Configuring AWS multi-account setup - Micetro - 26.1.0

Creating a group with user access to roles on other accounts

When creating a group with user access to roles on other accounts, you can either select an existing user or create a new one. You can either do this in the AWS Management Console or using the AWS CLI command [iam|create-user].

To create a group:

1. Open IAM service in the management console.
2. Select Users on the left menu or under IAM resources.
3. Either select an existing user or create a new user by selecting Add user and following the wizard’s steps.
   • If creating a new user, make sure you allow programmatic access to generate an access key ID and secret access key pair for adding the account to Micetro.
   • Attach the IAMReadOnlyAccess policy to the user.
   • If you want to manage Route 53 and VPCs on this account, also attach the access policies needed to manage Amazon Route 53 and EC2. For more information about permissions, refer to Permissions for integrating AWS cloud services with Micetro.
4. Create a group either through the AWS Management Console or using the AWS CLI command [iam|create-group].
   Note: Make sure to create the group under the account where the user is located.
   • Under IAM service, select Groups, then select Create New Group.
   • You’ll be prompted to attach policies to the group. Select Next Step.
   • Review the settings and then select Create Group.
5. Add the user to the group, either through the AWS Management Console or using the AWS CLI command [iam|add-user-to-group].
   • On the Groups menu, access the group you created in the previous step.
   • On the Users tab, select Add Users to Group.
   • Select user you want to add, and then select Add Users.

Creating and configuring roles for each account

Next, create and configure roles for each account.

1. Create a role:
   1. In the AWS Management Console, log in to the account that the user should have access to.
   2. Open the IAM service.
   3. Select Roles on the left menu or under the IAM resource.
   4. Select Create role.
2. Choose a trusted entity:
   • Select Another AWS account as the trusted entity type.
   • Enter the Account ID of the account containing the user who needs access.
   • Select Next: Permissions.
3. Attach necessary policies for Micetro by searching for them by name and selecting them:
   • AmazonRoute53FullAccess to manage hosted DNS zones.
   • AmazonEC2FullAccess to manage cloud networks and ranges.
   • IAMReadOnlyAccess so that Micetro can access the account alias. This does not need to be attached if you do not want AWS account aliases to be displayed in Micetro.

   Select Next: Tags.

   You can also attach policies using the AWS CLI command [iam|attach-role-policy].

4. (Optional) Add tags to the role for organization, and then select Next: Review.
5. Name and create role:
   • Add a name for the role and enter a brief description.
   • Select Create role.

Adding inline group policies for roles

Follow these instructions for each account that the user should have access to.

1. Locate the account where the user is located.
2. Locate the group that contains the user, which you created in the first step.
3. Create a group policy in the group for each account the user needs access to. This enables them to assume the role that was created on that account.
4. Either in the AWS Management Console or using the AWS CLI command [iam|put-grouppolicy], add inline group policies:
   1. Log in to the account containing the group with the user.
   2. Open the IAM service.
   3. Go to Groups.
   4. Locate the group created in the first step and open it.
5. Create a custom policy:
   1. On the Permissions tab, select Add permissions and Create new inline policy.
   2. In the Policy editor, select JSON and paste the following code:

      {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "",
                "Effect": "Allow",
                "Action": "sts:AssumeRole",
                "Resource": "arn:aws:iam::123456789012:role/RoleName"
            }
        ]
      }

      Replace 123456789012 with the account ID of the role’s location and RoleName with the role’s name.

   3. In the last step, enter a policy name and select Create policy.

After configuring the accounts

Once you have added policies to the group for all roles, you can add the accounts to Micetro using the API credentials of the user in the group.

For detailed instructions on adding AWS accounts to Micetro, refer to Integrating cloud services.