Why Provide Privileged Access

While Bootstrapping the Amazon EKS VPC, access to the Kubernetes API Server endpoint is configured as Private to minimize the exposure to the API and reduce the risk of unauthorized access that may compromise the cluster's state, compute resources, service availability, or sensitive data.

These restrictions also limit SingleStore's ability to interact directly with the BYOC cell. Therefore, to perform repair or maintenance tasks on the BYOC cell, SingleStore requires privileged access to the BYOC cell.

Follow the steps in Provide Privileged Access to SingleStore and Revoke Privileged Access to ensure a secure, auditable, and efficient process for providing temporary privileged access to critical resources.

What is a Privileged Access Instance

During the Bootstrapping process, an EC2 instance ("the privileged access instance") is provisioned within the EKS cluster. This instance enables privileged access for SingleStore and facilitates the execution of Kubernetes commands while maintaining high security standards. Access to this EC2 instance is strictly controlled via the AWS Session Manager, without requiring SSH keys or public endpoints.

SingleStore creates an IAM role named ssm-access-from-other-accounts (or ssm-access-from-other-accounts-<eks_cluster_name>) to govern access to the privileged access instance and adds the required policies to enable access to this instance. SingleStore assumes this role to access the privileged access instance.

SingleStore implements the following safeguards to uphold the security standards:

• Session Logging: Enable logging for all the sessions. Once AWS Session Manager CloudWatch logging is enabled on your VPC, all the sessions have logging enabled.

• IAM Role Protection: Use a specific IAM role named ssm-access-from-other-accounts (or ssm-access-from-other-accounts-<eks_cluster_name>).

Provide Privileged Access to SingleStore

After receiving a privileged access request from SingleStore Support over Zendesk, perform the following tasks:

1. Approve privileged access request. Ensure the following:

   • The ssm-access-from-other-accounts (or ssm-access-from-other-accounts-<eks_cluster_name>) IAM role is associated with the privileged access instance.

   • SingleStore Support is able to assume this IAM role.

   • Add the following to the trust relationship policy. Update <SingleStore_Role_ARN> with the ARN provided by SingleStore Support in the Zendesk ticket.

     JSON

     Copy

     {
     "Effect": "Allow",
     "Principal": {
     "AWS": "<SingleStore_Role_ARN>"
      	},
     "Action": "sts:AssumeRole"
     }

2. Enable CloudWatch auditing. To enable CloudWatch logging of the SSM session:

   1. On the Systems Manager Console, select Session Manager > Preferences.

   2. Select the region of your BYOC cell.

   3. Select Edit, and enable CloudWatch logging.

   4. Select the Log group named /aws/ssm/{BYOC_cell_name}/cluster.

   5. Use defaults for other configuration settings.

   6. Select Save. All the SSM session logs are now streamed to the selected log group.

3. Send confirmation to SingleStore. Contact SingleStore Support, confirm that the permissions are granted, and provide the ID of the instance named Privileged access instance (or Breakglass instance).

Revoke Privileged Access

After SingleStore Support has performed the required maintenance or repair operations, a follow-up response is sent to indicate that privileged access is no longer required.

To revoke access to the privileged access instance, remove the SingleStore IAM role from the trust entities - manually remove the SingleStore role from the trust entities of the ssm-access-from-other-accounts (or ssm-access-from-other-accounts-<eks_cluster_name>) role.