// Module included in the following assemblies:
//
// * rosa_hcp/rosa-hcp-aws-private-creating-cluster.adoc

:_mod-docs-content-type: PROCEDURE
[id="rosa-hcp-aws-private-security-groups_{context}"]
= Adding additional AWS security groups to the AWS PrivateLink endpoint

[role="_abstract"]
The AWS PrivateLink endpoint in the host VPC has a default security group that restricts access to the cluster's Machine CIDR range. To grant API access from outside the VPC, you must create and attach an additional security group to the PrivateLink endpoint.

[IMPORTANT]
====
Adding additional AWS security groups to the AWS PrivateLink endpoint is only supported on {product-title} version 4.17.2 and later.
====

.Prerequisites

* Your corporate network or other VPC has connectivity.
* You have permission to create and attach security groups within the VPC.

.Procedure

. Set your cluster name as an environmental variable by running the following command:
+
[source,terminal]
----
$ export CLUSTER_NAME=<cluster_name>
----
+
Verify that the variable exists by running the following command:
+
[source,terminal]
----
$ echo $CLUSTER_NAME
----
+
.Example output
[source,terminal]
----
hcp-private
----

. Find the VPC endpoint (VPCE) ID and VPC ID by running the following command:
+
[source,terminal]
----
$ read -r VPCE_ID VPC_ID <<< $(aws ec2 describe-vpc-endpoints --filters "Name=tag:api.openshift.com/id,Values=$(rosa describe cluster -c ${CLUSTER_NAME} -o yaml | grep '^id: ' | cut -d' ' -f2)" --query 'VpcEndpoints[].[VpcEndpointId,VpcId]' --output text)
----
+
[WARNING]
====
Modifying or removing the default AWS PrivateLink endpoint security group is not supported and might result in unexpected behavior.
====
+
. Create an additional security group by running the following command:
+
[source,terminal]
----
$ export SG_ID=$(aws ec2 create-security-group --description "Granting API access to ${CLUSTER_NAME} from outside of VPC" --group-name "${CLUSTER_NAME}-api-sg" --vpc-id $VPC_ID --output text)
----

. Add an inbound (ingress) rule to the security group by running the following command:
+
[source,terminal]
----
$ aws ec2 authorize-security-group-ingress --group-id $SG_ID --ip-permissions FromPort=443,ToPort=443,IpProtocol=tcp,IpRanges=[{CidrIp=<cidr-to-allow>}]
----

. Add the new security group to the VPCE by running the following command:
+
[source,terminal]
----
$ aws ec2 modify-vpc-endpoint --vpc-endpoint-id $VPCE_ID --add-security-group-ids $SG_ID
----
+
You can now access the API of your {product-title} private cluster from the specified CIDR block.
