack \
--stack-name hasura-cloud-byoc \
--template-body file://cloudformation.yaml \
--capabilities CAPABILITY_NAMED_IAM
--capabilities CAPABILITY_NAMED_IAM \
--parameters ParameterKey=ExternalId,ParameterValue=hasura-cloud

# Wait for creation to complete
aws cloudformation wait stack-create-complete \
Expand All @@ -270,7 +294,8 @@ Outputs:
aws cloudformation update-stack \
--stack-name hasura-cloud-byoc \
--template-body file://cloudformation.yaml \
--capabilities CAPABILITY_NAMED_IAM
--capabilities CAPABILITY_NAMED_IAM \
--parameters ParameterKey=ExternalId,ParameterValue=hasura-cloud

# Wait for update to complete
aws cloudformation wait stack-update-complete \
Expand Down Expand Up @@ -298,6 +323,13 @@ Share the following with the Hasura team:

- (Required) Role ARN (From output above)
- (Required) AWS Region
- (Optional) External ID
- The external ID used in the trust relationship between your AWS account and Hasura's AWS account
- This is the value you specified for the `ExternalId` parameter in the CloudFormation template
- If not specified, the default value "hasura-cloud" will be used
- Must have a minimum of 2 characters and a maximum of 1,224 characters
- Must be alphanumeric without white space, but can include the following symbols: plus (+), equal (=), comma (,), period (.), at (@), colon (:), forward slash (/), and hyphen (-)
- **Important**: Make sure to provide this value to the Hasura team if you've customized it
- (Optional) Preferred Availability Zones
- Use AZ IDs (e.g., use1-az1, use1-az2) instead of AZ names (us-east-1a, us-east-1b)
- You can get the AZ IDs by running:
Expand All @@ -308,7 +340,7 @@ Share the following with the Hasura team:
--query "AvailabilityZones[?State=='available'] | [].{ZoneName: ZoneName, ZoneId: ZoneId}"
```
- If you have specific zones which you'd like to use, please pass it along. Otherwise, Hasura will assign accordingly.
- (Optional) VPC CIDR (/16 CIDR)
- (Optional) VPC CIDR (/16-/19 CIDR)
- If you have a specific CIDR in mind for the VPC setup, please pass it along. If not specified, Hasura will assign 10.0.0.0/16.
- Note: If you are planning to use VPC Peering, this CIDR should not conflict with any networks on your side.
- (Optional) Kubernetes Service CIDR (/16-20 CIDR)
Expand Down Expand Up @@ -338,6 +370,8 @@ gcloud services enable \
multiclusterservicediscovery.googleapis.com \
trafficdirector.googleapis.com \
multiclusteringress.googleapis.com \
sqladmin.googleapis.com \
servicenetworking.googleapis.com \
container.googleapis.com \
certificatemanager.googleapis.com --project ${GCP_PROJECT_ID}
```
Expand Down Expand Up @@ -389,6 +423,10 @@ gcloud projects add-iam-policy-binding ${GCP_PROJECT_ID} \
--member "serviceAccount:[email protected]" \
--role roles/iam.serviceAccountAdmin

gcloud projects add-iam-policy-binding ${GCP_PROJECT_ID} \
--member "serviceAccount:[email protected]" \
--role roles/cloudsql.admin

gcloud projects add-iam-policy-binding ${GCP_PROJECT_ID} \
--member "serviceAccount:[email protected]" \
--role roles/iam.workloadIdentityPoolAdmin
Expand All @@ -403,7 +441,7 @@ Share the following with the Hasura team:
- (Required) GCP Region
- (Optional) Preferred Availability Zones
- If you have specific zones which you'd like to use, please pass it along. Otherwise, Hasura will assign accordingly.
- (Optional) VPC CIDR (/16 CIDR)
- (Optional) VPC CIDR (/16-/19 CIDR)
- If you have a specific CIDR in mind for the VPC setup, please pass it along. If not specified, Hasura will assign 10.0.0.0/16.
- Note: If you are planning to use VPC Peering, this CIDR should not conflict with any networks on your side.

Expand Down
Loading