Provisioning IAM Objects needed for Metworx 20.x Deployment
There are 3 IAM objects that are needed to run Metworx and their purpose and policies are summarized in a table below. NOTE: Current set of AWS policies are a "superset" and are compatible with Metworx Workflows Performance 3.5 through metworx-20.12
IAM Object | Description | Custom Policy | Custom Policy Summary | AWS Managed Policy |
---|---|---|---|---|
AWS IAM Service User | A service user whose credentials are used by metworx gui application to connect to customer-owned AWS Accounts | Service User Policy |
![]() |
|
AWS IAM EC2 service role | IAM role that Metworx cluster ec2 instances assume when running | EC2 Role Policy |
![]() |
AmazonSSMManagedInstanceCore |
AWS IAM Role for MetrumRG Metworx Support | The read-only role grants Metworx Support access to logs and general configuration information, but not DATA. | SupportUser AmazonEC2ReadOnlyAccess CloudWatchLogsReadOnlyAccess AWSCloudTrailReadOnlyAccess AWSSupportAccess AWSCloudFormationReadOnlyAccess |
Note: For the customers that opt in for a fully-supported solution, the Support Role would have full admin rights.
To create these IAM Objects:
- Login to the AWS Account that will host the Metworx Workflows. Make sure that you are in the same region as will be used by Metworx workflows.
- Use the link below to Launch The CloudFormation Stack, and click Next
-
You can accept all of the defaults for Stack Name, IAM Role Name and IAM username -- or provide your own.
- If you will host dev, staging and prod environment in the same AWS account, make sure to modify the names of these resources to ensure uniqueness.
- To grant MetrumRG Metworx Support Role FULL admins rights, please select 'true' for GrantFullAdminToSupportRole parameter.
- Click "Next" to accept all other defaults.
- Click Next to also accept all of the default Stack options.
- All the way at the bottom of the "Review" page, accept "Capabilities" to acknowledge that you will be creating IAM object, and click on "Create Stack"
- Monitor stack creation to make sure it is successful by refreshing events. After a couple of minutes the stack should finish creating.