Create a parent-child resource handler for AWS

A child handler carries no credentials of its own. It uses the parent’s and assumes a cross-account IAM role that exists in the member account under the same name. CMP can create that role across the member accounts for you, then import the accounts as handlers.

Prerequisites

The work happens on the Organization Accounts tab of the parent handler. That tab appears only where all of the following are true:

• The handler uses the Amazon Web Services technology, not AWS GovCloud (US) or AWS China.
• Its account is the management account of an AWS organization.
• Its Credentials Type is Account Credentials, and its Authentication Type is Access & Secret Key.

You also need a JSON file holding the permission policy for the cross-account role, and a CMP admin account to create the role.

For what the policy should grant, see AWS permissions.

Create the cross-account IAM role

This creates one role, under one name, in each member account you select.

To create it, CMP assumes the OrganizationAccountAccessRole role in each selected account with the management account’s credentials. AWS creates that role for accounts created in the organization. For an invited account, create the role first, or use the StackSet method instead.

1. Go to Admin > Resource Handlers and open the management account’s handler.
2. Go to the Organization Accounts tab and select Create IAM Role.
3. Select the accounts under Organization Accounts. The list shows the active member accounts in the organization, by name and ID. It does not include the management account.
4. Enter an IAM Role Name. It can be 4 to 64 characters, and may contain letters, digits, and the characters + = , . @ _ - but no spaces.
5. Upload the Permission Policy File. It must be a .json file holding the policy.
6. Select Create Roles. CMP starts a job; open it to follow progress.

Import the member accounts

1. Return to the parent handler’s Organization Accounts tab and select Import Organization Accounts.
2. Select the accounts under Organization Accounts. This list shows only accounts that are active and not already a child handler. The management account is not listed.
3. Enter the IAM Role Name you created in each account.
4. Select the regions to import under Available Regions. CMP creates one environment for each VPC in each region, in every child handler.
5. Select Import OU Accounts. CMP starts a job that creates a child handler for each account, then a sub-job that imports the regions for each one.

When the job finishes, the child handlers are listed on the Organization Accounts tab with their environment and server counts. Open one and use Verify Connection to confirm the role can be assumed. A child handler’s Overview tab displays its parent’s name.

Create the roles with a CloudFormation StackSet

Where you would rather create the roles in AWS, a StackSet deploys the same role across the organization.

1. Download CloudboltStackSetChildRoles.json from CloudBolt Forge.
2. In the AWS console, go to CloudFormation > StackSets and create a StackSet.
3. Under Prerequisite, select Template is ready. Under Specify template, select Upload a template file and upload the file.
4. Enter a StackSet name, the account ID, and the role name.
5. On the StackSet options page, set Execution configuration to Inactive.
6. Select Deploy new stacks and Deploy to organization, activate automatic deployment, set account removal behavior to delete stacks, and specify the regions the roles are needed in.
7. Review, acknowledge the resources being created, and submit.

Then import the member accounts as above, giving the role name from the template.