Skip to content

Commit 1e34af2

Browse files
Y0CossY0Coss
authored
Merge pull request #6725 from ovh/HK-Public-Cloud-Best_Practises_Project_Structuring
Hk public cloud best practises project structuring
2 parents 845f920 + e5a7f90 commit 1e34af2

20 files changed

+2172
-0
lines changed

Diff for: ‎pages/index.md

+1
Original file line numberDiff line numberDiff line change
@@ -559,6 +559,7 @@
559559
+ [Public Cloud FAQ - Change of monthly billing method](public_cloud/compute/faq_change_of_monthly_billing_method)
560560
+ [Local Zone Compute - Features, Capabilities and Limitations](public_cloud/compute/local-zones-capabilities-limitations)
561561
+ [Project management](public-cloud-compute-project-management)
562+
+ [Securing and Structuring your public cloud projects](public_cloud/compute/securing_and_structuring_projects)
562563
+ [How to increase Public Cloud quotas](public_cloud/compute/increasing_public_cloud_quota)
563564
+ [Deleting a Public Cloud project](public_cloud/compute/delete_a_project)
564565
+ [Delegating projects](public_cloud/compute/delegate_projects)

Diff for: ‎pages/public_cloud/compute/securing_and_structuring_projects/guide.de-de.md

+145
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
---
2+
title: 'Best Practices for securing & structuring OVHcloud Public Cloud Projects (EN)'
3+
excerpt: 'Learn how to secure your OVHcloud account, manage identities, implement best practices for structuring your Public Cloud projects and use IAM policies to restrict access rights'
4+
updated: 2024-09-23
5+
---
6+
7+
## Objective
8+
9+
**This guide explains how to secure your OVHcloud account, manage identities, implement best practices for structuring your Public Cloud projects and use IAM policies to restrict access rights**
10+
11+
## Requirements
12+
13+
- An active OVHcloud account
14+
- Access to the [OVHcloud Control Panel](/links/manager)
15+
16+
## Instructions
17+
18+
### Step 1: Securing Your Account
19+
20+
The "[Securing my OVHcloud account and managing my personal information](/pages/account_and_service_management/account_information/all_about_username)" guide provides general best practices for account management and is a good place to start.
21+
22+
#### Enable Two-Factor Authentication (2FA)
23+
24+
- **What it does**: Adds an extra layer of security by requiring a second form of verification (e.g., mobile app, security key) in addition to your password.
25+
- **How to enable it**: Log in to the [OVHcloud Control Panel](/links/manager), click your name in the top right-hand corner, then on your initials. Next, click on `Security`{.action} and follow the steps to set up 2FA using a mobile app or security key. Ensure you store your backup codes securely. For more information see: [Securing your OVHcloud account with two-factor authentication](/pages/account_and_service_management/account_information/secure-ovhcloud-account-with-2fa).
26+
- **Example**: If you use a U2F security key, you will plug it into your USB port each time you log in, providing an additional security measure beyond your password.
27+
28+
#### Set Strong Passwords
29+
30+
The [Password management guide](/pages/account_and_service_management/account_information/manage-ovh-password) provides best practices with regards to the password management.
31+
32+
#### Add a Backup Email Address
33+
34+
- **Importance**: Allows you to recover access to your account if the primary email is inaccessible.
35+
- **Configuration**: Add a backup email in the OVHcloud Control Panel under your profile settings, ensuring it differs from your primary email address. See the "[Securing my OVHcloud account and managing my personal information](/pages/account_and_service_management/account_information/all_about_username)" guide.
36+
37+
### Step 2: Understanding Identity and Access Management (IAM) and creating Identities
38+
39+
**Definition**: IAM is a framework for managing user identities and their access to resources securely.
40+
41+
**Implementation**: Use IAM features to manage identities, groups, and policies in OVHcloud IAM.
42+
43+
**Key Components**:
44+
45+
1. **Identities**: Individual accounts for people (users) or service accounts that need access to OVHcloud resources.
46+
2. **Groups**: Collections of users or resources with common access needs.
47+
3. **Policies**: Rules that define the actions that users and groups can perform on resources.
48+
49+
**Examples**:
50+
51+
- **Managing identities**: 3 types of identities are supported and presented in the following guide: [Presentation of identities that can interact within an OVHcloud account](/pages/manage_and_operate/iam/identities-management)
52+
- Local users: identities representing a person in your organisation and associated to your OVHcloud account. For more information, see [Creating and managing local users on an OVHcloud account](/pages/account_and_service_management/account_information/ovhcloud-users-management).
53+
- Service accounts: are used for 'machine to machine' interaction. Service accounts are also associated with your OVHcloud account. For more information, see [Managing OVHcloud service accounts via the API](/pages/manage_and_operate/api/manage-service-account) and [How to use service accounts to connect to OVHcloud APIs](/pages/account_and_service_management/account_information/authenticate-api-with-service-account).
54+
- Federated identities: multiple federation protocols / providers are supported and documented: [AD FS](/pages/account_and_service_management/account_information/ovhcloud-account-connect-saml-adfs), [Google Workspace](/pages/account_and_service_management/account_information/ovhcloud-account-connect-saml-google-workspace), [Entra ID](/pages/account_and_service_management/account_information/ovhcloud-account-connect-saml-azure-ad) or [OKTA](/pages/account_and_service_management/account_information/ovhcloud-account-connect-saml-okta)
55+
- **Grouping Users**: Create groups such as "Developers", "Admins", and "Auditors" to simplify permissions management. If you have chosen to create local users, then use the instructions in the [following guide](/pages/account_and_service_management/account_information/ovhcloud-users-management) to create local user groups. If you have chosen Identity Federation, then the group shall be defined in your identity provider, provided in the SAML ticket and mapped to an OVHcloud group. This step is detailed in each Identity provider documentation page.
56+
- **Defining Policies**: Assign policies to identities and groups to restrict or grant access. For example, a developer might have permissions to deploy applications but not to manage billing information. This [guide](/pages/account_and_service_management/account_information/iam-policy-ui) defines how to use IAM policies using the OVHcloud Control Panel.
57+
58+
### Step 3: Best Practices for Structuring Public Cloud Projects
59+
60+
Public Cloud projects enable resources to be separated from the access rights associated with them.
61+
62+
The pattern to split the projects can be:
63+
64+
- **Domain**: the domain inside your company e.g. finance, IT, marketing, sales, etc.
65+
- **Application id:** the identifier of the application. It could be its name or an id from the Application Portfolio of your entreprise.
66+
- **Environment**: the environment e.g. dev, QA, staging, prod.
67+
68+
A prefix can be used to facilitate the management of the resources.
69+
70+
For example, if we use the pattern defined above, we could have the following cloud projects names:
71+
72+
- cloud_project_finance_invoicing_qa
73+
- cloud_project_it_collaboration_staging
74+
- cloud_project_it_monitoring_prod
75+
- cloud_project_marketing_analytics_dev
76+
- cloud_project_marketing_automation_qa
77+
- cloud_project_sales_cpq_staging
78+
- cloud_project_sales_ecommerce_dev
79+
80+
### Step 4: Providing Role-Based Access Control (RBAC) to Public Cloud projects through IAM Policies
81+
82+
Now that you have identities and projects, you can define the access rights for each project. We recommend using groups rather than individual identities to define a policy, as this makes it easier to manage the policy lifecycle.
83+
84+
In the following example, we will use two groups called `finance_developer_group` and `finance_SRE_group`, which contain the identities of the users who are developing and those ensuring that the finance application is in production in a healthy state.
85+
86+
For this example, we will take a tool used by the finance team to make their financial planning and analysis (FPA). In this fictive case, we will have 3 Public Cloud projects managing the resources of three environments (development, staging and production). The projects are named:
87+
88+
- `cloud_project_finance_fpa_dev`
89+
- `cloud_project_finance_fpa_staging`
90+
- `cloud_project_finance_fpa_prod`
91+
92+
The following table sums up the access rights we will provide to each groups in the example. The access policies are provided for educational purpose and shall be adapted to your context.
93+
94+
| Public Cloud project name | `finance_developer_group` | `finance_SRE_group` |
95+
|------|------|------|
96+
|`cloud_project_finance_fpa_dev`|read write | no access |
97+
|`cloud_project_finance_fpa_staging`| read | read write|
98+
|`cloud_project_finance_fpa_prod`| no access | read write |
99+
100+
#### Provide Control Panel access
101+
102+
In order to provide access to the OVHCloud control Panel, you need to create a specific policy as described in the [following guide](/pages/account_and_service_management/account_information/iam-control-panel-access) and in the `Add user groups`, choose the groups `finance_developer_group` and `finance_SRE_group`.
103+
104+
![Add user groups](images/Add_user_groups.png){.thumbnail}
105+
106+
Thanks to this policy, the user belonging to these 2 groups will have access to the Control Panel but, because of this policy, they do not have the right to view/manage any resources. The following chapter adds that.
107+
108+
#### Provide specific rights to Public Cloud
109+
110+
Let's continue by creating policies in order to enable the access rights tables described above. For that we will create 4 policies summarized below.
111+
112+
| Policy name | Identities | Actions | Resources |
113+
| ------------------------------------ | ----------------------- | ----------------- | --------------------------------- |
114+
| cloud_project_finance_fpa_dev-RW | finance_developer_group | globalWriteAccess | cloud_project_finance_fpa_dev |
115+
| cloud_project_finance_fpa_staging-RO | finance_developer_group | globalReadAccess | cloud_project_finance_fpa_staging |
116+
| cloud_project_finance_fpa_staging-RW | finance_SRE_group | globalWriteAccess | cloud_project_finance_fpa_staging |
117+
| cloud_project_finance_fpa_prod-RW | finance_SRE_group | globalWriteAccess | cloud_project_finance_fpa_prod |
118+
119+
120+
The policy naming follows the following pattern : \<Name of the resource\>-RO/RW
121+
122+
Here is a step by step guide to create the first policy:
123+
124+
- Into IAM page `Create a Policy`{.action}, fill in the name `cloud_project_finance_fpa_dev-RW` and a description.
125+
- Then click on `Add user groups`{.action}, choose the group `finance_developer_group`.
126+
- Under `Product types`, choose `Public Cloud project`{.action}.
127+
- Under `Resources`, select the target public cloud project `cloud_project_finance_fpa_dev`.
128+
129+
![Add Product types & resources](images/Product_types_resources.png){.thumbnail}
130+
131+
- Under `Actions` in `Managed permission groups`{.action}, leave `Authorize all actions` unchecked and choose `globalWriteAccess`{.action}.
132+
133+
![Actions](images/Actions.png){.thumbnail}
134+
135+
Now the users belonging to the `finance_developer_group` will have only access to the Control Panel and to the selected Public Cloud project in write access.
136+
137+
## We want your feedback!
138+
139+
We would love to help answer questions and appreciate any feedback you may have.
140+
141+
If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](/links/professional-services) to get a quote and ask our Professional Services experts for a custom analysis of your project.
142+
143+
Are you on Discord? Connect to our channel at <https://discord.gg/ovhcloud> and interact directly with the team that builds our databases service!
144+
145+
Join our [community of users](/links/community).

0 commit comments

Comments
 (0)