// Module included in the following assemblies:
//
// * rosa_install_access_delete_clusters/rosa_getting_started_iam/rosa-aws-prereqs.adoc
// * rosa_planning/rosa-sts-aws-prereqs.adoc
:_mod-docs-content-type: REFERENCE
[id="rosa-aws-policy-provisioned_{context}"]
= Provisioned AWS Infrastructure

[role="_abstract"]
This is an overview of the provisioned {AWS} components on a deployed {product-title} cluster.

[id="rosa-ec2-instances_{context}"]
== EC2 instances

AWS EC2 instances are required to deploy
ifndef::openshift-rosa-hcp[]
the control plane and data plane functions for
endif::openshift-rosa-hcp[]
{product-title}.
ifndef::openshift-rosa-hcp[]
Instance types can vary for control plane and infrastructure nodes, depending on the worker node count.

At a minimum, the following EC2 instances are deployed:

* Three `m5.2xlarge` control plane nodes
* Two `r5.xlarge` infrastructure nodes
* Two `m5.xlarge` worker nodes
endif::openshift-rosa-hcp[]

ifdef::openshift-rosa-hcp[]
At a minimum, two `m5.xlarge` EC2 instances are deployed for use as worker nodes.
endif::openshift-rosa-hcp[]

The instance type shown for worker nodes is the default value, but you can customize the instance type for worker nodes according to the needs of your workload.

[id="rosa-ebs-storage_{context}"]
== Amazon Elastic Block Store storage

Amazon Elastic Block Store (Amazon EBS) block storage is used for both local node storage and persistent volume storage. By default, the following storage is provisioned for each EC2 instance:

ifndef::openshift-rosa-hcp[]
* Control Plane Volume
** Size: 350GB
** Type: gp3
** Input/Output Operations Per Second: 1000

* Infrastructure Volume
** Size: 300GB
** Type: gp3
** Input/Output Operations Per Second: 900

* Worker Volume
** Default size: 300{nbsp}GiB (adjustable at creation time)
** Minimum size: 128GB
** Type: gp3
** Input/Output Operations Per Second: 900

[NOTE]
====
Clusters deployed before the release of {OCP} 4.11 use gp2 type storage by default.
====
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa-hcp[]
* Node volumes
** Type: `AWS EBS GP3`
** Default size: 300{nbsp}GiB (adjustable at creation time)
** Minimum size: 75{nbsp}GiB

* Workload persistent volumes
** Default storage class: `gp3-csi`
** Provisioner: `ebs.csi.aws.com`
** Dynamic persistent volume provisioning
endif::openshift-rosa-hcp[]

[id="rosa-elastic-load-balancers_{context}"]
== Elastic Load Balancing

ifndef::openshift-rosa-hcp[]
Each cluster can use up to two Classic Load Balancers for application router and up to two Network Load Balancers for API.
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa-hcp[]
By default, one Network Load Balancer is created for use by the default ingress controller. You can create additional load balancers of the following types according to the needs of your workload:

* Classic Load Balancer
* Network Load Balancer
* Application Load Balancer

endif::openshift-rosa-hcp[]
For more information, see the link:https://aws.amazon.com/elasticloadbalancing/features/#Details_for_Elastic_Load_Balancing_Products[ELB documentation for AWS].

[id="rosa-s3-storage_{context}"]
== S3 storage

The image registry is backed by AWS S3 storage. Resources are pruned regularly to optimize S3 usage and cluster performance.

[NOTE]
====
Two buckets are required with a typical size of 2TB each.
====

[id="rosa-vpc_{context}"]
== VPC

Configure your VPC according to the following requirements:

* *Subnets*: Every cluster requires a minimum of one private subnet for every availability zone. For example, 1 private subnet is required for a single-zone cluster, and 3 private subnets are required for a cluster with 3 availability zones.
+
If your cluster needs direct access to a network that is external to the cluster, including the public internet, you require at least one public subnet.
+
Red{nbsp}Hat strongly recommends using unique subnets for each cluster. Sharing subnets between multiple clusters is not recommended.
+
[NOTE]
====
A *public subnet* connects directly to the internet through an internet gateway.

A *private subnet* connects to the internet through a network address translation (NAT) gateway.
====

* *Route tables*: One route table per private subnet, and one additional table per cluster.

* *Internet gateways*: One Internet Gateway per cluster.

* *NAT gateways*: One NAT Gateway per public subnet.

ifndef::openshift-rosa-hcp[]
.Sample VPC Architecture
image::VPC-Diagram.png[VPC Reference Architecture]
endif::openshift-rosa-hcp[]

[id="rosa-security-groups_{context}"]
== Security groups

AWS security groups provide security at the protocol and port access level; they are associated with EC2 instances and Elastic Load Balancing (ELB) load balancers. Each security group contains a set of rules that filter traffic coming in and out of one or more EC2 instances.

Ensure that the ports required for cluster installation and operation are open on your network and configured to allow access between hosts. The requirements for the default security groups are listed in xref:required-secgroup-ports_{context}[Required ports for default security groups].

[id="required-secgroup-ports_{context}"]
.Required ports for default security groups
[cols="2a,2a,2a,2a",options="header"]
|===

|Group
|Type
|IP Protocol
|Port range

ifndef::openshift-rosa-hcp[]
.4+|MasterSecurityGroup
.4+|`AWS::EC2::SecurityGroup`
|`icmp`
|`0`

|`tcp`
|`22`

|`tcp`
|`6443`

|`tcp`
|`22623`
endif::openshift-rosa-hcp[]

.2+|WorkerSecurityGroup
.2+|`AWS::EC2::SecurityGroup`
|`icmp`
|`0`

|`tcp`
|`22`

ifndef::openshift-rosa-hcp[]
.2+|BootstrapSecurityGroup
.2+|`AWS::EC2::SecurityGroup`

|`tcp`
|`22`

|`tcp`
|`19531`
endif::openshift-rosa-hcp[]

|===