Set up Micetro to discover AWS Organizations - Micetro - 26.1.0

Prerequisites

The following are prerequisites for using Organization discovery for AWS services in Micetro:

• The accounts that Micetro should manage must be members of the Organization that Micetro is integrating.
• The entity that runs the Micetro Agents used for the integration must be able to perform API calls to read data from the AWS Organization. Therefore, there must be a role on the Organization Account that Micetro can assume to perform the API calls OR Micetro must be running on the Organization Account.
• A role that Micetro can assume to manage the accounts' IPAM/DNS resources must exist on those accounts. For more information, refer to Configure AWS accounts for discovery.
• The Micetro Agents (DNS/DHCP) must be running, because they handle the discovery of accounts and IPAM/DNS data from the AWS cloud. For more information about setting up the agents, refer to the following pages:
  • On Windows: Installing Micetro DNS Agents on Windows and Installing Micetro DHCP Agents on Windows
  • On Linux: Installing Micetro DNS Agents on Linux and Installing Micetro DHCP Agents on Linux

Setting up Organization discovery in Micetro

To set up Organization discovery in Micetro:

1. Follow the instructions to add an AWS service to Micetro.
2. Select the Agent where the Micetro cloud functionality will run for the cloud service. All communication with the cloud service will be made from this host. The agent can be:
   • the Central host
   • an EC2 instance
   • or a different host running elsewhere
   Note: The DNS, DHCP, and Update Agents must be running on the host.
3. Choose the Authentication method Micetro will use to connect to AWS to manage your accounts:
   1. With an AWS access key. In this case, you must enter the key into the Access key ID and Secret access key fields.
   2. Using instance role authentication. In this case, Micetro uses the role assigned to the AWS EC2 instance that the agents are running on to authenticate with AWS. Depending on your requirements, the instance role should have one of the following access permissions:
      • If you're using a single AWS instance, make sure the instance role has the appropriate IAM and EC2 access. For a list of required permissions, refer to Permissions for integrating AWS cloud services with Micetro.
      • If you're using an AWS multi-account setup: Enable access to assume other roles. For instructions on how to configure an AWS account to assume roles in other accounts, refer to Configuring AWS multi-account setup .
      For instructions on how to set up instance role authentication, refer to IAM roles for Amazon EC2.
   Note: Security best practices recommend running the agents on an AWS EC2 instance and using instance roles for authentication to avoid needing to manage long-lived credentials for the Micetro integration.
4. In the dialog, make sure to check the Use organization discovery checkbox. This option determines whether Micetro should discover AWS accounts to manage by reading from the Organization or by using the fallback method of policy parsing instead.
5. Enter the following information:
   • Account management role name: The name of the role that Micetro will assume on member accounts of the AWS Organization to check whether it has access to manage resources there. This role must be assumable by the entity running Micetro and must exist on the accounts in the Organization.
     Note: This is not the ARN for the role. Micetro automatically determines the ARN using the account IDs discovered.
   • Organization management role ARN: The ARN of a role that Micetro will assume to read data from the AWS Organization, including accounts and organizational units. If no ARN is specified, Micetro assumes that the agent is running on the Organization Account and that it has access to the Organization API without assuming a role. The role ARN format is: arn:aws:iam::<Account Role Number>:role/<Role name>.
   • (Optional) Ignore list: By default, Micetro operates under the assumption that it can assume the Account management role on all member accounts in the Organizations. However, there may be accounts or organizational units that you want Micetro to avoid during discovery. The Ignore list allows you to specify account IDs and organizational units IDs on which Micetro should not try to assume roles during the discovery. IDs on the list should be separated by newlines or commas.
   • (Optional) Regions to exclude: Select this option to skip discovery and management of resources in specific regions. Then select the AWS regions where discovery should not be run. Account-specific exclusions become available after the service has been added to Micetro and can be added by editing the service properties.

Required Organization-level access

Micetro requires access to the following Organization API calls for organizational discovery:

• list-accounts
• list-accounts-for-parent

Troubleshooting

The Micetro DHCP Agent selected for the integration handles the account discovery. If the integration fails, the log level of the Agent can be raised to 7. To change log levels, refer to the Logging settings section of the system settings.

The Agent will log the entire discovery process. By reading the log, you can discern why the AWS integration is not completing successfully. The most likely causes include the following:

• Micetro cannot read from the AWS Organization because it doesn't have appropriate access.
  • If using a role to read from the Organization, make sure that Micetro can assume the role and that the role lists Organization accounts.
  • If not using a role, make sure that Micetro is running on the Organization Account.
• Micetro cannot assume the role that it should use for account management on the Organization's Member Accounts. The potential causes of this issue may be that the role does not exist or that a trust relationship has not been set up in the role or user/instance where Micetro is running so it doesn't have access to assume rules in general.