Step-3: Create Role / IAM User

Mavvrik supports both types of AWS authentications,

1. Roles

2. Users

Role-based access is generally considered to be more secure than user-based access, as it allows organizations to control access to resources and functions based on defined roles and responsibilities. We recommend using roles over individual users whenever possible

Roles

1. Search IAM and Navigate to IAM dashboard

2. Click on Roles from the left menu options and Click on Create Role

3. Select AWS Accounts and select Another AWS Account from an AWS Account tab

4. specify Account ID as 911403356698(This is the Account Id of Mavvrik which is universal)

5. Check on options Require external ID and enter the tenant id. To get the tenant id to follow instructions,

   1. Login to Mavvrik

   2. From the side menu, select API under the Admin section

   3. Capture the Tenant ID & enter it into the External ID field

6. Click Next and don’t select any permissions

7. Enter the Role name and click Create role.

   

   
   

8. A new role should be created and displayed in the list.

9. Click on the newly created Role which is navigated to the below page

10. Click on Add Permissions -> Create Inline Policy under Permissions Tab

11. Click on JSON tab & replace existing JSON with the below JSON

12. Replace <BUCKET_NAME> on lines 11 & 12 with the name of the bucket captured in Step-1: Enable CUR & Cost Explorer

    JSON

    { 
       "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "s3:GetObject",
                    "s3:ListBucket"
                ],
                "Resource": [
                    "arn:aws:s3:::<BUCKET_NAME>",
                    "arn:aws:s3:::<BUCKET_NAME>/*"
                ]
            },
            {
                "Effect": "Allow",
                "Action": [
                    "organizations:Describe*",
                    "organizations:List*"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "ce:Get*",
                    "ce:Desc*",
                    "ce:List*"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "iam:Get*",
                    "iam:List*",
                    "iam:SimulateCustomPolicy",
                    "iam:SimulatePrincipalPolicy"
                ],
                "Resource": "*"
            },
            {
         "Effect": "Allow",
         "Action": [
                    "cur:Get*",
                    "cur:ValidateReportDestination",
                    "cur:Describe*"
          ],
         "Resource": "*"
    }
        ]
    }
    

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>",
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "organizations:Describe*",
                "organizations:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ce:Get*",
                "ce:Desc*",
                "ce:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:Get*",
                "iam:List*",
                "iam:SimulateCustomPolicy",
                "iam:SimulatePrincipalPolicy"
            ],
            "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cur:Get*",
                "cur:ValidateReportDestination",
                "cur:Describe*"
            ],
            "Resource": "*"
        }
    ]
}

13. Click Next and Enter Policy, Name it & Click Create policy

14. After creating policy below page is displayed. Capture ARN of the role from the summary section for the next steps.

    

    
    

Users

This step is not required if you have created a Role.

1. Search IAM, Navigate to IAM dashboard and Click Users

2. Click Add Users, Enter name of your choice

3. Skip permissions for now. Keep doing Next & finally Create User.

4. Click the User you have created & click on Security credentials.

5. Scroll down & click on Create access key

   

6. Select Others & click on next

7. Click on Create Access Key

8. Capture Access key & Secret access key which is used in subsequent steps.

9. Click Done

10. Navigate to the details of the user we just created

11. Click Create Inline Policy under Permissions Tab & Click on JSON tab & replace existing JSON with the below JSON

12. Replace <BUCKET_NAME> on lines 11 & 12 with the name of the bucket captured in Step-1: Enable CUR & Cost Explorer

    JSON

    { 
       "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "s3:GetObject",
                    "s3:ListBucket"
                ],
                "Resource": [
                    "arn:aws:s3:::<BUCKET_NAME>",
                    "arn:aws:s3:::<BUCKET_NAME>/*"
                ]
            },
            {
                "Effect": "Allow",
                "Action": [
                    "organizations:ListAccounts",
                    "organizations:DescribeAccount"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "ce:Get*",
                    "ce:Desc*",
                    "ce:List*"
                ],
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": [
                    "iam:Get*",
                    "iam:List*",
                    "iam:SimulateCustomPolicy",
                    "iam:SimulatePrincipalPolicy"
                ],
                "Resource": "*"
            },
            {
         "Effect": "Allow",
         "Action": [
                    "cur:Get*",
                    "cur:ValidateReportDestination",
                    "cur:Describe*"
          ],
         "Resource": "*"
    }
        ]
    }
    

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>",
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "organizations:Describe*",
                "organizations:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ce:Get*",
                "ce:Desc*",
                "ce:List*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:Get*",
                "iam:List*",
                "iam:SimulateCustomPolicy",
                "iam:SimulatePrincipalPolicy"
            ],
            "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cur:Get*",
                "cur:ValidateReportDestination",
                "cur:Describe*"
            ],
            "Resource": "*"
        }
    ]
}

13. Review the policy & click create