To configure AWS in Aquila Clouds, perform the following tasks:
Identify the permissions required in AWS
Before you configure AWS environment for Aquila Clouds platform, understand and identify all the permissions required by your organization for effectively monitoring and managing AWS resources.
Permissions for cost recommendations, alerts, utilization, Container and Application dashboard
This section lists the permissions that enable the cost recommendations, alerts and Container and Application dashboards in Aquila Clouds platform for your organization's AWS resources.ec2:DescribeSnapshots,ec2:DescribeVolumes,ec2:DescribeVolumeStatus,ec2:DescribeSnapshotAttribute,ec2:DescribeInstances,ec2:DescribeVolumeAttribute,ec2:DescribeInstanceStatus,ec2:DescribeTags,ecs:List*,ecs:Describe*,eks:List*,eks:Describe*,ec2:Describe*,elasticloadbalancing:Describe*,cloudwatch:ListMetrics,cloudwatch:GetMetricStatistics,cloudwatch:GetMetricData,cloudwatch:Describe*,autoscaling:Describe*,
Permissions for actions in the Recommendations dashboard and Action console
This section lists the permissions that enable actions in the Recommendations dashboard and Action console in the Aquila Clouds platform for your organization's AWS resources.ec2:CopySnapshotec2:ModifyVolumeAttribute, ec2:CreateImage,ec2:ResetInstanceAttribute,ec2:CopyImage,ec2:StartInstances,ec2:StopInstancesec2:ImportSnapshot,ec2:CreateLaunchTemplateVersion,ec2:CreateLaunchTemplate,ec2:ModifyInstanceCreditSpecification,ec2:AssociateIamInstanceProfileec2:UnmonitorInstancesec2:MonitorInstances,ec2:ReportInstanceStatus,ec2:DeleteVolume,ec2:ModifySnapshotAttribute,ec2:StartInstances,ec2:CreatePlacementGroup,ec2:ImportImage,ec2:DetachVolume,ec2:ModifyVolume,ec2:ResetImageAttribute,ec2:CreateTags,ec2:RegisterImage,ec2:ModifyInstanceEventStartTime,ec2:RunInstances,ec2:StopInstances,ec2:CreateVolume,ec2:EnableVolumeIO,ec2:AttachVolume,ec2:ImportVolume,ec2:RequestSpotInstances,ec2:DeleteTags,ec2:RunScheduledInstances,ec2:RequestSpotFleet,ec2:ModifyImageAttribute,ec2:CreateSnapshot,ec2:ModifyInstanceAttribute,ec2:ModifyReservedInstances,ec2:RebootInstances,ec2:CreateInstanceExportTask,ec2:ModifyInstancePlacement,ec2:TerminateInstances,ec2:ImportInstance,ec2:ResetSnapshotAttribute,ec2:ModifyInstanceCapacityReservationAttributes
Comprehensive set of permissions for the entire set of features
This section lists comprehensive set of permissions for the entire set of features in the Aquila Clouds platform for your organization's AWS resources.{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["ec2:CopySnapshot","ec2:DescribeInstances","ec2:UnmonitorInstances","ec2:ModifyVolumeAttribute","ec2:MonitorInstances","ec2:CreateImage","ec2:ResetInstanceAttribute","ec2:CopyImage","ec2:DescribeSnapshots","ec2:ReportInstanceStatus","ec2:DeleteVolume","ec2:DescribeVolumeStatus","ec2:ModifySnapshotAttribute","ec2:StartInstances","ec2:CreatePlacementGroup","ec2:DescribeVolumes","ec2:ImportImage","ec2:DetachVolume","ec2:ModifyVolume","ec2:ResetImageAttribute","ec2:CreateTags","ec2:DescribeSnapshotAttribute","ec2:RegisterImage","ec2:ModifyInstanceEventStartTime","ec2:RunInstances","ec2:StopInstances","ec2:DescribeVolumeAttribute","ec2:CreateVolume","ec2:EnableVolumeIO","ec2:ModifyInstanceCapacityReservationAttributes","ec2:AttachVolume","ec2:ImportVolume","ec2:RequestSpotInstances","ec2:DeleteTags","ec2:RunScheduledInstances","ec2:RequestSpotFleet","ec2:ModifyImageAttribute","ec2:CreateSnapshot","ec2:ModifyInstanceAttribute","ec2:ModifyReservedInstances","ec2:DescribeInstanceStatus","ec2:RebootInstances","ec2:CreateInstanceExportTask","ec2:ModifyInstancePlacement","ec2:TerminateInstances","ec2:ImportInstance","ec2:DescribeTags","ec2:ResetSnapshotAttribute","ec2:ImportSnapshot","ec2:CreateLaunchTemplateVersion","ec2:CreateLaunchTemplate","ec2:ModifyInstanceCreditSpecification","ec2:AssociateIamInstanceProfile","ecs:List*","ecs:Describe*","eks:List*","eks:Describe*","ec2:Describe*","elasticloadbalancing:Describe*","cloudwatch:ListMetrics","cloudwatch:GetMetricStatistics","cloudwatch:GetMetricData","cloudwatch:Describe*","autoscaling:Describe*","ec2:DescribeInstances","ec2:StartInstances","ec2:StopInstances","rds:DescribeReservedDBInstances","rds:ListTagsForResource","rds:DescribeDBInstances","rds:DescribeDBParameters","pi:*","rds:DescribeDBClusters"],"Resource": "*"}]}
Permissions for billing reports
Thi section lists the permissions that enable billing reports of your organization's AWS resources on the Aquila Clouds platform.
{
"Version": 2012-10-17,
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": [
"arn:aws:s3:::BUCKET_NAME",
"arn:aws:s3:::BUCKET_NAME/*"
]
}
]
}
Configuring IAM role related permissions in AWS
To properly monitor and manage AWS on the Aquila Clouds platform, on the AWS platform, create an IAM role for Aquila Clouds and assign all the permissions to that role. We recommend you use Aquila Clouds' Role Creator application to create and configure the IAM role for Aquila Clouds.
If you cannot use the Role Creator application, see the following steps to create and configure an IAM role in AWS platform.
Before you begin: Identify the permissions required for your organization's setup.
If you want to use the Aquila Clouds platform only for monitoring AWS VMs, assign only the following two permissions to the IAM role.
AmazonEC2ReadOnlyAccess
CloudWatchReadOnlyAccess
Configuring IAM role related permissions in AWS
Log in to the AWS management console
Open the IAM console and from the navigation pane, choose Roles > Create Role page.
Choose the Another AWS account role type.
For Account ID, type 813367342454. This is AWS Account ID for Aquila Clouds.
Select the Require external ID check box, to enhance security.
In the External ID box, type A2I_COMPANY_EXTERNAL_ID.
Choose Next: Permissions.
Select the check box for the required permission.
Note: Aquila Clouds recommends assigning all permissions to the IAM role to effectively use the Aquila Clouds platform.
Choose Next: Review.
For Role name, type a name for your role. Role names must be unique within your AWS account.
Click Create Role.
Navigate to the Roles page and open the new role.
Select the Trust relationships tab and click Edit trust relationship.
In the Policy Document, next to the Account ID, replace root with user/aquila_product_user.
Save the Policy Document and in the Role Summary, copy the ARN for the role and add it in the Add Environment page of Aquila Clouds.
Figure 1: TRUST RELATIONSHIPS SCREEN The IAM role is created and configured in the AWS platform for Aquila Clouds.
Configuring access to billing details in AWS
You can create an S3 bucket, billing reports of required resources and configure AWS to store billing reports in the new S3 bucket.
Note: If you do not create an S3 bucket, Aquila Clouds will still be able to display the billing reports in the Aquila Clouds platform. These reports will be based on the standard billing rates available from AWS and will not include any user/organization specific discounts (if any).
Configuring IAM role related permissions in AWS
Login to the Amazon S3 console. Create an S3 bucket to store the daily billing reports of your AWS resources that are generated by AWS.
In the AWS Billing and Cost Management console, create a billing report and schedule daily generation of AWS cost and usage report.
On the navigation pane, choose Cost & Usage Reports.
Choose Reports > Create Report.
For Report name, type the name for your report.
For Additional report details, select Include resource IDs to associate resources with business services and click Next.
In the Configure S3 bucket, select the S3 bucket created in Step 1.
For the Report path prefix, define the required prefix to be prepended to the name of the report.
Note: If you don't specify a prefix, the default prefix is the name that you specified for the report in Step c and the date range for the report, in the following format:
/report-name/date-range/
For Time granularity, select Daily to aggregate report data every day.
Enable the Automatically refresh your Cost & Usage Report when charges are detected for previous months with closed bills checkbox.
Click Next.
Review the settings and click Review and Complete.
S3 bucket is created and AWS is configured to store billing details in the new S3 bucket.
Creating IAM role related policy to grant access to the S3 bucket
You can grant the access of S3 bucket to the IAM role created for Aquila Clouds platform.
Creating IAM role related policy to grant access to the S3 bucket
In the AWS Management Console, in the navigation pane, choose Policies.
On the Welcome to Managed Policies page, click Create Policy.
Choose Create Policies with the Visual Editor.
On the Visual editor tab, choose Choose a service.
Select S3 service.
Choose Select Actions and in the Access level group, select the List and Read check boxes.
In the Resources group, select Specific.
In the bucket section, click Add ARN.
In the Add ARN dialog box, type the required bucket name in the Bucket name box and click Add. For instance, set the bucket name to aquila-billing-bucket.
In the object section, click Add ARN.
In the Add ARN dialog box, type the same bucket name as used for Add ARN (in Step 9) and in the Object name box type *{}(wildcard) and select the Any check box for the Object name. Verify the bucket name and object name in the Specify ARN for Object box. For instance, for the bucket name set to aquila-billing-bucket, the text in Specify ARN for Object box is set to arn:aws:s3::: aquila-billing-bucket/{*}.
This grants permissions to any resource of aquila-billing-bucket type.Figure 3: ADD ARN FOR OBJECT SCREEN
Click Add.
Click Review policy and type Name and Description for the new policy.
Review the policy summary and click Create Policy.
AWS creates the new policy for Aquila Clouds.
In the navigation pane, choose Policies.
From the policies list, select the new policy and in the Policy actions, choose Attach.
Select the IAM role for Aquila Clouds to attach to the policy and choose Attach Policy.
AWS attaches the new policy to the IAM role for Aquila Clouds.
Navigate to S3 > Buckets and open the bucket for Aquila Clouds.
In the Json permissions code, set the <bucketname> to the name of the S3 bucket created for Aquila Clouds.
{
Version: 2012-10-17,
Statement: [
{
Effect: Allow,
Principal: {
AWS: 386209384616
},
Action: [
s3:GetBucketAcl,
s3:GetBucketPolicy
],
Resource: arn:aws:s3:::<bucketname>
},
{
Effect: Allow,
Principal: {
AWS: 386209384616
},
Action: s3:PutObject,
Resource: arn:aws:s3:::<bucketname>/*
}
]
}
Note: Ensure that you do not change the AWS Principal number 386209384616.
This enables AWS to send billing reports to the S3 bucket.
Adding AWS environment to Aquila Clouds
In the Aquila Clouds platform, add the AWS environment details to enable monitoring and management of your AWS resources from the Aquila Clouds platform.
Before you begin: Get the following details from your AWS environment:
ARNs
Payee Account ID
Billing bucket name and region
Billing report prefix and name
Adding AWS environment to Aquila Clouds
On the side navigation bar, select Administration tab.
On the Administration tab, click Environments.
On the Environments page, click Add.
On the Add Environment page, toggle on Active.
In the Environment Type group, select Amazon AWS.
In the Name of the environment, type the name of AWS environment.
Enter the following details for the connection parameters:
ARN List: Type ARN or list of ARNs that are configured in AWS for permitting access of your AWS environment to the Aquila Clouds platform.
Note: You would typically have a list of ARNs for managing a set of related accounts (root and its sub accounts together) by Aquila Clouds. For a set of related accounts, add the ARNs in another Environment.
Payee Account Id: Type the payee account ID of the AWS environment required to be managed from the Aquila Clouds platform. If an explicit Payee Account is not designated, you can type the root account ID.
Billing Bucket Name: Type the name of the S3 bucket created in AWS for Aquila Clouds.
Billing Bucket Region: Type the region code for the region that S3 bucket is created. For instance, for Ohio the region code is us-east-2.
Billing Report Prefix: Type the billing prefix as defined in the AWS environment without using '/'.
Billing Report Name: Type the name of the billing report configured in AWS for Aquila Clouds platform.
Click Apply.
Review the environment details and click Do you wish to confirm?.
AWS environment is configured in Aquila Clouds. You can start monitoring and managing AWS resources from Aquila Clouds platform according to the permissions defined in AWS environment.