Security Guidelines for Your IaaS Provider
Page last updated:
This topic provides security guidelines for the Infrastructure as a Service (IaaS) providers supported by VMware Tanzu Operations Manager (Ops Manager).
Ops Manager supports a variety of IaaS providers. Different IaaS providers require different configuration steps to secure user data, identity information, and credentials.
Security requirements can vary broadly based on the unique configuration and infrastructure of each organization. Rather than provide specific guidance that may not apply to all use cases, VMware has collected links to IaaS providers’ security and identity management documentation. The documents below may help you understand how your IaaS’ security requirements impact your Ops Manager deployment.
VMware does not endorse these documents for accuracy or guarantee that their contents apply to all Ops Manager installations.
Find your IaaS provider in the list below. The documentation items linked for each IaaS may help you configure and secure your installation infrastructure.
These topics in the AWS documentation provide a general reference for AWS’ Identity and Access Management (IAM) features:
AWS Identity and Access Management Guide: If you are new to AWS, start here.
Identities (Users, Groups, and Roles) in the AWS Identity and Access Management Guide
Temporary Security Credentials in the AWS Identity and Access Management Guide: This documentation provides a general definition of IAM terms and provide best practices to help you manage IaaS users and permissions.
Use IMDSv2: This documentation provides a description of IMDSv2 and the security benefits it provides for the AWS metadata endpoints. IMDSv2 support must be enabled within Ops Manager.
Ops Manager includes a feature that allows you to require the usage of IMDSv2. This security feature requires users to send a signed token header with any request to the instance metadata endpoint provided on AWS VMs. By default, IMDSv2 is not required when using the AWS metadata endpoint on a BOSH-deployed VM. You can configure Ops Manager to require IMDSv2 using the Ops Manager API. After enabling IMDSv2, you must re-create all VMs for the new configuration to take effect.
VMware Tanzu Application Service for VMs (TAS for VMs) v2.13.0 and later are compatible with IMDSv2. For all versions of VMware Tanzu Kubernetes Grid Integrated Edition (TKGI), it might be necessary to set the hop limit using the
metadata_options key. For more information, see VM Types / VM Extensions in the BOSH documentation.
To require IMDSv2 on all BOSH-deployed VMs:
Ensure all tiles are using stemcell Xenial v621.183 or later.
Use the Ops Manager API to set the
true. See Updating a staged director’s properties API endpoint.
Navigate to the Ops Manager Installation Dashboard.
Configure the BOSH Director to re-create VMs:
- Navigate to the Ops Manager Installation Dashboard.
- Click the BOSH Director tile.
- Select Director Config.
- Enable the Recreate VMs deployed by the BOSH Director checkbox.
- Return to the Ops Manager Installation Dashboard.
If you have service tiles installed, for each service tile:
Note: The names of the Upgrade all service instances and Recreate all service instances errands might be slightly different between services.
- Click the tile.
- Click the Errands tab.
- Enable the Upgrade all service instances errand. Running this errand is necessary to push CredHub certificate updates to each service instance.
- If the service tile has the Recreate all service instances errand:
- Enable the Recreate all service instances errand. Running this errand pushes BOSH Agent certificate updates to service instances.
Click Review Pending Changes.
Click Apply Changes.
This topic in the GCP documentation describes general authentication guidelines for GCP:
This topic in the Microsoft Azure documentation describes managing IaaS users and credentials:
These topics in the OpenStack documentation provide a general reference for OpenStack service credential management:
Configuring service credentials in Configure the deployment
This topic in the VMware vSphere documentation describes best practices for securing and managing a vSphere installation: