AWS on CloudBolt Documentation

Authenticate with an IAM role

Mon, 01 Jan 0001 00:00:00 +0000

Access keys have to be rotated and tracked, which gets tedious across many accounts. With the IAM role option, the keys live in one place: an AWS account profile stored under Connection Info. Each handler then names the role Cloud Management Platform (CMP) should assume.

Create the AWS account profile

The profile holds the access key and secret key CMP uses to assume the role. Create it before the handler, because the add dialog offers only profiles that already exist.

Authenticate with Roles Anywhere

Mon, 01 Jan 0001 00:00:00 +0000

Cloud Management Platform (CMP) presents a client certificate to the Roles Anywhere API and receives temporary credentials in return, valid for one hour. CMP requests new credentials each time it connects. Nothing long-lived is stored in CMP, which suits a multi-tenant deployment where you want to share the resources in an account without sharing its keys.

What you set up first

Four things must exist in AWS before you add the handler, each of which produces a required value. Work through them in order.

Authenticate with ADFS

Mon, 01 Jan 0001 00:00:00 +0000

Use this where your organization already federates AWS access through ADFS and does not want to issue a key pair for Cloud Management Platform (CMP) to hold. CMP logs in to your ADFS server with the provided credentials, receives a SAML assertion, and exchanges it for temporary AWS credentials by assuming a SAML role.

Prerequisites

A SAML IAM role in AWS, and its role ARN. The role must appear in the ADFS assertion issued for the account you log in with.
An ADFS server with the AWS relying party trust configured and IdP-initiated sign-on enabled, since that is the page CMP posts the credentials to.
An Active Directory account with permission to log in there.

Create the handler

Go to Admin > Resource Handlers and select Add.
Select the Amazon Web Services tile.
Set Credentials Type to ADFS Credentials.

Complete the fields that appear:

Field	Description
Username	The Active Directory username or email address, such as `admin@example.com`.
Password	That account’s password.
ADFS Domain Name	The ADFS server’s domain, such as `adserver.example.com`.
SAML IAM Role ARN	The role CMP assumes, such as `arn:aws:iam::111111111111:role/YourADFSRole`.
ADFS Server SSL Verification	Leave enabled unless the ADFS server presents a certificate CMP cannot verify. Disabling it stops CMP from checking the certificate at login.

Select Continue, then complete the handler’s settings and select at least one region, as described under Add an AWS resource handler.

Authenticate with IAM Auto Discovery

Mon, 01 Jan 0001 00:00:00 +0000

CMP reads temporary credentials for the role from the EC2 instance metadata service, so nothing is stored in CMP, and nothing needs to be rotated. This suits AWS security guidance that favors roles over long-lived keys.

Prerequisites

CMP installed on an AWS EC2 instance. This option works only there, because the credentials come from that instance’s metadata.
An IAM role attached to that same EC2 instance, carrying the permissions listed under AWS permissions.

Create the IAM role in AWS

In the IAM console, select Roles, then Create role.
Select AWS service as the trusted entity type and EC2 as the use case, then select Next.
Attach a policy granting the permissions under AWS permissions, or select Create policy and paste them in as JSON.
Name the role and create it. You need its exact name in CMP.

Attach the role to the EC2 instance running CMP

In the AWS console, go to EC2 > Instances and open the instance CMP is installed on.
Go to Actions > Security > Modify IAM role.
Select the role you created and save.

The role must be on the instance CMP itself runs on, not on the instances CMP provisions.

Create a parent-child resource handler for AWS

Mon, 01 Jan 0001 00:00:00 +0000

A child handler carries no credentials of its own. It uses the parent’s and assumes a cross-account IAM role that exists in the member account under the same name. CMP can create that role across the member accounts for you, then import the accounts as handlers.

Prerequisites

The work happens on the Organization Accounts tab of the parent handler. That tab appears only where all of the following are true:

AWS GovCloud (US) and AWS China

Mon, 01 Jan 0001 00:00:00 +0000

Both connect to their own AWS partition rather than the commercial one, and both are limited to that partition’s regions. Cloud Management Platform (CMP) creates one environment for each VPC in each region you import, exactly as it does for Amazon Web Services. Anything not described here, including the permissions AWS needs to grant and the AWS parameters on each environment, is on the AWS page.

What differs from a commercial AWS handler

Credentials always consist of an access key and a secret key. Neither technology offers the Credentials Type choice, so IAM Role, Roles Anywhere, ADFS, and IAM Auto Discovery are not available. You can still name an IAM Role ARN for CMP to assume.
GovCloud needs a second, commercial credential pair for billing. A GovCloud account does not maintain its own billing data; an associated commercial account does, and CMP reads the cost and usage reports using that account’s keys.
AWS China has no billing. The Billing and Reserved Instances tabs are not offered.

Set up an AWS GovCloud (US) handler

Before you start, collect four credentials: the Access Key ID and Secret Access Key for the GovCloud account, and the Commercial Access Key ID and Commercial Account Secret Access Key for the commercial account that holds the billing bucket. For billing, you also need an S3 bucket in that commercial account configured to receive cost and usage reports. See AWS Cost and Usage Reports.

Import AMIs

Mon, 01 Jan 0001 00:00:00 +0000

CMP first syncs the AMIs available in AWS into its own list; then you pick from that list. Everything happens on the AMIs tab of an AWS resource handler.

Sync AMIs from AWS

Until AMIs have been synced, the import dialogs report that no AMIs are available.

Go to Admin > Resource Handlers and open the AWS handler.
Go to the AMIs tab and select Sync AMIs.
Under AMIs Type, select Private AMIs or Public AMIs.
Select the Regions to sync. Only regions already imported for this handler are listed.
For public AMIs, leave Sync Whitelist AMIs selected unless you need the full list. AWS publishes a large number of public AMIs, and syncing them all takes 15 minutes or more per region.
Select Sync AMIs. CMP starts a job; open it to follow progress.

(opens full-size image in a new tab)