Docs: Create AWS Account

Mon, 01 Jan 0001 00:00:00 +0000

Procedure

On the Cloud Accounts page, click “Create” above the list to open the create cloud account page.
Select AWS as the cloud platform, then click “Next: Configure cloud account”.
Configure the following parameters:
- Name: AWS account name.
- Account type: Currently supports connecting AWS Global and China region accounts.
- Key ID / password: Key ID and password for connecting to AWS. See How to obtain AWS parameters. To onboard AWS Organization accounts, see How to onboard AWS Organizations accounts.
- Common parameters: see Common configuration parameters.
Click “Connection test” to verify that the parameters are correct.
After a successful test, click “Next: Configure sync regions” to configure resource sync regions (all regions are synced by default).
After configuration, click “Next: Billing file access information (optional)” to configure billing parameters.
Configure scheduled sync (optional), then click “OK” to create the AWS account.

How to obtain AWS parameters

Obtain AWS access keys

Sign in to the AWS Management Console with the AWS primary account (or a sub-account with Administrator Access), click “IAM”, and open the IAM dashboard.
Click “Users” in the left menu to open the user list, then click a user name to open the user details page. Choose a user with sufficient management permissions.
Click the “Security credentials” tab.
Click “Create access key”. In the create access key dialog, you can see the key information: key ID (Access Key ID) and password (Access Key Secret).

Private access keys are visible only at creation time. Copy and save them. If lost, create a new key.

Permission configuration

To manage AWS resources through the platform, the cloud account needs the following permissions:

Permission description	Read-only	Read-write
Manage all AWS resources	ReadOnlyAccess	AdministratorAccess
Manage Amazon EC2	AmazonEC2ReadOnlyAccess	AmazonEC2FullAccess
Manage Amazon VPC	AmazonVPCReadOnlyAccess	AmazonVPCFullAccess
Manage Amazon S3	AmazonS3ReadOnlyAccess	AmazonS3FullAccess
Manage Elastic Load Balancing (ELB)	ElasticLoadBalancingReadOnly	ElasticLoadBalancingFullAccess
Manage Amazon RDS	AmazonRDSReadOnlyAccess	AmazonRDSFullAccess
Manage Amazon ElastiCache	AmazonElastiCacheReadOnlyAccess	AmazonElastiCacheFullAccess
Manage AWS CloudTrail	AWSCloudTrailReadOnlyAccess	AWSCloudTrail_FullAccess
Manage Amazon EFS	AmazonElasticFileSystemReadOnlyAccess	AmazonElasticFileSystemFullAccess
Manage WAF	AWSWAFReadOnlyAccess	AWSWAFFullAccess
Manage IAM	IAMReadOnlyAccess	IAMFullAccess
Manage Amazon Route 53	AmazonRoute53ReadOnlyAccess	AmazonRoute53FullAccess
Manage billing and cost	AWSBillingReadOnlyAccess	Billing
Manage Amazon CloudWatch	CloudWatchReadOnlyAccess	CloudWatchFullAccess

Billing configuration

Cloud account type

Includes primary account and associated account. Before using an associated account, ensure the primary account has been imported to the platform, and select that primary account when using the associated account.

Billing analysis scope

Set the scope for the platform to analyze cloud account billing. Includes accounts onboarded on this platform and all accounts.

Accounts onboarded on this platform: Collect billing for the primary account and its associated organization accounts. If the AWS account is used only as a payer for other AWS accounts, billing files for those other AWS accounts are discarded.
All billing: Collect all billing for the primary account. For billing entries whose corresponding cloud account cannot be found on the platform, the cloud subscription is shown as “this cloud account name – numeric ID of the cloud account associated with the billing entry”.

How to obtain the bucket URL?

New version (required for AWS accounts created after 2019/08/07)

Sign in to the AWS Management Console with the AWS primary account, click the username in the upper right, then “My Billing Dashboard”, and open the Billing and Cost Management dashboard.
Click “Cost & Usage Reports” in the left menu. On the AWS Cost and Usage Reports page, click “Create report” to open the create report page.
Configure the report name, select “Include resource IDs”, then click “Next” to open the delivery options page.
Configure the S3 bucket. You can select an existing bucket or create a new one.
Configure the report path prefix, set time granularity to “Hourly”, report version to “Create new report version”, and compression type to “ZIP”, then click “Next” to open the review page.
After confirming the configuration, record the S3 bucket and report path prefix shown in the red boxes, then click “Review and Complete” to finish configuration and create the report.
On the S3 storage management page in the AWS console, view the overview of any billing file in the corresponding bucket and record the object URL. The bucket URL is that URL with the file name removed.
The file prefix is the report path prefix from step 6.

Legacy version

Sign in to the AWS Management Console with the AWS primary account, click the username in the upper right, then “My Billing Dashboard”, and open the Billing and Cost Management dashboard.
Click “Billing preferences” in the left menu. On the preferences page, under “Cost management preferences”, view and record the S3 bucket for “Receive Billing Reports”.
On the S3 storage management page in the AWS console, view the overview of any billing file in the corresponding bucket and record the object URL. The bucket URL is that URL with the file name removed.
For AWS, the file prefix is the AWS account ID.

How to onboard AWS Organizations accounts?

Configure AWS Organizations: Use an AWS organization account to associate AWS accounts. You can create new AWS accounts or invite existing AWS accounts. Invited AWS accounts must have the “OrganizationAccountAccessRole” role.
Obtain access keys: Create access keys for an IAM user on the management account of the AWS organization account. Using a user with AdministratorAccess is recommended.

Configure AWS Organizations

Sign in to the AWS Management Console with the AWS primary account, click the username in the upper right, then “My Billing Dashboard”, and open the Billing and Cost Management dashboard.
Click “Consolidated Billing” on the right to open the AWS Organizations page.
On the AWS Organizations – AWS accounts page, add AWS accounts. Two ways to add an AWS account to an Organization are supported:
- Create AWS account: Set the AWS account name, the account owner’s email address, and the IAM role name (OrganizationAccountAccessRole), then click “Create AWS account”.
- Invite existing AWS account: Set the email address or account ID of the AWS account to invite, then click “Send invitation”.

How to add the OrganizationAccountAccessRole role to an AWS account?

Sign in to the AWS Management Console with the AWS primary account, click “IAM”, and open the IAM dashboard.
Click “Roles” on the right. On the roles page, click “Create role”.
Select “Another AWS account” as the trusted entity type, enter the account ID that manages the AWS Organization, then click “Next: Permissions”.
Attach the “AdministratorAccess” permission policy, then click “Next: Tags”.
Configure tags as needed. After configuration, click “Next: Review”.
Set the role name to “OrganizationAccountAccessRole”, then click “Create role”.

Cloudpods – AWS