IAM Role Manual Setup

To set up an Identity and Access Management (IAM) role, consider using the CloudFormation Template that greatly simplifies creation of the role. However, if you prefer to create the role manually, you can do so.

About This Task

To set up an AWS integration in Virtana Platform using the IAM Role, you must complete tasks in both the AWS Console and in Virtana Platform.

After creating your IAM role, wait 2-5 minutes for AWS to finalize its creation before proceeding to the next steps. This ensures the new role has the correct S3 access permissions when added to Virtana Platform.

You can view a list of permissions granted by the IAM role.

Prerequisites

You must have administrator access to both the Virtana Platform and the AWS consoles.
You must have enabled Cost Explorer and created a Cost and Usage Report in AWS.

Tip

If you already have an existing IAM role for Virtana Platform but it does not include in-line policies for Cost Explorer or Cost and Usage Reports, you only need to add the policies to the IAM role.

Perform the following three tasks.

Create an Inline Policy for Cost Explorer API Access

Inline policies provide a one-to-one relationship between a specific policy and a specific user, role, or group. In this case, the inline policy will be embedded in the IAM Role, when that role is created.

In your AWS Console, search for IAM, and select the IAM service.
In the navigation pane, select Access Management > Policies and click Create Policy.

Select the JSON tab and replace the default content with the following code:

{
   "Version": "2012-10-17",
   "Statement": [
    {
      "Action": "ce:Get*",
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

Click Next: Tags and add any needed tags.
Adding tags is optional.
Click Next: Review and provide a descriptive Name for the policy.
Example: CostExplorerAPIReadOnly
Make a note of the policy name, review the permissions summary, and click Create Policy.
You will need the policy name to attach this customer managed policy to your IAM role.

Create an In-Line Policy for Cost and Usage Report Read Access

In your AWS Console, search for IAM, and select the IAM service.
The Identity and Access Management (IAM) dashboard displays.
In the navigation pane, select Access Management > Policies and click Create Policy.

Select the JSON tab and replace the default content with the following code:

{   
  "Version": "2012-10-17",
  "Statement": [
    {
       "Effect": "Allow",
       "Action": "cur:DescribeReportDefinitions",
       "Resource": "*"
    }
  ] 
}

Click Next: Tags and add any needed tags.
Adding tags is optional.
Click Next: Review and provide a descriptive Name for the policy.
Example: ReadCostAndUsageReportDefinitions
Make a note of the policy name, review the permissions summary, and click Create Policy.
You will need the policy name to attach this customer managed policy to your IAM role.

Create an IAM Read-Only Role Manually

AWS Identity and Access Management (IAM) roles provide the ability to grant permissions to trusted entities. IAM roles issue temporary security credentials that are only valid for a role session, providing greater security. The IAM read-only role will be used to allow Virtana Platform modules to access AWS APIs.

About This Task

To create an IAM role, you need to perform the following in AWS:

Create the IAM role.
Select and configure one of the following options:
- Standard permissions
  The simplest setup. Provides read-only access to everything.
- Minimal cost permissions
  The most secure setup. Provides Virtana Platform access only to services for which Virtana Platform is collecting data. This would include cost reports and performance metrics for the Cloud Cost Management module.
  Must be created before being assigned to an IAM Role.
- Management account permissions
  Provides read-only access only for Cost and Usage Reports for a single S3 bucket for a particular customer.

Prerequisites

You need the Account ID and External ID values for the AWS Integration, located on the integration setup form in Virtana Platform (Settings > Integrations > Cloud Providers > Add Integration).
You need the name of the S3 bucket associated with the integration you are creating.
This is found under AWS Services in the Cost & Usage Reports section.

Steps

In your AWS Console, search for IAM, and select the IAM service.
The Identity and Access Management (IAM) dashboard displays.
In the navigation pane, select Access Management > Roles and click Create Role.
For "type of trusted entity", select AWS Account and then select Another AWS Account.
Provide the Account ID from your Virtana Platform AWS Integration.
This identifies the Virtana Platform account as the user of this role.
Check Require external ID and provide the External ID from your Virtana Platform AWS Integration.
Leave Require MFA unchecked.
Click Next: Permissions.
Define and assign to the read-only role ONE of the following three role permissions available in AWS.
- sidebar. Standard Permissions
  Standard permissions grant blanket read-only access to collect CloudWatch performance metrics and billing files from S3.
  Steps
  Under Attach permission policies, search for ReadOnlyAccess, locate it in the results, and select the checkbox to attach the permissions to the role you are creating:
  Be sure to select the checkbox. Selecting the policy name displays details about the policy.
  Next, attach to the IAM role the 2 in-line policies you previously created:
  Click Filter policies and select Customer managed.
  Clear any text in the search field.
  Find and click the checkbox to select the Cost Explorer in-line policy you created.
  Example: CostExplorerAPIReadOnly
  Find and click the checkbox to select the Cost and Usage Reports in-line policy you created.
  Example: ReadCostAndUsageReportDefinitions
  Under Set permissions bouindary, ensure the default of Create role without a permission boundary is checked.
  Click Next: Tags and add any needed tags.
  Adding tags is optional.
  Click Next: Review, add the Role Name, and click Create Role.
  You are returned to the IAM Roles list, which displays the new role name.
  In the list, click the name of the role you just created and make a note of the Role ARN value displayed in the Summary.
  You will need to enter this value in the integrations settings in Virtana Platform.
  Next Steps
  Enter the AWS Values in Virtana Platform
- sidebar. Minimal Cost Permissions
  This setup method grants read-only access to collect CloudWatch performance metrics and billing files. It is limited to only the AWS services for which Virtana Platform Cloud Cost Management (CCM) provides cost reports.
  Steps
  Open another browser window and access your AWS Console.
  Navigate to Find Services, search for IAM, and select the IAM service.
  In the navigation pane, select Access Management > Policies and click Create Policy.
  Select the JSON tab and replace the default content with the following code:
  { "Version": "2012-10-17", "Statement": [ { "Action": [ "cloudwatch:Get*", "cloudwatch:List*", "cloudwatch:Describe*", "ec2:Get*", "ec2:Describe*", "elasticloadbalancing:Describe*", "iam:Get*", "rds:Describe*", "rds:List*", "s3:Get*", "s3:List*", "s3:Describe*", "tag:Get*", "tag:Describe*" ], "Effect": "Allow", "Resource": "*" } ] }
  Click Next: Review and provide a descriptive Name for the policy.
  Example: MinimalReadonlyCost
  Make a note of the policy name, review the permissions summary, and click Create Policy.
  You will need the policy name to attach this customer managed policy to your IAM role.
  Return to the first browser displaying the Create role > Attach permission policies page.
  Attach to the role the read-only policy and the 2 in-line policies you created:
  Click Filter policies and select Customer managed.
  Clear any text in the search field.
  Locate the 3 policies in the list and select the checkboxes to attach the permissions to the role.
  Minimal read-only cost policy
  Example: MinimalReadonlyCost
  In-line policy for cost explorer API access
  Example: CostExplorerAPIReadonly
  In-line policy for cost and usage report read access
  Example: ReadCostAndUsageReportDefinitions
  Be sure to select the checkbox. Selecting the policy name displays details about the policy.
  Click Next: Tags and add any needed tags.
  Adding tags is optional.
  Click Next: Review, add the Role Name, and click Create Role.
  You are returned to the IAM Roles list, which displays the new role name.
  In the list, click the name of the role you just created and make a note of the Role ARN value displayed in the Summary.
  You will need to enter this value in the integrations settings in Virtana Platform.
  Next Steps
  Enter the AWS Values in Virtana Platform
- sidebar. Management Account Permissions
  This setup method provides a shared management account with limited access. It grants read-only access to collect billing files from a single s3 bucket that can be located in a management account.
  The management account permissions are useful if you store billing files in a shared management account and need to grant Cloud Cost Management (CCM) restricted access to one specific S3 bucket.
  Note
  CCM only reads the costs for accounts that CCM monitors. Data for unrelated accounts is discarded.
  Prerequisites
  You need the name of the AWS bucket associated with your CUR files.
  Steps
  Open another browser window and access your AWS Console.
  Navigate to Find Services, search for IAM, and select the IAM service.
  In the navigation pane, select Access Management > Policies and click Create Policy.
  Switch to the JSON tab, replace the existing content with the following code, and replace 2 instances of your-bucket-name in the code with the name of the bucket associated with your CUR files.
  Example: Eng_bucket
  There are two instances of your-bucket-name that need replacing.
  { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::your-bucket-name" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::your-bucket-name/*" ] } ] }
  Click Next: Review and provide a descriptive Name for the policy.
  Example: EngBucketReadOnly
  Make a note of the policy name, review the permissions summary, and click Create Policy.
  You will need the policy name to attach this customer managed policy to your IAM role.
  Return to the first browser displaying the Create role > Attach permission policies page.
  Attach to the role the read-only policy and the 2 in-line policies you created:
  Click Filter policies and select Customer managed.
  Clear any text in the search field.
  Locate the 3 policies in the list and select the checkboxes to attach the permissions to the role.
  Be sure to select the checkbox. Selecting the policy name displays details about the policy.
  Management account read-only policy
  Example: EngBucketReadonly
  In-line policy for cost explorer API access
  Example: CostExplorerAPIReadonly
  In-line policy for cost and usage report read access
  Example: ReadCostAndUsageReportDefinitions
  Click Next: Tags and add any needed tags.
  Adding tags is optional.
  Click Next: Review, add the Role Name, and click Create Role.
  You are returned to the IAM Roles list, which displays the new role name.
  In the list, click the name of the role you just created and make a note of the Role ARN value displayed in the Summary.
  You will need to enter this value in the integrations settings in Virtana Platform.
  Next Steps
  Enter the AWS Values in Virtana Platform

In this section: