Welcome to your first step towards cloud efficiency and savings with Infrastructure Optimizer. By following our setup checklist, you'll enable Infrastructure Optimizer to operate smoothly in your environment.
Environment Prerequisites Overview
...
Component
...
Section Link
...
VPC
...
...
Certificate
...
...
IAM Roles
...
...
EKS Cluster
...
...
| title | Network Checklist |
|---|
...
Component
...
Requirements
...
VPC
...
Please specify an IPv4 CIDR block range other than
192.168.137.0/24It contains at least one private subnet
...
NAT Gateway
...
The connectivity type is public
Security
...
| title | Security Checklist |
|---|
...
Component
...
Details
...
SSH Key
...
This will be used to attach to the Management Server
...
Trusted Certificate
...
To make the installation accessible to your organization
Compute
...
| title | Compute Platform Checklist |
|---|
...
Component
...
Requirements
...
Operating System
...
Linux variants
Permissions
We understand that cloud control and security are essential to you. In order to install Infrastructure Optimizer and start saving right away, we need your help to set up the right permissions for Infrastructure Optimizer to operate. For seamless operation and integration with AWS services, the following IAM roles with specific permissions are required:
User IAM Role
...
| title | Least privilege IAM policies of users |
|---|
| Info |
|---|
This is for users who install and use the product. |
...
Least privilege IAM policies
...
Explanation
...
| Expand | |||||
|---|---|---|---|---|---|
| |||||
|
...
Before you begin, use this checklist to confirm that your environment satisfies the specifications required to operate Infrastructure Optimizer.
| Info |
|---|
The pre-check commands will require the IAM principal to have at least the |
Network
By default, Infrastructure Optimizer schedules workload in private subnets to protect them from direct external accesses.
Use the following commands to ensure that the AWS VPC where Infrastructure Optimizer will run has at least one private subnet with public NAT Gateways.
Check private subnets that are suitable for running the Infrastructure Optimizer workload Workers:
| Code Block |
|---|
aws ec2 describe-subnets --filter Name=vpc-id,Values=<vpc_id> --query 'Subnets[?MapPublicIpOnLaunch==`false`].SubnetId' |
Check whether there is a public NAT Gateway attached:
| Code Block | ||
|---|---|---|
| ||
aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=<vpc_id> --output json | jq '.NatGateways[] | {NatGatewayId, SubnetId, ConnectivityType}' |
If no private subnets exist, follow the AWS documentation to create a private subnet and a public NAT Gateway.
| Info |
|---|
EKS only: the Infrastructure Optimizer must run in the same VPC as the EKS cluster |
Security
A pre-provisioned, user-managed SSH key pair is required to access the Infrastructure Optimizer Management Server.
| Info |
|---|
OPTIONAL: Follow the AWS EC2 documentation to generate a SSH key pair. |
For environments with existing PKI setup, the x509 certificates, private key, and optionally, intermediate chain certificates and CA certificates will also be needed.
Compute
Infrastructure Optimizer runs on the following OSes:
Rocky Linux
Permissions
Installations and Deployment
The following file contains the minimum IAM permissions required by the AWS IAM principal used to install Infrastructure Optimizer:
| View file | ||
|---|---|---|
|
| Expand | ||
|---|---|---|
| ||
|
Management Server IAM Role
| Expand | |||||||
|---|---|---|---|---|---|---|---|
| |||||||
Type: Customer managed
|
Controller IAM Role
| Expand | |||||
|---|---|---|---|---|---|
| |||||
Type: Customer managed
|
Worker IAM Role
...
| title | Least privilege IAM policies required by workers |
|---|
| Info |
|---|
This is required for EKS users only. |
Type: AWS Managed
...
Policy
...
Explanation
...
AmazonEC2ContainerRegistryReadOnly
...
This allows read-only access to Amazon EC2 Container Registry repositories
...
AmazonEKS_CNI_Policy
...
This provides the Amazon VPC CNI Add-on permissions it requires to modify the IP address configuration on your EKS worker nodes
...
AmazonEKSWorkerNodePolicy
...
This allows Amazon EKS worker nodes to connect to Amazon EKS Clusters
...
AmazonSSMManagedInstanceCore
...
This is to enable AWS Systems Manager service core functionality
...
AmazonEBSCSIDriverPolicy
...
This allows the CSI driver service account to make calls to related services such as EC2
Type: Customer Inline
...
Policy
...
Explanation
...
ModifyEC2InstanceMedataReponseHopLimit
...
This allows worker nodes to modify the instance metadata parameters on a running or stopped EC2 instance
...
UnassignPrivateIpAddresses
...
This denies unassigning one or more secondary private IP addresses, or IPv4 Prefix Delegation prefixes from a network interface
...
| language | json |
|---|
...
EC2 Instance Profiles
The Infrastructure Optimizer Controllers and Workers require a set of IAM permissions to manage and scale your workloads efficiently. Use this CloudFormation template to create the EC2 instance profiles.
| View file | ||
|---|---|---|
|
| Info |
|---|
When completed, the roles and instance profile ARNs outputs by CloudFormation will be needed for subsequent installation steps. |