Setup for AWS

This page describes the legacy CDM implementation, which will be deprecated in an upcoming release. We strongly recommend that you transition to the current CDM implementation as soon as possible.

This page outlines the steps that the Cloud Deployment Team took when setting up AWS before deploying the CDM.

Perform these steps before you deploy the CDM:

Create and configure an IAM group:
1. Create a group with the name cdm-users.
2. Attach the following AWS preconfigured policies to the cdm-users group:
  - IAMUserChangePassword
  - IAMReadOnlyAccess
  - AmazonEC2FullAccess
  - AmazonEC2ContainerRegistryFullAccess
  - AWSCloudFormationFullAccess
3. Create two policies in the IAM service of your AWS account:
  1. Create the EksAllAccess policy using the eks-all-access.json file in the /path/to/forgeops/etc/aws-example-iam-policies directory.
  2. Create the IamLimitedAccess policy using the iam-limited-access.json file in the /path/to/forgeops/etc/aws-example-iam-policies directory.
4. Attach the policies you created to the cdm-users group.
  
  Remember, the CDM is a reference implementation and is not for production use. The policies you create in this procedure are suitable for the CDM. When you create a project plan, you’ll need to determine how to configure AWS permissions.
5. Assign one or more AWS users who will set up CDM to the cdm-users group.
If you haven’t already done so, set up your aws command-line interface environment using the aws configure command.

Verify that your AWS user is a member of the cdm-users group:

$ aws iam list-groups-for-user --user-name my-user-name --output json
{
    "Groups": [
        {
            "Path": "/",
            "GroupName": "cdm-users",
            "GroupId": "ABCDEFGHIJKLMNOPQRST",
            "Arn": "arn:aws:iam::048497731163:group/cdm-users",
            "CreateDate": "2020-03-11T21:03:17+00:00"
        }
    ]
}

Verify that you are using the correct user profile:

$ aws iam get-user
{
    "User": {
        "Path": "/",
        "UserName": "my-test-user",
        "UserId": ". . .",
        "Arn": "arn:aws:iam::01. . .3:user/my-test-user",
        "CreateDate": "2020-09-17T16:01:46+00:00",
        "PasswordLastUsed": "2021-05-10T17:07:53+00:00"
    }
}

Determine the region where you’ll deploy the CDM. Then, configure that region as your default AWS region. For example:
```
$ aws configure set default.region us-east-1
```
Note the following:
- The region must support Amazon EKS.
- The region must have at least three availability zones. (Use the aws ec2 describe-availability-zones --region region-name command to determine the availability zones for an AWS region.)
- Objects required for your EKS cluster should reside in the same region to get the best performance. To make sure that AWS objects are created in the correct region, be sure to set your default region as shown above.
Determine your cluster size: small, medium, or large.
Ensure that the cluster creation script will support your region:
1. Change to the /path/to/forgeops/cluster/eks directory.
2. Open the configuration file for your selected cluster size. For example, open the small.yaml file if you’re going to deploy a small-sized cluster.
3. Specify your region as the metadata/region value.
4. Specify the three availability zones in your region as the availabilityZones values.
Ensure that your region has an adequate CPU quota for the CDM:
1. Change to the /path/to/forgeops/cluster/eks directory.
2. Open the YAML file that contains the configuration for your selected cluster size. For example, open the small.yaml file if you’re going to deploy a small-sized cluster.
3. Locate the two instanceType statements in the nodeGroups section.
4. Your quotas need to let you allocate six machines of each type in your region. If your quotas are too low, request and wait for a quota increase from AWS before attempting to create your CDM cluster.

Create Amazon ECR repositories for the ForgeRock Identity Platform Docker images:

$ for i in am am-config-upgrader amster ds-cts ds-idrepo idm ldif-importer ig ds-proxy rcs-agent;
do
  aws ecr create-repository --repository-name "forgeops/${i}";
done

{
    "repository": {
        "repositoryArn": "arn:aws:ecr:us-east-1:. . .:repository/forgeops/am",
        "registryId": ". . .",
        "repositoryName": "forgeops/am",
        "repositoryUri": ". . . .dkr.ecr.us-east-1.amazonaws.com/forgeops/am",
        "createdAt": "2020-08-03T14:19:54-08:00"
    }
}
. . .

ForgeOps

Setup for AWS

Next step