(Optional) Configure cross AWS account access in AWS

If the given user credentials has access to VPCs belonging to other AWS accounts, they will be available for processing as part of the AWS connector.

1. The designated Secure Workload user should have the following AWS access permissions:

   1. iam:GetPolicyVersion
   2. iam:ListPolicyVersions
   3. iam:ListAttachedUserPolicies
   4. iam:GetUser
   5. servicequotas:ListServiceQuotas
   

   Example AWS policy JSON:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "VisualEditor0",
         "Effect": "Allow",
         "Action": [
           "iam:GetPolicyVersion",
           "iam:ListPolicyVersions",
           "iam:ListAttachedUserPolicies",
           "iam:GetUser",
           "servicequotas:ListServiceQuotas"
         ],
         "Resource": "*"
       }
     ]
   }
   

2. Create an AWS IAM role in the desired AWS account of which the designated Secure Workload user is NOT part of.

3. Allow the AWS IAM role to be assumed by the Secure Workload user. This can be done by adding the Secure Workload user ARN to the AWS IAM role trust policy.

   Example AWS IAM role trust policy JSON:

   {
     "Version": "2012-10-17",
     "Statement": [
         {
           "Effect": "Allow",
           "Principal": {
             "AWS": <Secure Workload_user_arn>
               },
     "Action": "sts:AssumeRole",
     "Condition": {} 
       }
     ]
   }
   

4. Perform the steps 2 and 3 for all the desired AWS accounts which the Secure Workload user does not belong to.

5. Create a customer managed policy (NOT Inline policy) with permission to assume all the created AWS roles from different accounts.

   In AWS connector, Customer Inline Policy is not supported.

   Example Managed policy JSON:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "VisualEditor0",
         "Effect": "Allow",
         "Action": "sts:AssumeRole",
         "Resource": [<AWS_role_cross_account_1_arn>, <AWS_role_cross_account_2_arn>...]
       }
     ]
   }
   

6. Attach the created customer managed policy to the Secure Workload user.

7. The connector configuration wizard will provide a CloudFormation Template. After uploading the CFT as-is to the designated Secure Workload user, you will edit the template and upload the edited template to the CloudFormation portal to grant the required permissions to the AWS IAM roles. For details, see Create a New AWS Connector.