Information Security and Access Control Design for vRealize Suite Lifecycle Manager
You protect the vRealize Suite Lifecycle Manager deployment by configuring authentication and secure communication with the other components in the SDDC. You dedicate a service account to the communication between vRealize Suite Lifecycle Manager and vCenter Server.
You use a custom role in vSphere with permissions to perform life cycle operations on vRealize Suite components in the SDDC. A dedicated service account is assigned a custom role for communication between vRealize Suite Lifecycle Manager and the vCenter Server instances in the environment.
Identity Management
Users can authenticate to vRealize Suite Lifecycle Manager by using local administrator accounts or by using Workspace ONE Access
vRealize Suite Lifecycle Manager performs local authentication only for the default administrator account,
vcfadmin@local
. To ensure accountability on user access, you enable authentication with Workspace ONE Access. You can grant both users and groups access to vRealize Suite Lifecycle Manager to perform tasks and initiate orchestrated operations, such as deployment and upgrade of vRealize Suite components and content. See の の設計.Service Accounts
Configure a service account for communication between vRealize Suite Lifecycle Manager and vCenter Server endpoint instances. You assign a service account with only the minimum set of permissions to perform inventory data collection and life cycle management operations for the instances defined in the data center.
Password Management
To ensure continued access to the vRealize Suite Lifecycle Manager appliance, you must rotate the appliance
root
password on or before 365 days after deployment.Certificate Management
Access to all vRealize Suite Lifecycle Manager endpoint interfaces requires an SSL connection. By default, vRealize Suite Lifecycle Manager uses an appliance certificate signed by VMware Certificate Authority (VMCA). To provide secure access to the vRealize Suite Lifecycle Manager and between SDDC endpoints, replace the default VMCA-signed certificate with a CA-signed certificate.