Security Guidelines for Your IaaS Provider

Page last updated:

This topic provides security guidelines for the Infrastructure as a Service (IaaS) providers supported by VMware Tanzu Operations Manager (Ops Manager).

Overview

Ops Manager supports a variety of IaaS providers. Different IaaS providers require different configuration steps to secure user data, identity information, and credentials.

Security requirements can vary broadly based on the unique configuration and infrastructure of each organization. Rather than provide specific guidance that may not apply to all use cases, VMware has collected links to IaaS providers’ security and identity management documentation. The documents below may help you understand how your IaaS’ security requirements impact your Ops Manager deployment.

VMware does not endorse these documents for accuracy or guarantee that their contents apply to all Ops Manager installations.

Find your IaaS provider in the list below. The documentation items linked for each IaaS may help you configure and secure your installation infrastructure.

Amazon Web Services (AWS)

These topics in the AWS documentation provide a general reference for AWS’ Identity and Access Management (IAM) features:

Enable IMDSv2 in Ops Manager

Ops Manager includes a feature that allows you to require the usage of IMDSv2. This security feature requires users to send a signed token header with any request to the instance metadata endpoint provided on AWS VMs. By default, IMDSv2 is not required when using the AWS metadata endpoint on a BOSH-deployed VM. You can configure Ops Manager to require IMDSv2 using the Ops Manager API. After enabling IMDSv2, you must re-create all VMs for the new configuration to take effect.

VMware Tanzu Application Service for VMs (TAS for VMs) v2.13.0 and later are compatible with IMDSv2. For all versions of VMware Tanzu Kubernetes Grid Integrated Edition (TKGI), it might be necessary to set the hop limit using the metadata_options key. For more information, see VM Types / VM Extensions in the BOSH documentation.

Warning: All tiles and service instances must be using stemcell Xenial v621.183 or later in order to require IMDSv2. Requiring IMDSv2 while using an older stemcell causes Apply Changes to fail due to an unresponsive BOSH agent.

To require IMDSv2 on all BOSH-deployed VMs:

  1. Ensure all tiles are using stemcell Xenial v621.183 or later.

  2. Use the Ops Manager API to set the require_imds_v2 property to true. See Updating a staged director’s properties API endpoint.

  3. Navigate to the Ops Manager Installation Dashboard.

  4. Configure the BOSH Director to re-create VMs:

    1. Navigate to the Ops Manager Installation Dashboard.
    2. Click the BOSH Director tile.
    3. Select Director Config.
    4. Enable the Recreate VMs deployed by the BOSH Director checkbox.
    5. Return to the Ops Manager Installation Dashboard.
  5. If you have service tiles installed, for each service tile:

    Note: The names of the Upgrade all service instances and Recreate all service instances errands might be slightly different between services.

    1. Click the tile.
    2. Click the Errands tab.
    3. Enable the Upgrade all service instances errand. Running this errand is necessary to push CredHub certificate updates to each service instance.
    4. If the service tile has the Recreate all service instances errand:
      1. Enable the Recreate all service instances errand. Running this errand pushes BOSH Agent certificate updates to service instances.
  6. Click Review Pending Changes.

  7. Click Apply Changes.

Google Cloud Platform (GCP)

This topic in the GCP documentation describes general authentication guidelines for GCP:

Microsoft Azure

This topic in the Microsoft Azure documentation describes managing IaaS users and credentials:

OpenStack

These topics in the OpenStack documentation provide a general reference for OpenStack service credential management:

VMware vSphere

This topic in the VMware vSphere documentation describes best practices for securing and managing a vSphere installation: