Step-2 : Create an IAM role for Mavvrik

1. Login to AWS Member account you’re trying to onboard as an Administrator if not already logged in. And navigate to IAM service using AWS search bar.

2. On the IAM Console, Select Roles from the left menu, and click Create role.

3. Select Custom trust policy

4. Copy the JSON

   {
     "Version": "2012-10-17",
       "Statement": [
         {
           "Effect": "Allow",
           "Action": ["sts:AssumeRole"],
           "Principal": {
             "AWS": [
               "arn:aws:iam::911403356698:user/global-user-for-assume-role",
               "arn:aws:iam::911403356698:user/mavvrik-svc-user",
               "arn:aws:iam::911403356698:role/mavvrik-svc-role"
             ]
           },
           "Condition": {
             "StringEquals": {
               "sts:ExternalId": "<TENANT-ID>"
             }
           }
         }
       ]
   }
   

5. Paste the copied JSON in Custom trust policy editor

   

6. Remove <TENANT-ID>

7. Enter your tenant id as shown image. To get the tenant id to

1. 1. Login to Mavvrik

   2. From the side menu, select API under the Admin section

   3. Capture the Tenant ID

8. Click Next, on next screen for permissions, please choose 'All Types'in the filter and select the listed policies below.

• ReadOnlyAccess

• ViewOnlyAccess

• IAMReadOnlyAccess

• CloudWatchReadOnlyAccess

• ComputeOptimizerReadOnlyAccess

• AWSOrganizationsReadOnlyAccess

  

9. Click Next again & on a final page, give a name to the role & click Create role

10. Open the newly created role

11. Click on Add permissions → Create inline policy.

    

    
    

12. Search for Cost Explorer Service

13. Click on Write → StartSavingsPlansPurchaseRecommendationGeneration →Next

    

    
    

14. Enter the policy name.

15. Click onCreate policy.

    

16. Once the role is created, please note the ARN of a role, which will be required in the next step.

If you still wish to prefer using access/secret access key. Follow below steps

1. Login to AWS Member account you’re trying to onboard as an Administrator if not already logged in. And navigate to IAM service using AWS search bar.

2. On a IAM Console, Select Users from the left menu

3. Click on Create User

4. Enter the Username & click Next.

5. Select Attach policies directly, on next screen for permissions, please choose 'All Types' in the filter and select the listed policies below.

• ReadOnlyAccess

• ViewOnlyAccess

• IAMReadOnlyAccess

• CloudWatchReadOnlyAccess

• ComputeOptimizerReadOnlyAccess

• AWSOrganizationsReadOnlyAccess

  

6. Click Next again & on a final page, give a name to the role & click Create user

   

7. Once the user is created, please click on the user to create a Secret Key

8. Go to Security Credentials tab & Click on Create Access Key

   

9. Select Application running outside AWS & Click on Next

   

10. Click on Create access key.

11. Secret Key will get generated.

12. Copy the Access Key & Secret Key which will be required in the next step.

13. Open newly created user

14. Click on Add permissions → Create inline policy.

15. Search for Cost Explorer Service

16. Click on Write → StartSavingsPlansPurchaseRecommendationGeneration →Next

    

    
    

17. Enter the policy name.

18. Click onCreate policy.