MMS: Create AWS Role for Cross-Account Access

MongoDB

This guide provides instructions for creating a Role for Cross-Account Access in AWS and then adding the appropriate credentials to MMS.

Rather than providing direct access to AWS Keys, MMS now requires users to provide an AWS Role for Cross-Account Access to use provisioning features. This is more secure as it doesn’t require users to share their Keys.

1. To get started, log into your AWS account and from the console home, select “Identity and Access Management.”

2. From the left sidebar navigation, select “Roles”, then choose “Create New Role.”

3. Give your Role a name, then click “Next Step.”

4. Choose “Role for Cross-Account Access”, select “Allows IAM users from a 3rd party AWS account to access this account.”, then click “Next Step.”

5. Copy the AWS Account ID and External ID provided by MMS to the “Account ID” and “External ID” fields, then click “Next Step.”

6. On the “Attach Policy” step, make NO SELECTION. Just click “Next Step”

7. While reviewing the Role you’re creating, copy the “Role ARN” into the appropriate field in MMS, then click “Create Role.”

8. On this screen you’ll see a list of all your roles. Click the one you just created.

9. From the “Permissions” section, select “Inline Policies” and then create new.

10. On the “Set Permissions” page, select “Custom Policy.”

11. On the “Review Policy” page, enter a name for your policy (can be anything) and then paste the following document object into the Policy Document field, then click “Apply Policy”

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:*AccessKey*", "iam:GetUser"],
      "Resource": ["*"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:AttachVolume",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:CreateKeyPair",
        "ec2:CreateSecurityGroup",
        "ec2:CreateTags",
        "ec2:CreateVolume",
        "ec2:DeleteKeyPair",
        "ec2:DeleteSecurityGroup",
        "ec2:DeleteTags",
        "ec2:DeleteVolume",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeInstanceAttribute",
        "ec2:DescribeInstanceStatus",
        "ec2:DescribeInstances",
        "ec2:DescribeKeyPairs",
        "ec2:DescribeRegions",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeTags",
        "ec2:DescribeVpcs",
        "ec2:DescribeVpcAttribute",
        "ec2:DescribeVolumeStatus",
        "ec2:DescribeVolumes",
        "ec2:DescribeVolumeAttribute",
        "ec2:ImportKeyPair",
        "ec2:RunInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances",
        "ec2:TerminateInstances"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

8. Close your AWS console and return to MMS to continue with setup.