:_mod-docs-content-type: ASSEMBLY
include::_attributes/attributes-openshift-dedicated.adoc[]
:context: rosa-fedramp-security-config
[id="rosa-fedramp-security-config"]
= Red{nbsp}Hat {OCP} FedRAMP Rev5 Secure Configuration Guidance

toc::[]

[role="_abstract"]
Complete the Red{nbsp}Hat {OCP} Federal Risk and Authorization Management Program (FedRAMP) Rev5 Secure Configuration Guidance (SCG) requirements so that you have clear guidance on how to securely configure and operate your cloud services. Use the SCG to supplement the Customer Responsibilities Matrix (CRM), giving you actionable steps for securing administrative accounts and system configurations.

When you use SCG on a Red{nbsp}Hat {OCP}, you have the following guidance and capabilities:

* Administrative Account Protection: Comprehensive guidance for securing administrative accounts with dedicated-admin privileges, implementing role-based access control (RBAC), configuring identity providers, and managing privileged access with audit logging and session controls.
* Machine-Readable Formats: Configuration export capabilities in YAML, JSON, and Open Security Controls Assessment Language (OSCAL) formats through the Compliance Operator, enabling automated compliance verification and configuration management.
* API-Driven Configuration: Full programmatic access to all security settings through Kubernetes and OpenShift REST APIs, with official SDKs for many programming languages supporting infrastructure-as-code workflows.

Before you learn guidance for your different administrative roles, complete the following foundational security configuration actions:

* Configure identity providers by setting up Open Authorization (OAuth) integration with your selected enterprise directory service: Lightweight Directory Access Protocol (LDAP), Active Directory, or OpenID Connect (OIDC) provider. After configuring your enterprise identity provider, delete the temporary htpasswd identity provider created by `rosa create admin` to comply with FedRAMP identity requirements.
* Implement RBAC controls by applying role-based access control following the principle of least privilege. Create custom roles for specific administrative functions within the dedicated-admin scope.
* Enable compliance scanning by installing and configuring the Compliance Operator to continuously monitor your cluster against FedRAMP Moderate or High baselines and automatically detect configuration drift.
* Configure audit logging by setting the API server audit profile to `WriteRequestBodies` or higher to capture comprehensive logs of all administrative actions for compliance and forensic purposes.
* Review security context constraints to ensure workloads use the most restrictive SCC possible. The restricted-v2 SCC is recommended, and you should create custom SCCs only when necessary with minimal required privileges.

include::modules/rosa-fedramp-overview.adoc[leveloffset=+1]
include::modules/rosa-fedramp-accounts-config.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_{context}"]
== Additional resources

* link:https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4[Red Hat OpenShift Service on AWS (ROSA) Documentation]
* link:https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/authentication_and_authorization/index[ROSA Authentication and Authorization Guide]
* link:https://docs.redhat.com/en/documentation/red_hat_openshift_service_on_aws/4/html/security_and_compliance/index[ROSA Security and Compliance Guide]