...
| Table of Contents | ||||||
|---|---|---|---|---|---|---|
|
Define permissions for billing reports
...
Configuring IAM role related permissions in AWS
Log in to the AWS management console.
Open the IAM console and from the navigation pane, choose Roles > Create Role page.
Choose the Another AWS account role type.
For Account ID, type 813367342454. This is AWS Account ID for Aquila Clouds.
Select the Require external ID check box, to enhance security.
In the External ID box, type A2I_COMPANY_EXTERNAL_ID.
Choose Next: Permissions.
Select the check box for the required permission.
Note: Aquila Clouds recommends assigning all permissions to the IAM role to effectively use the Aquila Clouds platform.
Choose Next: Review.
For Role name, type a name for your role. Role names must be unique within your AWS account.
Click Create Role.
Navigate to the Roles page and open the new role.
Select the Trust relationships tab and click Edit trust relationship.
In the Policy Document, next to the Account ID, replace root with user/aquila_product_user.
Save the Policy Document and in the Role Summary, copy the ARN for the role and add it in the Add Environment page of Aquila Clouds.
Figure 1: TRUST RELATIONSHIPS SCREEN The IAM role is created and configured in the AWS platform for Aquila Clouds.
...
Configuring IAM role related permissions in AWS
Login to the Amazon S3 console. Create an S3 bucket to store the daily billing reports of your AWS resources that are generated by AWS.
In the AWS Billing and Cost Management console, create a billing report and schedule daily generation of AWS cost and usage report.
On the navigation pane, choose Cost & Usage Reports.
Choose Reports > Create Report.
For Report name, type the name for your report.
For Additional report details, select Include resource IDs to associate resources with business services and click Next.
In the Configure S3 bucket, select the S3 bucket created in Step 1.
For the Report path prefix, define the required prefix to be prepended to the name of the report.
Note: If you don't specify a prefix, the default prefix is the name that you specified for the report in Step c and the date range for the report, in the following format:
/report-name/date-range/
For Time granularity, select Daily to aggregate report data every day.
Enable the Automatically refresh your Cost & Usage Report when charges are detected for previous months with closed bills checkbox.
Click Next.
Review the settings and click Review and Complete.
S3 bucket is created and AWS is configured to store billing details in the new S3 bucket.
...
Creating IAM role related policy to grant access to the S3 bucket
In the AWS Management Console, in the navigation pane, choose Policies.
On the Welcome to Managed Policies page, click Create Policy.
Choose Create Policies with the Visual Editor.
On the Visual editor tab, choose Choose a service.
Select S3 service.
Choose Select Actions and in the Access level group, select the List and Read check boxes.
In the Resources group, select Specific.
In the bucket section, click Add ARN.
In the Add ARN dialog box, type the required bucket name in the Bucket name box and click Add. For instance, set the bucket name to aquila-billing-bucket.
In the object section, click Add ARN.
In the Add ARN dialog box, type the same bucket name as used for Add ARN (in Step 9) and in the Object name box type *{}(wildcard) and select the Any check box for the Object name. Verify the bucket name and object name in the Specify ARN for Object box. For instance, for the bucket name set to aquila-billing-bucket, the text in Specify ARN for Object box is set to arn:aws:s3::: aquila-billing-bucket/{*}.
This grants permissions to any resource of aquila-billing-bucket type.Figure 3: ADD ARN FOR OBJECT SCREEN.
Click Add.
Click Review policy and type Name and Description for the new policy.
Review the policy summary and click Create Policy.
AWS creates the new policy for Aquila Clouds.In the navigation pane, choose Policies.
From the policies list, select the new policy and in the Policy actions, choose Attach.
Select the IAM role for Aquila Clouds to attach to the policy and choose Attach Policy.
AWS attaches the new policy to the IAM role for Aquila Clouds.Navigate to S3 > Buckets and open the bucket for Aquila Clouds.
In the Json permissions code, set the <bucketname> to the name of the S3 bucket created for Aquila Clouds.
{
Version: 2012-10-17,
Statement: [
{
Effect: Allow,
Principal: {
AWS: 386209384616
},
Action: [
s3:GetBucketAcl,
s3:GetBucketPolicy
],
Resource: arn:aws:s3:::<bucketname>
},
{
Effect: Allow,
Principal: {
AWS: 386209384616
},
Action: s3:PutObject,
Resource: arn:aws:s3:::<bucketname>/*
}
]
}
Note: Ensure that you do not change the AWS Principal number 386209384616.
This enables AWS to send billing reports to the S3 bucket.
...
Adding AWS environment to Aquila Clouds
On the side navigation bar, select Administration tab.
On the Administration tab, click Environments.
On the Environments page, click Add.
On the Add Environment page, toggle on Active.
In the Environment Type group, select Amazon AWS.
In the Name of the environment, type the name of AWS environment.
Enter the following details for the connection parameters:
ARN List: Type ARN or list of ARNs that are configured in AWS for permitting access of your AWS environment to the Aquila Clouds platform.
Note: You would typically have a list of ARNs for managing a set of related accounts (root and its sub accounts together) by Aquila Clouds. For a set of related accounts, add the ARNs in another Environment.Account Id: Type the account ID of the AWS environment required to be managed from the Aquila Clouds platform. If an explicit Payee Account is not designated, you can type the root account ID.
Billing Bucket Name: Type the name of the S3 bucket created in AWS for Aquila Clouds.
Billing Bucket Region: Type the region code for the region that S3 bucket is created. For instance, for Ohio the region code is us-east-2.
Billing Report Prefix: Type the billing prefix as defined in the AWS environment without using '/'.
Billing Report Name: Type the name of the billing report configured in AWS for Aquila Clouds platform.
Config Aggregator Name:
Config Aggregator Region:
Related Govt Account: Provide mapping of commercial account with government account where the commercial account ID is the leftmost value followed by double colons and the government account ID. For example, 123456::789464. You can use comma separated values to map multiple accounts.
Click Apply.
Review the environment details and click Do you wish to confirm?. AWS environment is configured in Aquila Clouds. You can start monitoring and managing AWS resources from Aquila Clouds platform according to the permissions defined in AWS environment.
Configuring using the Cloud Formation Template
...
Configuring IAM role related permissions in AWS
Login to the Amazon S3 console. Create an S3 bucket to store the daily billing reports of your AWS resources that are generated by AWS.
In the AWS Billing and Cost Management console, create a billing report and schedule daily generation of AWS cost and usage report.
On the navigation pane, choose Cost & Usage Reports.
Choose Reports > Create Report.
For Report name, type the name for your report.
For Additional report details, select Include resource IDs to associate resources with business services and click Next.
In the Configure S3 bucket, select the S3 bucket created in Step 1.
For the Report path prefix, define the required prefix to be prepended to the name of the report.
Note: If you don't specify a prefix, the default prefix is the name that you specified for the report in Step c and the date range for the report, in the following format:
/report-name/date-range/
For Time granularity, select Daily to aggregate report data every day.
Enable the Automatically refresh your Cost & Usage Report when charges are detected for previous months with closed bills checkbox.
Click Next.
Review the settings and click Review and Complete.
S3 bucket is created and AWS is configured to store billing details in the new S3 bucket.
...
Before you begin: Get the cloud formation template file from Aquila Clouds.
Log in to the AWS management console using credentials of a user with privileges to access cloud formation template and to create a stack.
Search for CloudFormation.
In the search results, click CloudFormation to create and manage resources with template.
You can also use the following URL to create and manage resources with template.
https://console.aws.amazon.com/cloudformation/On the Stacks page, choose Create Stack > With new resources (standard).
On the Create Stack page, in the Prerequisite - Prepare template group, select Upload a template. file to upload the template provided by Aquila Clouds.
Browse to the directory containing template file provided by Aquila Clouds and upload it.
You can use the template available at the following URL:
https://aquila-helper.s3.us-east-2.amazonaws.com/s3bucketorgpolicyIamcft.jsonClick Next.
Specify stack name and billing CUR bucket name.
Type the RoleName and S3Bucket.
Click Next.
On the Configure stack options page, click Next Step.
On the Review page, click Create stack.
Create stack with new resources in AWS for sub accounts
Before you begin, if you require to restrict access to specific organizational units or accounts get the Organization Unit ID (OU-ID).
Log in to the AWS management console using credentials of a user with privileges to access cloud formation template and to create a stack.
Search for CloudFormation.
In the search results, click CloudFormation to create and manage resources with template.
You can also use the following URL to create and manage resources with template.
https://console.aws.amazon.com/cloudformation/On the Stacks page, choose Create StackSet.
On the Choose a template page, select the Service-managed permissions option.
Select Upload a template file.
Browse to the directory containing template file provided by Aquila Clouds.
Click Next.
On the Specify StackSet details page, specify the stackset name, stackset description, rolename and S3 bucket.
Click Next.
On the Configure StackSet options page, click Next.
On the Set deployment options page, select any one of the following option:
Select the Deploy to organization option to create roles and policies for all sub account.
Select the Deploy to organizational units (OUs) option to create roles and policies in specific organizational unit.
Type the AWS OU ID. You can add more than one AWS OU ID.
Click Next.
On the Review page, click Create StackSet.
Adding AWS environment for cloud formation template to Aquila Clouds
...
Adding AWS environment to Aquila Clouds
On the side navigation bar, select Administration tab.
On the Administration tab, click Environments.
On the Environments page, click Add.
On the Add Environment page, toggle on Active.
In the Environment Type group, select Amazon AWS.
In the Connection Type list, select AWS Role ARN.
In the Name of the environment, type the name of AWS environment.
Enter the following details for the connection parameters:
ARN List: Type ARN or list of ARNs that are configured in AWS for permitting access of your AWS environment to the Aquila Clouds platform.
Note: You would typically have a list of ARNs for managing a set of related accounts (root and its sub accounts together) by Aquila Clouds. For a set of related accounts, add the ARNs in another Environment.Account Id: Type the account ID of the AWS environment required to be managed from the Aquila Clouds platform. If an explicit Payee Account is not designated, you can type the root account ID.
Billing Bucket Name: Type the name of the S3 bucket created in AWS for Aquila Clouds.
Billing Bucket Region: Type the region code for the region that S3 bucket is created. For instance, for Ohio the region code is us-east-2.
Billing Report Prefix: Type the billing prefix as defined in the AWS environment without using '/'.
Billing Report Name: Type the name of the billing report configured in AWS for Aquila Clouds platform.
Config Aggregator Name:
Config Aggregator Region:
Related Govt Account: Provide mapping of commercial account with government account where the commercial account ID is the leftmost value followed by double colons and the government account ID. For example, 123456::789464. You can use comma separated values to map multiple accounts.
Click Apply.
Review the environment details and click Do you wish to confirm?. AWS environment is configured in Aquila Clouds. You can start monitoring and managing AWS resources from Aquila Clouds platform according to the permissions defined in AWS environment.
Configuring using the IAM credentials
...
Adding AWS environment to Aquila Clouds
On the side navigation bar, select Administration tab.
On the Administration tab, click Environments.
On the Environments page, click Add.
On the Add Environment page, toggle on Active.
In the Environment Type group, select Amazon AWS.
In the Connection Type list, select AWS IAM Credentials.
In the Name of the environment, type the name of AWS environment.
Enter the following details for the connection parameters:
Account Id: Type the account ID of the AWS environment required to be managed from the Aquila Clouds platform. If an explicit Payee Account is not designated, you can type the root account ID.
Access Key ID: Type the access key ID that you have created for programmatic calls to AWS. For example,
AKIAIOSFODNN7EXAMPLE.Secret Access Key: Type the secret key that you have created. For example,
JalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY.
Click Apply.
Review the environment details and click Do you wish to confirm?. AWS environment is configured in Aquila Clouds. You can start monitoring and managing AWS resources from Aquila Clouds platform according to the permissions defined in AWS environment.
Quick Reference - CFT Permissions
Service | Type | Permissions |
|---|---|---|
AWS Organizations | organizations | organizations:Describe* |
Amazon Elastic Compute Cloud (ASG) | autoscaling | autoscaling:Describe* |
Amazon Elastic Compute Cloud (EC2) | ec2 | ec2:Describe* |
Amazon Elastic Compute Cloud (elb) | elasticloadbalancing | elasticloadbalancing:Describe* |
Cloudwatch | cloudwatch | cloudwatch:Describe* |
Elastic Container Registry | ecr-public | ecr-public:DescribeImageTags |
Elastic Container Registry | ecr-private | ecr:DescribeImages |
Elastic Container Service | ecs | ecs:Describe |
Elastic Kubernetes Service | eks | eks:Describe* |
Elastic Filesystem | elasticfilesystem | elasticfilesystem:ClientMount |
Relational Database Service | rds pi | pi:* |
Simple Storage Service | s3 | s3:GetBucketLocation |
AWS Config | config | config:DescribeConfigRules config:PutConfigRule config:DeleteConfigRule |