Configure AWS accounts for discovery - Micetro - 26.1.0

Micetro Reference Articles
ft:locale
en-US
Product name
Micetro
Version
26.1.0

Before setting up AWS Organization discovery in Micetro, you need to configure your AWS accounts accordingly. This includes ensuring that roles on the AWS accounts exist, allowing Micetro to read organization information and manage the DNS/DHCP resources on those accounts.

To configure your AWS accounts for Organization discovery, you must:

  1. Create the Micetro user or EC2 instance in AWS
  2. Configure your AWS Organization accounts for discovery by creating roles and users on the accounts in the Organization

Creating the Micetro user or EC2 instance in AWS

When managing AWS Organizations in Micetro, it's preferred to use instance authentication with an EC2 instance. This is a security best practice, because you do not need to manage long-lived credentials.

However, you can also manage AWS Organizations from a Micetro user created on the AWS account from which you want to run Micetro.

Use the following tabs for instructions on how to add an EC2 instance or a Micetro user in AWS:

To create the Micetro user:
  1. Log into the Networking Account in AWS, that is, the account from which you want to run Micetro, and create a new user on the IAM page.
  2. In the Set permissions step, select Attach policies directly.
  3. From the permisions list, select the following permissions:
    • AmazonEC2FullAccess or AmazonEC2ReadOnlyAccess
    • AmazonRoute53FullAccess or AmazonRoute53ReadOnlyAccess
    • IAMReadOnlyAccess
  4. Complete the user creation.
To add an EC2 instance for Micetro:
  1. In the AWS Management Console or CLI, create a new role. For instructions, refer to the AWS documentation on creating IAM roles.
  2. Under Trusted entity type, select AWS service.
  3. Under Use case, select EC2.
  4. Add the following permissions to the role:
    • AmazonEC2FullAccess or AmazonEC2ReadOnlyAccess
    • AmazonRoute53FullAccess or AmazonRoute53ReadOnlyAccess
    • IAMReadOnlyAccess
    Note: Refer to Permissions for integrating AWS cloud services with Micetro for a list of required/recommended permissions.
  5. Complete the role creation.
  6. Navigate to EC2 Management.
  7. Launch a new instance.
    • In the Advanced details section, use the IAM instance profile dropdown to select the instance role you created.
    For instructions on launching AWS EC2 instances, refer to the Amazon documentation on how to launch an Amazon EC2 instance.

You then need to run the Micetro Agents on the EC2 instance. For instructions on setting up the agents to handle the discovery of accounts and IPAM/DNS data from the AWS cloud, refer to Set up Micetro to discover AWS Organizations.

Creating roles and users on the AWS accounts in the Organization

You can also configure your AWS Organization accounts/instances for discovery by creating roles and users with permissions that enable Micetro to manage the related accounts/instances appropriately.

Note: If you are not using instance role authentication—in which Micetro uses the role assigned to the AWS EC2 instance that the agents are running on to authenticate with AWS—you must create and configure users as well as roles.

There are several steps you need to complete:

Step 1: Create the OrganizationRead role

It is a best practice to use an OrganizationRead role, which allows read-only access to the AWS Organization. You should create this role on the Organization Account. As part of the role creation, you need to allow the Micetro user/instance to assume the role.

  1. Log into the Organization Account, which holds the organization information, such as the AWS Organization member accounts, or an AWS account that is a delegated administrator for the Organization.
  2. Navigate to IAM > Roles and select Create role.
  3. Select AWS account as the Trusted entity type.
  4. In the An AWS account section, select to allow entities in other AWS accounts to perform actions in Another AWS account.
  5. Select IAM and then Roles.
  6. Paste the Account ID of the account where you've added the Micetro user/instance in the provided field.
  7. Add the following permission to the role: AWSOrganizationsReadOnlyAccess.
  8. Name the role OrganizationRead.
  9. Under Step 1: Select trusted entities, select Edit. Editing the trust policy will allow the Micetro user/instance to assume the role.
  10. Use the following tabs for instructions on editing the role's trust policy depending on whether you're using a user or an instance:
    If you're using a user account:
    1. Add a principal with the type IAM Users.
    2. Copy the Account ID and User Name for the user created in Creating the Micetro user or EC2 instance in AWS and replace the values in the trust policy. The format should be:
      arn:aws:iam::{Account}:user/{UserName}
    If you're using an instance:
    1. Add a principal with the type IAM Roles.
    2. Enter the instance role's ARN.
  11. In the role's Summary section, copy the ARN. You will specify this ARN when creating a new permission policy on the Networking Account.

Step 2: Create the Micetro account management role

Create a new role that allows the Micetro user/instance to manage the other AWS accounts in the Organization.

In the Organization's Member Accounts:

  1. Create the Micetro account management role:
    1. Select AWS account as the Trusted entity type.
    2. In the An AWS account section, select to allow entities in other AWS accounts to perform actions in Another AWS account.
    3. Select IAM and then Roles.
    4. Paste the Account ID of the account where you've added the Micetro user/instance in the provided field.
    5. Add the following permissions to the role:
      • AmazonEC2FullAccess
      • AmazonRoute53FullAccess
      • IAMReadOnlyAccess
  2. In the role's Summary section, copy the ARN. You will specify this ARN when creating a new permission policy on the Micetro user/instance you want to manage the AWS account information.

Step 3: Allow the Micetro user/instance to assume roles

In the Networking Account, edit the Micetro user/instance's permissions to allow them to assume the account management role and the OrganizationRead role. This allows the user/instance to access and manage DNS/DHCP on each Member Account in the AWS Organization.

Select the appropriate tab for instructions on allowing either a user or instance to assume these roles.

  1. On the IAM page, locate the Micetro user you created in Creating the Micetro user or EC2 instance in AWS and select it.
  2. To grant the user access to assume the role, navigate to the Permissions policies section and use the Add permissions dropdown to select Create inline policy.
    Note: You can also reuse an appropriate existing policy if one already exists.
  3. In the Service dropdown, select STS.
  4. Specify the following Write access permission on STS: AssumeRole. This permission allows the user to assume roles on other accounts.
  5. Add the ARN for each of the account management roles and the OrganizationRead role to the policy.
    Note: Or switch to the JSON editor and use a wildcard (*) for the account ID. This means that it will not need to include every account nor require updating every time a new account is added to the Organization. The following is an example of an account ID that allows for the assumption of a role with the name management-role in all account IDs: "Resource": "arn:aws:iam::*:role/management-role".
    In the Specify ARNs dialog, select Other account and then enter the following information into the provided fields:
    • Resource in: Select Other account and enter the Account ID from the Micetro account management role's ARN, which you copied in Step 2: Create the Micetro account management role.
    • Resource role name with path: Enter the role name.
    • Resource ARN: Enter the resource ARN.
    Repeat this process for the OrganizationRead role:
    • Resource in: Select Other account and enter the Account ID from the OrganizationRead role's ARN, which you copied in Step 1: Create the OrganizationRead role.
    • Resource role name with path: Enter the role name OrganizationRead.
    • Resource ARN: Enter the resource ARN.
  6. Then select Add ARNs. This ensures that this user can only assume this role, which has been explicitly allowed.
  1. In the AWS Management Console, navigate to the Micetro instance.
  2. In the Instance summary, locate the instance's IAM role and select it.
  3. To grant the instance access to assume the role, navigate to the Permissions policies section and use the Add permissions dropdown to select Create inline policy.
    Note: You can also reuse an appropriate existing policy if one already exists.
  4. In the Service dropdown, select STS.
  5. Specify the following Write access permission on STS: AssumeRole. This permission allows the instance to assume roles on other accounts.
  6. Add the ARN for each of the account management roles and the OrganizationRead role to the policy.
    Note: Or switch to the JSON editor and use a wildcard (*) for the account ID. This means that it will not need to include every account nor require updating every time a new account is added to the Organization. The following is an example of an account ID that allows for the assumption of a role with the name management-role in all account IDs: "Resource": "arn:aws:iam::*:role/management-role".
    In the Specify ARNs dialog, select Other account and then enter the following information into the provided fields:
    • Resource in: Select Other account and enter the Account ID from the Micetro account management role's ARN, which you copied in Step 2: Create the Micetro account management role.
    • Resource role name with path: Enter the role name.
    • Resource ARN: Enter the resource ARN.
    Repeat this process for the OrganizationRead role:
    • Resource in: Select Other account and enter the Account ID from the OrganizationRead role's ARN, which you copied in Step 1: Create the OrganizationRead role.
    • Resource role name with path: Enter the role name OrganizationRead.
    • Resource ARN: Enter the resource ARN.
  7. Then select Add ARNs. This ensures that this user can only assume this role, which has been explicitly allowed.

The Micetro user/instance can now fetch and manage data from the Organization.

Next steps

After you've configured these users and roles in AWS, add access keys and/or instance roles that you will need to manage services in Micetro. Refer to the AWS documentation for more information about:

Once you've configured your AWS accounts, you can set up Micetro to read account information from your AWS Organization. For instructions, refer to Set up Micetro to discover AWS Organizations.