Step-2: Create an IAM role for Mavvrik

Mavvrik supports both types of AWS authentications

1. Roles

2. Users

Role-based access is generally considered to be more secure than user-based access, as it allows organizations to control access to resources and functions based on defined roles and responsibilities. We recommend using roles over individual users

Roles

1. Login to AWS Member account you’re trying to onboard as an Administrator if not already logged in. And navigate to IAM service using AWS search bar.

2. On a IAM Console, Select Roles from the left menu, and click Create role. One the create role screen please select the configuration as follows

a. Trusted entity type: AWS Account

b. An AWS account: Choose Another AWS account and fill in the account number as 911403356698

c. External ID: In this field, please put the Tenant ID for your Mavvrik account. To get the tenant id follow instructions outlined in this page Retrieve the Tenant Id

d. Click Next

3. Click Next, on next screen for permissions, Choose 'AWS Managed - job function' in the filter . Search and select the listed policies below.

• ReadOnlyAccess

• ViewOnlyAccess

Choose ‘AWS Managed in the filter. Search and select the listed policies below.

• IAMReadOnlyAccess

• CloudWatchReadOnlyAccess

• ComputeOptimizerReadOnlyAccess

• AWSOrganizationsReadOnlyAccess

4. Click Next again & on a final page, enter a name to the role & click Create role

5. Search for the newly created role

6. Click on Add permissions → Create inline policy.

   

7. Search for Cost Explorer Service

8. Click on Write → StartSavingsPlansPurchaseRecommendationGeneration →Next

   

9. Enter the policy name.

10. Click onCreate policy.

11. Once the role is created, please note the ARN of a role, which will be required in the next step.

OR use below permissions and create a inline policy for the newly created role

ReadOnlyAccess
ViewOnlyAccess
CloudWatchReadOnlyAccess
ComputeOptimizerReadOnlyAccess
AWSOrganizationsReadOnlyAccess

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowIAMReadOnlyActions",
            "Effect": "Allow",
            "Action": [
                "iam:SimulatePrincipalPolicy",
                "iam:GetAccountSummary"
            ],
            "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>"
        },
        {
            "Sid": "DenyAllOtherIAMActions",
            "Effect": "Deny",
            "NotAction": [
                "iam:SimulatePrincipalPolicy",
                "iam:GetAccountSummary"
            ],
            "Resource": "arn:*:iam::*:*"
        }
    ]
}

Users

1. Login to AWS Member account you’re trying to onboard as an Administrator if not already logged in. And navigate to IAM service using AWS search bar.

2. On a IAM Console, Select Users from the left menu

3. Click on Create User

4. Enter the Username & click Next.

5. Select Attach policies directly, on next screen for permissions, please choose 'All Types' in the filter and select the listed policies below.

• ReadOnlyAccess

• ViewOnlyAccess

• IAMReadOnlyAccess

• CloudWatchReadOnlyAccess

• ComputeOptimizerReadOnlyAccess

• AWSOrganizationsReadOnlyAccess

or you can use below policies

ViewOnlyAccess
CloudWatchReadOnlyAccess
ComputeOptimizerReadOnlyAccess
AWSOrganizationsReadOnlyAccess

6. Click Next again & on a final page, give a name to the role & click Create user

   

7. Once the user is created, please click on the user to create a Secret Key

8. Go to Security Credentials tab & Click on Create Access Key

   

9. Select Application running outside AWS & Click on Next

   

10. Click on Create access key.

11. Secret Key will get generated.

12. Copy the Access Key & Secret Key which will be required in the next step.

13. Open newly created user

14. Click on Add permissions → Create inline policy.

15. Search for Cost Explorer Service

16. Click on Write → StartSavingsPlansPurchaseRecommendationGeneration →Next

    

    
    

17. Enter the policy name.

18. Click onCreate policy.