Configuring an AWS Integration

1. In your AWS Console, search for IAM, and select the IAM service.

   

2. In the navigation pane, select Access Management > Policies and click Create Policy.

3. Select the JSON tab and replace the default content with the following code:

   {
      "Version": "2012-10-17",
      "Statement": [
       {
         "Action": "ce:Get*",
         "Resource": "*",
         "Effect": "Allow"
       }
     ]
   }
   

4. Click Next: Tags and add any needed tags.

   Adding tags is optional.

5. Click Next: Review and provide a descriptive Name for the policy.

   Example: CostExplorerAPIReadOnly

6. Make a note of the policy name, review the permissions summary, and click Create Policy.

   You will need the policy name to attach this customer managed policy to your IAM role.

1. In your AWS Console, search for IAM, and select the IAM service.

   

   The Identity and Access Management (IAM) dashboard displays.

2. In the navigation pane, select Access Management > Policies and click Create Policy.

3. Select the JSON tab and replace the default content with the following code:

   {   
     "Version": "2012-10-17",
     "Statement": [
       {
          "Effect": "Allow",
          "Action": "cur:DescribeReportDefinitions",
          "Resource": "*"
       }
     ] 
   }
   

4. Click Next: Tags and add any needed tags.

   Adding tags is optional.

5. Click Next: Review and provide a descriptive Name for the policy.

   Example: ReadCostAndUsageReportDefinitions

6. Make a note of the policy name, review the permissions summary, and click Create Policy.

   You will need the policy name to attach this customer managed policy to your IAM role.

Steps

1. In your AWS Console, search for IAM, and select the IAM service.

   

   The Identity and Access Management (IAM) dashboard displays.

2. In the navigation pane, select Access Management > Roles and click Create Role.

3. For "type of trusted entity", select AWS Account and then select Another AWS Account.

   

4. Provide the Account ID from your Virtana Platform AWS Integration.

   This identifies the Virtana Platform account as the user of this role.

5. Check Require external ID and provide the External ID from your Virtana Platform AWS Integration.

   Leave Require MFA unchecked.

6. Click Next: Permissions.

7. Define and assign to the read-only role ONE of the following three role permissions available in AWS.

   • Standard Permissions

     Standard permissions grant blanket read-only access to collect CloudWatch performance metrics and billing files from S3.

     Steps

     1. Under Attach permission policies, search for ReadOnlyAccess, locate it in the results, and select the checkbox to attach the permissions to the role you are creating:

        Be sure to select the checkbox. Selecting the policy name displays details about the policy.

     2. Next, attach to the IAM role the 2 in-line policies you previously created:

        1. Click Filter policies and select Customer managed.

           

        2. Clear any text in the search field.

        3. Find and click the checkbox to select the Cost Explorer in-line policy you created.

           Example: CostExplorerAPIReadOnly

        4. Find and click the checkbox to select the Cost and Usage Reports in-line policy you created.

           Example: ReadCostAndUsageReportDefinitions

     3. Under Set permissions bouindary, ensure the default of Create role without a permission boundary is checked.

     4. Click Next: Tags and add any needed tags.

        Adding tags is optional.

     5. Click Next: Review, add the Role Name, and click Create Role.

        You are returned to the IAM Roles list, which displays the new role name.

     6. In the list, click the name of the role you just created and make a note of the Role ARN value displayed in the Summary.

        You will need to enter this value in the integrations settings in Virtana Platform.

        

     Next Steps

     Enter the AWS Values in Virtana Platform

   • Minimal Cost Permissions

     This setup method grants read-only access to collect CloudWatch performance metrics and billing files. It is limited to only the AWS services for which Virtana Platform Cloud Cost Management (CCM) provides cost reports.

     Steps

     1. Open another browser window and access your AWS Console.

     2. Navigate to Find Services, search for IAM, and select the IAM service.

        

     3. In the navigation pane, select Access Management > Policies and click Create Policy.

     4. Select the JSON tab and replace the default content with the following code:

        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": [
                "cloudwatch:Get*",
                "cloudwatch:List*",
                "cloudwatch:Describe*",
                "ec2:Get*",
                "ec2:Describe*",
                "elasticloadbalancing:Describe*",
                "iam:Get*",
                "rds:Describe*",
                "rds:List*",
                "s3:Get*",
                "s3:List*",
                "s3:Describe*",
                "tag:Get*",
                "tag:Describe*"
              ],
              "Effect": "Allow",
              "Resource": "*"
            }
          ]
        }
        

     5. Click Next: Review and provide a descriptive Name for the policy.

        Example: MinimalReadonlyCost

     6. Make a note of the policy name, review the permissions summary, and click Create Policy.

        You will need the policy name to attach this customer managed policy to your IAM role.

     7. Return to the first browser displaying the Create role > Attach permission policies page.

     8. Attach to the role the read-only policy and the 2 in-line policies you created:

        1. Click Filter policies and select Customer managed.

           

        2. Clear any text in the search field.

        3. Locate the 3 policies in the list and select the checkboxes to attach the permissions to the role.

           • Minimal read-only cost policy

             Example: MinimalReadonlyCost

           • In-line policy for cost explorer API access

             Example: CostExplorerAPIReadonly

           • In-line policy for cost and usage report read access

             Example: ReadCostAndUsageReportDefinitions

           Be sure to select the checkbox. Selecting the policy name displays details about the policy.

     9. Click Next: Tags and add any needed tags.

        Adding tags is optional.

     10. Click Next: Review, add the Role Name, and click Create Role.

         You are returned to the IAM Roles list, which displays the new role name.

     11. In the list, click the name of the role you just created and make a note of the Role ARN value displayed in the Summary.

         You will need to enter this value in the integrations settings in Virtana Platform.

         

     Next Steps

     Enter the AWS Values in Virtana Platform

   • Management Account Permissions

     This setup method provides a shared management account with limited access. It grants read-only access to collect billing files from a single s3 bucket that can be located in a management account.

     The management account permissions are useful if you store billing files in a shared management account and need to grant Cloud Cost Management (CCM) restricted access to one specific S3 bucket.

     Note

     CCM only reads the costs for accounts that CCM monitors. Data for unrelated accounts is discarded.

     Prerequisites

     You need the name of the AWS bucket associated with your CUR files.

     Steps

     1. Open another browser window and access your AWS Console.

     2. Navigate to Find Services, search for IAM, and select the IAM service.

        

     3. In the navigation pane, select Access Management > Policies and click Create Policy.

     4. Switch to the JSON tab, replace the existing content with the following code, and replace 2 instances of your-bucket-name in the code with the name of the bucket associated with your CUR files.

        Example: Eng_bucket

        There are two instances of your-bucket-name that need replacing.

                {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "s3:ListBucket"
              ],
              "Resource": [
                "arn:aws:s3:::your-bucket-name"
              ]
            },
            {
              "Effect": "Allow",
              "Action": [
                "s3:GetObject"
              ],
              "Resource": [
                "arn:aws:s3:::your-bucket-name/*"
              ]
            }
          ]
        }
        

     5. Click Next: Review and provide a descriptive Name for the policy.

        Example: EngBucketReadOnly

     6. Make a note of the policy name, review the permissions summary, and click Create Policy.

        You will need the policy name to attach this customer managed policy to your IAM role.

     7. Return to the first browser displaying the Create role > Attach permission policies page.

     8. Attach to the role the read-only policy and the 2 in-line policies you created:

        1. Click Filter policies and select Customer managed.

           

        2. Clear any text in the search field.

        3. Locate the 3 policies in the list and select the checkboxes to attach the permissions to the role.

           Be sure to select the checkbox. Selecting the policy name displays details about the policy.

           • Management account read-only policy

             Example: EngBucketReadonly

           • In-line policy for cost explorer API access

             Example: CostExplorerAPIReadonly

           • In-line policy for cost and usage report read access

             Example: ReadCostAndUsageReportDefinitions

     9. Click Next: Tags and add any needed tags.

        Adding tags is optional.

     10. Click Next: Review, add the Role Name, and click Create Role.

         You are returned to the IAM Roles list, which displays the new role name.

     11. In the list, click the name of the role you just created and make a note of the Role ARN value displayed in the Summary.

         You will need to enter this value in the integrations settings in Virtana Platform.

         

     Next Steps

     Enter the AWS Values in Virtana Platform

1. In your AWS Console, search for IAM, and select the IAM service.

   

2. In the navigation pane, select Access Management > Policies and click Create Policy.

3. Select the JSON tab and replace the default content with the following code:

   {
      "Version": "2012-10-17",
      "Statement": [
       {
         "Action": "ce:Get*",
         "Resource": "*",
         "Effect": "Allow"
       }
     ]
   }
   

4. Click Next: Tags and add any needed tags.

   Adding tags is optional.

5. Click Next: Review and provide a descriptive Name for the policy.

   Example: CostExplorerAPIReadOnly

6. Make a note of the policy name, review the permissions summary, and click Create Policy.

   You will need the policy name to attach this customer managed policy to your IAM role.

1. In your AWS Console, search for IAM, and select the IAM service.

   

   The Identity and Access Management (IAM) dashboard displays.

2. In the navigation pane, select Access Management > Policies and click Create Policy.

3. Select the JSON tab and replace the default content with the following code:

   {   
     "Version": "2012-10-17",
     "Statement": [
       {
          "Effect": "Allow",
          "Action": "cur:DescribeReportDefinitions",
          "Resource": "*"
       }
     ] 
   }
   

4. Click Next: Tags and add any needed tags.

   Adding tags is optional.

5. Click Next: Review and provide a descriptive Name for the policy.

   Example: ReadCostAndUsageReportDefinitions

6. Make a note of the policy name, review the permissions summary, and click Create Policy.

   You will need the policy name to attach this customer managed policy to your IAM role.