# Create a parent-child resource handler for AWS

> Where an AWS organization holds many member accounts, Cloud Management Platform (CMP) can add each as a child of the management account's resource handler

---

Site [llms.txt](/llms.txt)

---

A child handler carries no credentials of its own. It uses the parent's and assumes a cross-account IAM role that exists in the member account under the same name. CMP can create that role across the member accounts for you, then import the accounts as handlers.

## Prerequisites

The work happens on the **Organization Accounts** tab of the parent handler. That tab appears only where all of the following are true:

- The handler uses the **Amazon Web Services** technology, not AWS GovCloud (US) or AWS China.
- Its account is the management account of an AWS organization.
- Its **Credentials Type** is **Account Credentials**, and its **Authentication Type** is **Access & Secret Key**.

You also need a JSON file holding the permission policy for the cross-account role, and a CMP admin account to create the role.

For what the policy should grant, see [AWS permissions](/docs/cmp/configure/infrastructure/resource-handlers/aws/#aws-permissions).

## Create the cross-account IAM role

This creates one role, under one name, in each member account you select.

To create it, CMP assumes the `OrganizationAccountAccessRole` role in each selected account with the management account's credentials. AWS creates that role for accounts created in the organization. For an invited account, create the role first, or use [the StackSet method](#create-the-roles-with-a-cloudformation-stackset) instead.

1. Go to **Admin** > **Resource Handlers** and open the management account's handler.
1. Go to the **Organization Accounts** tab and select **Create IAM Role**.
1. Select the accounts under **Organization Accounts**. The list shows the active member accounts in the organization, by name and ID. It does not include the management account.
1. Enter an **IAM Role Name**. It can be 4 to 64 characters, and may contain letters, digits, and the characters + = , . @ _ - but no spaces.
1. Upload the **Permission Policy File**. It must be a .json file holding the policy.
1. Select **Create Roles**. CMP starts a job; open it to follow progress.

## Import the member accounts

1. Return to the parent handler's **Organization Accounts** tab and select **Import Organization Accounts**.
1. Select the accounts under **Organization Accounts**. This list shows only accounts that are active and not already a child handler. The management account is not listed.
1. Enter the **IAM Role Name** you created in each account.
1. Select the regions to import under **Available Regions**. CMP creates one environment for each VPC in each region, in every child handler.
1. Select **Import OU Accounts**. CMP starts a job that creates a child handler for each account, then a sub-job that imports the regions for each one.

When the job finishes, the child handlers are listed on the **Organization Accounts** tab with their environment and server counts. Open one and use **Verify Connection** to confirm the role can be assumed. A child handler's Overview tab displays its parent's name.

## Create the roles with a CloudFormation StackSet

Where you would rather create the roles in AWS, a StackSet deploys the same role across the organization.

1. Download [CloudboltStackSetChildRoles.json](https://raw.githubusercontent.com/CloudBoltSoftware/cloudbolt-forge/master/internal/cloudformation_templates/CloudboltStackSetChildRoles.json) from CloudBolt Forge.
1. In the AWS console, go to **CloudFormation** > **StackSets** and create a StackSet.
1. Under Prerequisite, select **Template is ready**. Under Specify template, select **Upload a template file** and upload the file.
1. Enter a StackSet name, the account ID, and the role name.
1. On the StackSet options page, set Execution configuration to **Inactive**.
1. Select **Deploy new stacks** and **Deploy to organization**, activate automatic deployment, set account removal behavior to delete stacks, and specify the regions the roles are needed in.
1. Review, acknowledge the resources being created, and submit.

Then import the member accounts as above, giving the role name from the template.

## Related

- [AWS](/docs/cmp/configure/infrastructure/resource-handlers/aws/): adding a handler and what an AWS handler needs permission to do.