Credentials per Account

AWS cloud onboarding using single credentials for single Account

AWS Cloud Onboarding

Creating IAM user - Customer Prerequisites

Customer must follow bellow requirements and prepare for onboarding as follows:

1. Login to Cloud portal

2. Create new IAM user (for example named: 'insight') must be created under each Account, follow documentation: Creating an IAM user in your AWS account

3. While creating user, add required permission policy: ReadOnlyAccess (built in permission policy, AWS managed - job function) and custom permission "trustedadvisor:List*" or

Create and use custom Permissions Policy with specific permissions - to view click this!

Important! Take note that with new functionality we may require new permissions

a. Create a Permissions Policy named 'Insight-Resources-Viewer' in IAM on each Account. Alternatively, a combination of roles/policies can be used, so long as result has all of the permissions listed below.

b. Add permissions either via services or edit JSON directly:

{
	"Version": "2012-10-17",
	"Statement": [
		{
		    "Sid": "VisualEditor0",
		    "Effect": "Allow",
		    "Action": [
                        "sts:GetCallerIdentity",
                        "organizations:DescribeOrganization",
                        "organizations:DescribeAccount",
                        "organizations:ListAccounts",
                        "account:ListRegions",
                        "backup:ListBackupJobs",
                        "backup:ListProtectedResources",
                        "cloudformation:GetResource",
                        "cloudformation:ListResources",
                        "config:DescribeDeliveryChannels",
                        "config:DescribeConfigurationRecorderStatus",
                        "config:ListDiscoveredResources",
                        "config:SelectResourceConfig",
                        "guardduty:GetFindings",
                        "guardduty:ListFindings",
                        "inspector:ListFindings",
                        "inspector:DescribeFindings",
                        "inspector2:ListFindings",
                        "ssm:DescribeMaintenanceWindows",
                        "ssm:ListCommandInvocations",
                        "tag:GetResources",
                        "trustedadvisor:List*"
		   ],
		   "Resource": "*"
		}
	]
}

1. For programmatic access, a third-party Access key needs to be created, write down Access key ID and Secret access key which will be required to onboard your account.

2. For getting Cloud resources enable Config service and do this for all(or relevant where resources deployed) regions: Change Region, Open AWS Config Service, select '1-click setup', select 'Confirm'. Repeat.

Onboarding SA - INSIGHT configuration

1. Login to INSIGHT platform

2. Open Cloud Management under Administration

3. Add AWS credentials

   • Access Key ID

   • Secret Access Key

4. Save [done]

AWS Cloud billing Onboarding

Creating Cost Export

Customer must follow bellow requirements and prepare cost export to proceed on onboarding to INSIGHT platform. To start collecting your Cloud Billing data, you must create cost export following this guide steps you need to do:

1. Login to Cloud portal

2. Open Billing and Cost Management, Select menu: Data Exports

3. Press Create and select options:

   - Standard data export

   - Enter Export name: 'DailyExports'

   - Select 'Include resource IDs'

   - Select 'Split cost allocation data'

   - Select 'Daily'

   - Leave Selection 'Column selection (125/125)' as is

   - Select 'gzip - text/csv'

   - Select 'Overwrite existing data export file'

   - Configure S3, general purpose bucket, name it for example <prefix#-costexports-s3bucket-no#>, select your usually used region.

   - Enter S3 path prefix: 'Insight'

   - Create!

4. You need to wait for data to come in before proceeding, usually AWS sends information twice over 24 hours.

5. Open S3 Service

6. Select S3 Bucket you just created

7. Open twice objects (folders) prefix and export names, until you see data and metadata objects

8. Copy browser URL for later use.

9. If you are using custom permission sets for access, then update to include additional permissions to access this bucket, add additional set named 'Insight_Costs_Viewer' (change <bucketname>):

   {
   	"Version": "2012-10-17",
   	"Statement": [
   		{
   			"Sid": "Statement1",
   			"Effect": "Allow",
   		    "Action": [
                           "s3:ListBucket",
                           "s3:GetObject"
   		        ],
   		    "Resource": [
                           "arn:aws:s3:::<bucketname>",
                           "arn:aws:s3:::<bucketname>/*"
                           ]
   		}
   	]
   }

Onboarding Cost Export

1. Login to INSIGHT platform

2. Open Cloud Management menu under Administration

3. Add Billing Export Configuration

   • Project Name [Account name where cost export data set is located]

   • Cost Export URL [Example: https://us-east-1.console.aws.amazon.com/s3/buckets/costexportss3bucket?region=us-east-1&bucketType=general&prefix=Insight/DailyExports/]

4. Save [done]