Provisioning IAM Objects Needed for Metworx 20.x Deployment
This document outlines the steps associated with provisioning IAM objects for Metworx purposes.
Relevant Metworx Version(s)
The process outlined below pertains only to Metworx 20.x series workflows, so from Metworx 20.03 onward.
Relevant IAM Objects
There are 3 IAM objects that are needed to run Metworx and their purpose and policies are summarized in the table below.
The current set of AWS policies are a "superset" and are compatible with Metworx Workflows 20.03 and beyond.
|IAM Object||Description||Custom Policy||Custom Policy Summary||AWS Managed Policy|
|AWS IAM Service User||A service user whose credentials are used by metworx gui application to connect to customer-owned AWS Accounts||Service User Policy|
|AWS IAM EC2 service role||IAM role that Metworx cluster ec2 instances assume when running||EC2 Role Policy||AmazonSSMManagedInstanceCore|
|AWS IAM Role for MetrumRG Metworx Support||The read-only role grants Metworx Support access to logs and general configuration information, but not DATA.||SupportUser AmazonEC2ReadOnlyAccess CloudWatchLogsReadOnlyAccess AWSCloudTrailReadOnlyAccess AWSSupportAccess AWSCloudFormationReadOnlyAccess|
NOTE: For the customers that opt in for a fully-supported solution, the Support Role would have full admin rights.
Steps to Create the Required IAM Object
- Login to the AWS Account that will host the Metworx Workflows. Make sure that you are in the same region as will be used by Metworx workflows.
- Use the link below to Launch The CloudFormation Stack, and click Next
You can accept all of the defaults for Stack Name, IAM Role Name and IAM username -- or provide your own.
- If you will host dev, staging and prod environments in the same AWS account, make sure to modify the names of these resources to ensure uniqueness.
- To grant MetrumRG Metworx Support Role FULL admins rights, please select 'true' for GrantFullAdminToSupportRole parameter.
- Click "Next" to accept all other defaults.
- Click "Next" to also accept all of the default Stack options.
- At the bottom of the "Review" page, accept "Capabilities" to acknowledge that you will be creating IAM object, and click on "Create Stack"
- Monitor stack creation to make sure it is successful by refreshing events. After a couple of minutes the stack should finish creating.
Associated Step-by-Step Video
Linked is a Step-by-Step Video walking you through the steps outlined above.