[OSDOCS-20477]: CQA: Managing HCP on AWS (3 of 6)

hosted_control_planes/hcp-manage/hcp-manage-aws.adoc

@@ -29,8 +29,6 @@ include::modules/hcp-managed-aws-infra-iam-separate.adoc[leveloffset=+1]
 
 include::modules/hcp-managed-aws-infra-separate.adoc[leveloffset=+2]
 
-include::modules/hcp-managed-aws-iam-separate.adoc[leveloffset=+2]
-
 include::modules/hcp-managed-aws-hc-separate.adoc[leveloffset=+2]
 
 include::modules/hcp-migrate-aws-single-to-multiarch.adoc[leveloffset=+1]

modules/hcp-managed-aws-hc-separate.adoc

@@ -2,40 +2,56 @@
 //
 // * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc
 
-:_mod-docs-content-type: CONCEPT
+:_mod-docs-content-type: PROCEDURE
 [id="hcp-managed-aws-hc-separate_{context}"]
 = Creating a hosted cluster separately
 
-You can create a hosted cluster separately on {aws-first}.
+[role="_abstract"]
+In {hcp} on {aws-short}, you can create a hosted cluster separately from creating the infrastructure and Identity and Access Management (IAM) resources.
 
-To create a hosted cluster separately, enter the following command:
+.Prerequisites
 
+* You created infrastructure resources separately. For more information, see "Creating the {aws-short} infrastructure separately".
+
+* You created the following IAM resources:
+
+** An OpenID Connect (OIDC) identity provider in IAM, which is required to enable STS authentication. For more information, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html[Create an OpenID Connect (OIDC) identity provider in IAM].
+** Seven roles, which are separate for every component that interacts with the provider, such as the Kubernetes controller manager, cluster API provider, and registry. For more information, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html[IAM role creation].
+** The instance profile, which is the profile that is assigned to all worker instances of the cluster. For more information, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html[Use instance profiles].
+
+.Procedure
+
+* To create a hosted cluster separately, enter the following command:
++
 [source,terminal]
 [subs="+quotes"]
 ----
 $ hcp create cluster aws \
-    --infra-id <infra_id> \// <1>
-    --name <hosted_cluster_name> \// <2>
-    --sts-creds <path_to_sts_credential_file> \// <3>
-    --pull-secret <path_to_pull_secret> \// <4>
-    --generate-ssh \// <5>
-    --node-pool-replicas 3
-    --role-arn <role_name> <6>
+    --infra-id <infra_id> \
+    --name <hosted_cluster_name> \
+    --sts-creds <path_to_sts_credential_file> \
+    --pull-secret <path_to_pull_secret> \
+    --generate-ssh \
+    --node-pool-replicas 3 \
+    --role-arn <role_name> \
+    --render > <file_name>.yaml
 ----
-<1> Replace `<infra_id>` with the same ID that you specified in the `create infra aws` command. This value identifies the IAM resources that are associated with the hosted cluster.
-<2> Replace `<hosted_cluster_name>` with the name of your hosted cluster.
-<3> Replace `<path_to_sts_credential_file>` with the same name that you specified in the `create infra aws` command.
-<4> Replace `<path_to_pull_secret>` with the name of the file that contains a valid {product-title} pull secret.
-<5> The `--generate-ssh` flag is optional, but is good to include in case you need to SSH to your workers. An SSH key is generated for you and is stored as a secret in the same namespace as the hosted cluster.
-<6> Replace `<role_name>` with the Amazon Resource Name (ARN), for example, `arn:aws:iam::820196288204:role/myrole`. Specify the Amazon Resource Name (ARN), for example, `arn:aws:iam::820196288204:role/myrole`. For more information about ARN roles, see "Identity and Access Management (IAM) permissions".
-
-You can also add the `--render` flag to the command and redirect output to a file where you can edit the resources before you apply them to the cluster.
-
-After you run the command, the following resources are applied to your cluster:
-
-* A namespace
-* A secret with your pull secret
-* A `HostedCluster`
-* A `NodePool`
-* Three AWS STS secrets for control plane components
-* One SSH key secret if you specified the `--generate-ssh` flag.
++
+** `--infra-id` specifies the same ID that you specified in the `create infra aws` command. This value identifies the IAM resources that are associated with the hosted cluster.
+** `--name` specifies the name of your hosted cluster.
+** `--sts-creds` specifies the same name that you specified in the `create infra aws` command.
+** `--pull-secret` specifies the name of the file that contains a valid {product-title} pull secret.
+** `--generate-ssh` is an optional flag, but it is good to include in case you need to SSH to your workers. An SSH key is generated for you and is stored as a secret in the same namespace as the hosted cluster.
+** `--role-arn` specifies the Amazon Resource Name (ARN); for example, `arn:aws:iam::820196288204:role/myrole`. For more information about ARN roles, see "Identity and Access Management (IAM) permissions".
+** `--render` is an optional flag. You can include this flag to redirect output to a file where you can edit the resources before you apply them to the cluster.
+
+.Verification
+
+* After you run the command, you can verify that the following resources are applied to your cluster:
++
+** A namespace
+** A secret with your pull secret
+** A `HostedCluster`
+** A `NodePool`
+** Three {aws-short} STS secrets for control plane components
+** If you specified the `--generate-ssh` flag, one SSH key secret.