Step 2: Create an IAM role for Mavvrik

Mavvrik supports both types of AWS authentication:

1. Roles

2. Users

Role-based access is generally considered to be more secure than user-based access, as it allows organizations to control access to resources and functions based on defined roles and responsibilities. We recommend using roles over individual users

Roles

1. Login to AWS Member account you're trying to onboard as an Administrator if not already logged in. And navigate to IAM service using AWS search bar.

2. On the IAM Console, Select Roles from the left menu, and click Create role.

3. Select Custom trust policy

4. Copy the JSON

   {
     "Version": "2012-10-17",
       "Statement": [
         {
           "Effect": "Allow",
           "Action": ["sts:AssumeRole"],
           "Principal": {
             "AWS": [
               "arn:aws:iam::911403356698:user/global-user-for-assume-role",
               "arn:aws:iam::911403356698:user/mavvrik-svc-user",
               "arn:aws:iam::911403356698:role/mavvrik-svc-role"
             ]
           },
           "Condition": {
             "StringEquals": {
               "sts:ExternalId": "<TENANT-ID>"
             }
           }
         }
       ]
   }
   

5. Paste the copied JSON in Custom trust policy editor

   

6. Remove <TENANT-ID>

7. Enter your tenant id as shown image. To get the tenant id to follow instructions,

1. 1. Login to Mavvrik

   2. From the side menu, select API under the Admin section

   3. Capture the Tenant ID

8. Click Next, on next screen for permissions, Choose 'AWS Managed - job function' in the filter. Search and select the listed policies below.

   • ReadOnlyAccess

   • ViewOnlyAccess

Choose 'AWS Managed in the filter. Search and select the listed policies below.

• IAMReadOnlyAccess

• CloudWatchReadOnlyAccess

• ComputeOptimizerReadOnlyAccess

• AWSOrganizationsReadOnlyAccess

9. Click Next again & on a final page, enter a name to the role & click Create role

10. Search for the newly created role

11. Click on Add permissions → Create inline policy.

12. Search for Cost Explorer Service

13. Click on Write → StartSavingsPlansPurchaseRecommendationGeneration →Next

14. Enter the policy name.

15. Click on Create policy.

16. Once the role is created, please note the ARN of a role, which will be required in the next step.

OR use below permissions and create an inline policy for the newly created role

ReadOnlyAccess
ViewOnlyAccess
CloudWatchReadOnlyAccess
ComputeOptimizerReadOnlyAccess
AWSOrganizationsReadOnlyAccess

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowIAMReadOnlyActions",
            "Effect": "Allow",
            "Action": [
                "iam:SimulatePrincipalPolicy",
                "iam:GetAccountSummary"
            ],
            "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>"
        },
        {
            "Sid": "DenyAllOtherIAMActions",
            "Effect": "Deny",
            "NotAction": [
                "iam:SimulatePrincipalPolicy",
                "iam:GetAccountSummary"
            ],
            "Resource": "arn:*:iam::*:*"
        }
    ]
}

Users

1. Login to AWS Member account you're trying to onboard as an Administrator if not already logged in. And navigate to IAM service using AWS search bar.

2. On the IAM Console, Select Users from the left menu

3. Click on Create User

4. Enter the Username & click Next.

5. Select Attach policies directly, on next screen for permissions, please choose 'All Types' in the filter and select the listed policies below.

   • ReadOnlyAccess

   • ViewOnlyAccess

   • IAMReadOnlyAccess

   • CloudWatchReadOnlyAccess

   • ComputeOptimizerReadOnlyAccess

   • AWSOrganizationsReadOnlyAccess

or you can use below policies

ViewOnlyAccess
CloudWatchReadOnlyAccess
ComputeOptimizerReadOnlyAccess
AWSOrganizationsReadOnlyAccess

6. Click Next again & on a final page, give a name to the role & click Create user

7. Once the user is created, please click on the user to create a Secret Key

8. Go to Security Credentials tab & Click on Create Access Key

9. Select Application running outside AWS & Click on Next

10. Click on Create access key.

11. Secret Key will get generated.

12. Copy the Access Key & Secret Key which will be required in the next step.

13. Open newly created user

14. Click on Add permissions → Create inline policy.

15. Search for Cost Explorer Service

16. Click on Write → StartSavingsPlansPurchaseRecommendationGeneration →Next

17. Enter the policy name.

18. Click on Create policy.