Delegating permissions for a MID Server

Use IAM roles for a MID Server installed on Amazon EC2 within the AWS cloud that is configured to discover cloud resources in "discrete" accounts. A "discrete" account is one that is not an organization - an account with no member accounts. This method of delegating permissions within the cloud eliminates the need to manage AWS account credentials on your instance. Discovery uses the credentials from AWS if an instance profile is configured in AWS for the EC2 instance.

The MID Server retrieves the security credentials from AWS that are provided by the role. The MID Server is then granted the permissions for the actions and resources defined for that role through those security credentials. These security credentials are temporary and rotate automatically. AWS generates new credentials at least five minutes before the expiration of the old credentials.

For instructions on configuring roles for an AWS instance profile, see Amazon Web Services documentation on IAM Roles for Amazon EC2.

Assuming member account roles in a large AWS organization is more convenient and offers better security than using large numbers of permanent credentials for all member accounts. Temporary credentials are only acquired on behalf of a member account when there is no permanent credential specified for that member account in the Service Accounts [cmdb_ci_cloud_service_account] table.

The MID Server uses the AssumeRole action in the AWS Security Token Service API to assume a member account role. Parameters passed to this API determine what additional security restrictions are applied to the role when it accesses AWS resources.

Default member role configuration

By default, the MID Server is configured to assume the OrganizationAccountAccessRole, which grants temporary credentials to all the members of a master account. This action occurs automatically if no permanent credentials exist for the member accounts. This configuration does not apply any additional security or restrict access to any resources in member accounts.

Advanced member role configuration

You can improve security by defining additional roles that a MID Server can assume. These roles can have access to certain member accounts and determine the actions that Discovery is allowed to take on the resources in those accounts.

Create records in the Cloud Management AWS Org Assume Role Parameters module that specify the roles and restrictions that apply. Records in the Cloud Service Account AWS Org Assume Role Params [cloud_service_account_aws_org_assume_role_params] table pass their parameters to the AWS Security Token Service API, which then provides the appropriate credentials and permissions to the MID Server.

How Discovery determines which credentials to use

Caching of temporary credentials

By default, temporary credentials for member accounts are cached for 60 minutes. This interval allows the horizontal Discovery process to run multiple times without generating new credentials during each Discovery.

Configure a custom AWS member role

Customize the AWS roles that a MID Server can assume to receive temporary credentials for member accounts. You can configure additional parameters to improve security and customize the way that the member account’s role is assumed when discovering cloud resources. To configure custom AWS member roles with the procedure, see Configure a custom AWS member role.