Skip to main content

Link AWS accounts via DoiT console

When linking new AWS accounts via the DoiT console, choose an approach based on your setup:

CloudFormation StackSet prerequisites​

To use CloudFormation StackSets:

Using StackSets lets you automate the deployment of required permissions across all member accounts within your deployment target with a single setup. It also automates the account lifecycle management.

  • If you add a new member account to your AWS Organization, the StackSet deploys the required permissions, and DoiT discovers the account automatically.

  • If you move an account out of the linked OU or root, the stack is automatically deleted from that account, and the features are no longer available for it.

Tip

For accounts already connected using CloudFormation stacks, to switch to the CloudFormation StackSet approach, you must first unlink each account or delete the CloudFormation stack in the AWS console.

To link new AWS accounts:

  1. In the DoiT console, select Data ingestion and integrations > AWS from the top navigation mega menu.

  2. On the Connect Amazon Web Services page, select Link new account.

    Link Amazon Web Services account

  3. Choose an option to create a cross-account AWS IAM Role with the required policies.

    Link account options

    • Create a role automatically (recommended): DoiT launches a CloudFormation stack or StackSet that deploys the required policies.

    • Create a role manually: You create the IAM role in the AWS console and paste the role ARN back into the DoiT console.

Create a role automatically​

  1. Select Create a role automatically.

  2. Select features to enable on your AWS account. You can expand a feature to review its required AWS policies.

    An expanded feature section

    • Read-only permissions: Features requiring only Read-only access are included by default; you do not have to manually select them.

    • Write permissions: Features requiring Write access must be manually added by selecting the corresponding checkboxes.

    • If you select Real-time anomalies, you must provide an S3 bucket that contains CloudTrail event files. See Enable real-time anomaly on AWS accounts for more information.

  3. Select Link new account.

  4. Choose the way to create the cross-account IAM role.

    The Deployment target ID field

    • Deployment target ID: This field is required to create a CloudFormation StackSet with service-managed permissions in your management account.

    • Link single account: Select this option to create a CloudFormation stack for an individual account.

CloudFormation StackSets​

For this approach, you need to provide the Deployment target ID (see also CloudFormation StackSet prerequisites).

  1. Open the AWS Organizations console and locate the Organizational Unit (OU) or organization root whose member accounts should receive the selected features.

  2. Copy the OU ID (for example, ou-abcd-12345678) or the root ID (for example, r-abcd).

  3. Return to the DoiT console and paste the OU ID or root ID into the Deployment target ID field.

  4. Read the message in the dialog and select Link new account.

  5. You are redirected to the AWS CloudFormation Quick create stack page to create a CloudFormation StackSet with service-managed permissions.

    If this is the first time you create a StackSet with service-managed permissions, AWS prompts you to activate trusted access for StackSets with AWS Organizations.

  6. Review parameters. The stack name and required parameters (including your deployment target ID and External ID) will be pre-filled.

  7. Adjust the following thresholds if necessary:

    • FailureTolerancePercentage: The percentage of accounts that can fail before the StackSet operation halts. The DoiT template sets this value to 20.

    • Max Concurrent Percentage: Maximum percentage of target accounts to deploy to concurrently. The DoiT template sets this value to 100.

  8. Scroll to the bottom and select the checkboxes to acknowledge that AWS CloudFormation might create IAM resources with custom names and require the CAPABILITY_AUTO_EXPAND capability.

  9. Select Create stack.

The process can take several minutes. If successful, your linked AWS accounts will show a Healthy status.

CloudFormation stack​

You will be taken to the AWS console to create a CloudFormation stack template.

  1. Create a CloudFormation stack for the IAM role, using AWS CloudFormation console or AWS CloudShell.

    1. Select Link New account to launch the DoiT stack template in the AWS CloudFormation console.

    2. Make sure that you are in the US East (N. Virginia) us-east-1 region.

      Link Amazon Web Services account

    3. Select the checkbox at the bottom of the page to acknowledge that AWS CloudFormation might create IAM resources with custom names.

      Link Amazon Web Services account

    4. Create the stack. (See also cross-account AWS IAM Role.)

After creating the stack, it can take up to 30 seconds for the account to link to the DoiT Platform. If successful, your linked AWS account will show a Healthy status.

Create a role manually​

This option applies to all types of AWS accounts.

  1. Select Create a role manually.

  2. Note down the values of Our AWS Account and Your External ID displayed in the DoiT console.

    The manual role creation form

  3. (Optional) If you want to enable real-time anomaly detection on the account, enter the AWS CloudTrail S3 bucket name and specify the region where the bucket resides (the bucket must reside in one of the supported regions).

  4. Create an AWS IAM Role in the AWS Management Console. (See also Creating an IAM role (console).)

    1. Navigate to the AWS IAM console, select Roles in the left-hand side navigation pane, and then select Create role.

    2. Select AWS account as the trusted entity.

    3. Select Another AWS account, enter the DoiT AWS account ID (the Our AWS Account provided in the DoiT console).

    4. Select the checkbox Require external ID, enter your external ID.

    5. Select Next to add permissions.

      Choose policies in accordance with the features to enable:

      • For Core, add specific AWS managed policies to your role.

      • For other features, create custom policies by selecting Create policy, switching to the JSON tab, and then pasting the relevant feature permissions.

      See also

      AWS Documentation: Creating IAM policies (console)

    6. Once the policies are created, go back to your original tab. You may need to refresh to see the new policies in the search list.

    7. Select all the new policies for the features you want to enable in addition to the three built-in policies required for Core features.

    8. Select Next, give the Role a name, review the selected policies, and then select Create role.

  5. After creating the role, select the role name to open its summary page, copy the value of the role's ARN, and paste the Role ARN to the DoiT console.

  6. Select Add to link your AWS account.

If successful, the status of your AWS account will show as Healthy in the DoiT console.

Manage linked accounts​

Caution

This section applies only to AWS accounts that are not linked via CloudFormation StackSets. To unlink a member account of an OU, you have to remove the account from the OU. To modify a member account's feature access, move the account to a different OU with the desired feature set.

To unlink an account:

  1. Navigate to the Link Amazon Web Services page.

  2. Locate the account of interest.

  3. Select the kebab menu (⋮) at the rightmost end of the account entry.

  4. Select Unlink account.

    The location of the Unlink option

Modify feature access​

Add a feature​

To add a new feature, you need to update the IAM role of the linked account with additional permissions:

  1. Select the kebab menu (⋮) at the rightmost end of the account entry.

  2. Select Edit account.

  3. Select the checkbox of the new feature.

    For an AWS management account of a DoiT PartnerOps end customer without AWS Billing Transfer, the CloudFlow feature is selected by default. It is required for creating an AWS connection in CloudFlow.

    PartnerOps Tier-3 customer CloudFlow option

  4. Update the IAM role with the new permissions by using one of the following options.

    • Select Update account to create a CloudFormation stack in the AWS console.

    • Select Prefer CLI to get the command to create the CloudFormation stack via AWS CloudShell.

    See Create a role automatically for more information.

Remove a feature​

To remove a feature:

  1. Open the IAM page in the AWS console.

  2. Detach the policies associated with the feature in the linked account's role.

Feature permissions​

Below are the required permissions of the core functionality and some features you can enable on a linked account. See Security and data access policy: Amazon Web Services for the full list of available features.

Core, Quota Monitoring, and more:

Core permissions consist of three AWS managed policies. If you choose to create the IAM role automatically, read-only permissions required by other DoiT features in your Cloud Intelligence plan are also included in core permissions.

AWS managed policyDescription
SecurityAuditGrants access to read security configuration metadata.
AWSSavingsPlansReadOnlyAccessProvides read-only access to Savings Plans service.
BillingGrants permissions for billing and cost management.

DoiT Insights:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "trustedadvisor:GetRecommendation",
        "trustedadvisor:ListRecommendations",
        "trustedadvisor:ListRecommendationResources"
      ],
      "Resource": "*"
    }
  ]
}
Last updated on