1. Define a user a. To create a user, refer to the instructions outlines on the AWS page at:

Transcription

1 ATAmotion AWS IAM Roles Background This document outlines the minimum AWS IAM access that is needed when migrating to an AWS EC2 instance using ATADATA s ATAmotion software. To provision server instances to AWS, the ATAmotion software needs access to certain EC2 and Identity and Access Management (IAM) API calls so that ATAmotion is able to provision and configure target instance in AWS. IAM Role Creation In instances where the ATAmotion software is installed outside of an AWS account, it requires the ability to call AWS API s via access keys that are tied to an Identity and Access Management (IAM) user. This user is defined in the target AWS account. In order to define this user and create the appropriate access keys, take the following steps: 1. Define a user a. To create a user, refer to the instructions outlines on the AWS page at: rs_create.html Simply go to the IAMs section under Security and Identity of the AWS Web Services page. 1

2 b. It is recommended that when creating a user for ATAmotion, to define this user without a password as no one should have to log in as the user. Click on the user link located under the Dashboard menu section to setup your user. c. Within the main window pane enter in a username and ensure the generate an access key for each user is checked. Then click on the blue create user button in the lower right hand corner which will setup the user. 2

3 d. Once the user has been created the next page will allow the downloading of the credentials or you could click on the security credentials link to display the account information as below. 2. Add a user defined policy a. To attach a policy, refer to the steps on the AWS page at: s_policies_managed-using.html#attach-managed-policyconsole b. We have provided a copy of a policy to the EC2 service which list full actions the ATADATA console can be provided to create and modify instances within the AWS environment. Simply copy and paste the syntax into the policy document window editor under the Identity and Access Management section. Then validate, save and attach to the user account created in step 1. However, if a more restrictive policy is needed go to section Bare Minimum IAM Role Creation following this section. 3

4 4 { "Version": " ", "Statement": [ { "Sid": "Stmt ", "Effect": "Allow", "Action": [ "ec2:allocateaddress", "ec2:assignprivateipaddresses", "ec2:associateaddress", "ec2:associatedhcpoptions", "ec2:associateroutetable", "ec2:attachclassiclinkvpc", "ec2:attachinternetgateway", "ec2:attachnetworkinterface", "ec2:attachvolume", "ec2:attachvpngateway", "ec2:createnetworkinterface", "ec2:createsubnet", "ec2:createvolume", "ec2:createvpc", "ec2:describevpcs", "ec2:describevpcendpointservices", "ec2:describevpcendpoints", "ec2:describesecuritygroups", "ec2:describeaddresses", "ec2:describeavailabilityzones", "ec2:describecustomergateways", "ec2:describedhcpoptions", "ec2:describehosts", "ec2:describeinstanceattribute", "ec2:describeinstancestatus", "ec2:describeinstances", "ec2:describeinternetgateways", "ec2:describenatgateways", "ec2:describenetworkinterfaceattribute", "ec2:describenetworkinterfaces", "ec2:describeregions", "ec2:describesecuritygroups", "ec2:describesubnets", "ec2:describevolumeattribute", "ec2:describevolumestatus", "ec2:describevolumes", "ec2:describevpcattribute", "ec2:describevpcclassiclink", "ec2:describevpcpeeringconnections", "ec2:rebootinstances", "ec2:runinstances", "ec2:startinstances", "ec2:describekeypairs", "ec2:createtags", "ec2:deletetags", "ec2:deletevolume", "ec2:detachvolume", "ec2:disassociateaddress", "ec2:detachnetworkinterface", "ec2:stopinstances", "ec2:modifyinstanceattribute", "ec2:getconsoleoutput", "ec2:modifyinstanceplacement", "ec2:modifynetworkinterfaceattribute", "ec2:modifysubnetattribute", "ec2:modifyvolumeattribute", "ec2:modifyvpcattribute", "ec2:modifyvpcpeeringconnectionoptions", "ec2:modifyvpcendpoint", "ec2:monitorinstances", "ec2:reportinstancestatus", "ec2:resetnetworkinterfaceattribute", "ec2:resetinstanceattribute", "ec2:modifyidformat", "ec2:describesubnets",

5 } ] } "ec2:describeaccountattributes", "ec2:modifyhosts", "ec2:describeaccountattributes", "ec2:disassociateroutetable", "ec2:modifyhosts", "ec2:modifynetworkinterfaceattribute", "ec2:moveaddresstovpc", "ec2:releaseaddress", "ec2:releasehosts", "ec2:replacenetworkaclassociation", "ec2:replacenetworkaclentry", "ec2:replaceroute", "ec2:replaceroutetableassociation", "ec2:describeroutetables", "ec2:importvolume", "ec2:modifyimageattribute", "ec2:importimage", "ec2:importinstance", "ec2:createroute", "ec2:createroutetable", "ec2:deleteroute", "ec2:deleteroutetable", "ec2:createdhcpoptions", "ec2:authorizesecuritygroupegress", "ec2:authorizesecuritygroupingress", "ec2:createdhcpoption", "iam:listroles" ], "Resource": [ "*" ] 3. Configure the ATAmotion account with the newly created IAMs user account. a. Login to the ATAmotion console and configure the amazon cloud profile as below. b. Click on the configuration link then the plus symbol which will allow the configuration of a cloud profile. 5

6 c. Select AMAZON as the Cloud Platform. Next, enter the Cloud Profile Name -- this can be the name of the user account created in Step 1, the Cloud Username and Password will be the account access key and the password that was downloaded. 6

7 Last, click Save this will save the profile successfully (as shown below). Now your ATAmotion product is ready to migrate servers to the AWS Cloud. Bare Minimum IAM Role Creation There are scenarios where customer s have strict policies towards applications and or users and only the bare minimum requirements are allowed when creating or assigning an IAM Role. Provided below is the syntax for the bare minimum requirements of an IAM role needed to allow successful migrations using ATASphere or the ATADATA console. "Version": " ", "Statement": [ { "Sid": "Stmt ", "Effect": "Allow", "Action": [ "ec2:assignprivateipaddresses", "ec2:attachnetworkinterface", "ec2:attachvolume", "ec2:authorizesecuritygroupingress" "ec2:createvolume", "ec2:createtags", "ec2:describevpcs", "ec2:describevpcendpointservices", 7

8 } ] } "ec2:describevpcendpoints", "ec2:describesecuritygroups", "ec2:describeaddresses", "ec2:describeavailabilityzones", "ec2:describecustomergateways", "ec2:describedhcpoptions", "ec2:describehosts", "ec2:describeinstanceattribute", "ec2:describeinstancestatus", "ec2:describeinstances", "ec2:describeinternetgateways", "ec2:describenatgateways", "ec2:describenetworkinterfaceattribute", "ec2:describenetworkinterfaces", "ec2:describeregions", "ec2:describesubnets", "ec2:describeaccountattributes", "ec2:describesecuritygroups", "ec2:describesubnets", "ec2:describevolumeattribute", "ec2:describevolumestatus", "ec2:describevolumes", "ec2:describevpcattribute", "ec2:describevpcclassiclink", "ec2:describevpcpeeringconnections", "ec2:describekeypairs", "ec2:describeroutetables", "ec2:deletevolume", "ec2:detachvolume", "ec2:detachnetworkinterface", "ec2:reportinstancestatus", "ec2:resetnetworkinterfaceattribute", "ec2:resetinstanceattribute", "ec2:describeaccountattributes" "ec2:releasehosts", "ec2:stopinstances", "ec2:getconsoleoutput", "ec2:monitorinstances", "ec2:rebootinstances", "ec2:runinstances", "ec2:startinstances", "iam:listroles" ], "Resource": [ "*" ] With this bare minimum IAM role, all creating and modifying functions (except for auto-provisioning EC2 instances) have been removed. So, no new objects can be created such as a VPC, public IP s, networks, etc. will not be allowed. Select target infrastructure Select target platform Specify IP address for preconfigured targets or unselect for auto-configuration of instances. 8

9 Select target cloud profile which will be configured to the restricted policy Specify the Instance name Specify Region Specify Instance Type Specify a VPC (must be pre-configured) Specify a Security Group (must be pre-configured) Specify a Subnet (must be pre-configured) Specify a Private key (must be pre-configured) This concludes this document. 9