Skip to main content

Link your AWS account

Link your AWS account to unlock advanced functionalities such as proactive resource quota monitoring, Spot Scaling, real-time anomaly detection, AWS Trusted Advisor insights, and AWS Cost Optimization Hub insights.

Required permission​

  • Manage Settings

To link an AWS account to DoiT:

  1. Sign in to the DoiT console, select Integrate from the top navigation bar, and then select Amazon Web Services.

  2. On the Link Amazon Web Services page, select Link account.

    Link Amazon Web Services account

Proceed to create an AWS IAM Role with the required policies. You can choose to Create a role automatically or Create a role manually.

Create a role automatically​

  1. Select Create a role automatically.

  2. Select features to enable on your AWS account. You can expand a feature to review its required AWS policies.

    An expanded feature section

  3. Create a CloudFormation stack for the IAM role, using AWS CloudFormation console or AWS CloudShell.

    1. Select Link account to launch the DoiT stack template in the AWS CloudFormation console.

    2. Make sure that you are in the US East (N. Virginia) us-east-1 region.

      Link Amazon Web Services account

    3. Select the checkbox at the bottom of the page to acknowledge that AWS CloudFormation might create IAM resources with custom names.

      Link Amazon Web Services account

    4. Create the stack.

After creating the stack, it can take up to 30 seconds for the account to link to the DoiT Platform. If successful, your linked AWS account will show a Healthy status.

Create a role manually​

  1. Select Create a role manually.

  2. Note down the values of Our AWS Account and Your External ID displayed in the DoiT console.

    The manual role creation form

  3. (Optional) If you want to enable real-time anomaly detection on the account, enter the AWS CloudTrail S3 bucket name and specify the region where the bucket resides (the bucket must reside in one of the supported regions).

  4. Create an AWS IAM Role in the AWS Management Console. (See also Creating an IAM role (console).)

    1. Navigate to the AWS IAM console, select Roles in the left-hand side navigation pane, and then select Create role.

    2. Select AWS account as the trusted entity.

    3. Select Another AWS account, enter the DoiT AWS account ID (the Our AWS Account provided in the DoiT console).

    4. Select the checkbox Require external ID, enter your external ID.

    5. Select Next to add permissions.

      Choose policies in accordance with the features to enable:

      • For Core, add specific AWS managed policies to your role.

      • For other features, create custom policies by selecting Create policy, switching to the JSON tab, and then pasting the relevant feature permissions.

      See also

      AWS Documentation: Creating IAM policies (console)

    6. Once the policies are created, go back to your original tab. You may need to refresh to see the new policies in the search list.

    7. Select all the new policies for the features you want to enable in addition to the three built-in policies required for Core features.

    8. Select Next, give the Role a name, review the selected policies, and then select Create role.

  5. After creating the role, select the role name to open its summary page, copy the value of the role's ARN, and paste the Role ARN to the DoiT console.

  6. Select Add to link your AWS account.

If successfully, the status of your AWS account will show as Healthy in the DoiT console.

Feature permissions​

Below are the required permissions of the core functionality and various features you can enable on a linked account. See also Security and data access policy.

Core permissions are a minimum set of read-only permissions for many DoiT platform features. It consists of the following AWS managed policies:

AWS managed policyDescription
SecurityAuditGrants access to read security configuration metadata.
AWSSavingsPlansReadOnlyAccessProvides read-only access to Savings Plans service.
BillingGrants permissions for billing and cost management.

Edit linked accounts​

To unlink an account:

  1. Navigate to the Link Amazon Web Services page.

  2. Locate the account of interest.

  3. Select the three dots menu (⋮) at the rightmost end of the account entry.

  4. Select Unlink account.

    The location of the Unlink option

Modify feature access​

Add a feature​

To add a new feature, you need to update the IAM role of the linked account with additional permissions:

  1. Select the three dots menu (⋮) at the rightmost end of the account entry.

  2. Select Edit account.

  3. Select the checkbox of the new feature.

  4. Update the IAM role with the new permissions by using one of the following options.

    • Select Update account to create a CloudFormation stack in the AWS console.

    • Select Prefer CLI to get the command to create the CloudFormation stack via AWS CloudShell.

    See Create a role automatically for more information.

Remove a feature​

To remove a feature:

  1. Open the IAM page in the AWS console.

  2. Detach the policies associated with the feature in the linked account's role.

Last updated on