How to Onboard an AWS Member Account

This user guide will explain how to onboard an AWS member account into CoreStack.

📘

Note:

AWS management and member accounts were formerly known as master and linked accounts, respectively. Some areas in the platform UI may still use the old naming conventions.

This user guide uses the latest naming conventions as per AWS. We appreciate your patience while we update the platform UI to align with this.

Pre-onboarding

There are certain prerequisites that need to be set up in your AWS account before it can be onboarded into CoreStack. It primarily involves creating an IAM Role for CoreStack and providing it with necessary access.

Authorize CoreStack to Access Your AWS Account

You can use IAM roles to delegate access to your AWS resources. With IAM roles, you can establish trust relationships between your trusting account and other AWS trusted (CoreStack) accounts. The trusting account owns the resource to be accessed and the trusted account contains the users who need access to the resource.

📘

Note:

IAM User (Access Key and Secret Key) based authentication is no longer supported. This is in compliance with the security standards and recommendations prescribed by AWS.

CoreStack would use the AWS Security Token Service (AWS STS) “AssumeRole” API operation. This operation provides temporary security credentials that enable access to AWS resources in your account.

Refer this link for more information: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html

Required Credentials:

• Role ARN: The Amazon Resource Name (ARN) of IAM Role.
• External ID: The external ID can be any word or number that is agreed upon between you and the third-party account.
• Require MFA: Flag to identify if the role is restricted with multi-factor authentication (MFA).

The IAM role must be created with the following access permissions.

• For Assessment: Read-Only Access.
• For Assessment + Governance: Read-Write Access.

CoreStack simplifies this process by providing a CloudFormation Template that will take care of creating an IAM Role and assign the necessary permissions automatically.

You can use the S3 URLs provided based on the type of access you wish to provide for CoreStack.

• S3 URL with Template for Assessment Only (Read-Only Access): Click here
• S3 URL with Template for Assessment + Automation (Read-Write Access): Click here

Setting Up the IAM Role

1. Login to the AWS account.
2. Navigate to CloudFormation.
3. Click Create Stack with new resources. The Step 1 screen of Create Stack section appears.

4. Select Template is ready option in the Prepare template field.
5. Select Amazon S3 URL option in the Template source field.
6. Copy the required S3 URL with Template from the above section and paste it in the Amazon S3 URL text field.

7. Click Next. The Step 2 screen appears.
8. Provide values for the Stack name and Role name fields. If you have used the Amazon S3 URL with template for Read-Write Access, you can view additional fields that can be left with default values. However, if you do NOT want to configure CFN or GuardDuty or Inspector for your AWS account, you can set them as “false”.

9. Click Next. The Step 3 screen appears.
10. You can leave the values for the fields in this screen as default or make changes as necessary including assigning Tags, providing notification options, etc.

11. Click Next. The Step 4 screen appears.
12. The information provided in all the steps will be displayed. After reviewing the provided information for correctness, scroll down to the end of the screen and click on the acknowledge checkbox.
13. Click Create Stack.

The stack creation process will be initiated, and the status can be viewed.

14. Navigate to Stack Info tab to see the overview of the stack and the final status.
15. Click Refresh icon to retrieve the updated status. When it is successfully completed, you will see the status as “CREATE_COMPLETE”.
16. Navigate to Outputs tab to view the access credentials (ARN).

You need to copy this information and keep it ready in a notepad to be able to copy paste into CoreStack while onboarding. This is the information required to onboard the account into CoreStack.

Setting up Cost Reports

Cost and Usage Report (CUR) must be enabled in your AWS account which enables the platform to fetch the Billing data from your account. This is required for providing Cost Visibility and Cost Analytics for your accounts. If you already have this enabled, you can skip the below step and just be ready with the S3 Bucket name where the CUR files are being placed by AWS.

📘

Note:

AWS used to provide billing data only at the Management (Payer) Account level. From Dec-2020, AWS provides billing data for member accounts as well. If you have onboarded both your management and member accounts, the platform can directly fetch the billing data from the management account for all the member accounts.

To set up the Cost Usage Report, you should login as “Root User” into your management (Payer) AWS account and complete the following steps:

1. Login to the AWS management account as a Root User.

2. Navigate to Billing and Cost Management.

   

3. On the left navigation menu, select  Cost Analysis > Data Exports.

   

4. Click Create.

5. In the Export type field, select the Legacy CUR export option.

   

📘

Note:

If you already have a report configured, you can still review the following steps to ensure that all the settings are configured properly. Use the Edit option to make any changes.

6. Provide necessary details about the report content in the first step. Ensure that the checkboxes Include Resource IDs and Automatically refresh are enabled.
7. Click Next. The screen with Delivery Options appears.
8. Select the following values for the respective fields:
   • Report Path Prefix: Optional field. It can be left blank. There will be no impact even if some prefix is provided.
   • Time Granularity: Daily
   • Report Versioning: Create new report version.
   • Compression Type: GZIP
9. Also, the S3 Bucket configuration must be performed in this step:
   1. Click Configure.
   2. If you already have a bucket with the appropriate permissions, you can select the same or you can select Create a bucket (this is recommended).
      AWS will take care of creating this new bucket and attaching the necessary policies.
   3. Click Next to view the policy to be applied.
   4. Enable the checkbox I have confirmed that is available below.
   5. Click Save to complete the process. The S3 Bucket will be successfully configured.
   6. Click Next to proceed to the next step.
10. The last step is to review the provided values and complete CUR configuration. Ensure that the following values are configured correctly.
    • Time Granularity: Daily
    • Report Versioning: Create new report version.
    • Compression Type: GZIP
11. Click Review and Complete.

The report will be created successfully. You can now continue with onboarding the account to the platform. It will take up to 24 hours before AWS places the first report (CSV file in Gzip format) in the S3 bucket. Hence, the cost data will not be available for the platform until then.

Select Cost Allocation Tags

It is mandatory to configure cost allocation tags in order to process the cost data.

To set up Cost Allocation Tags, perform the following steps:

1. Navigate to Billing Dashboard.
2. Select Cost Allocation Tags from the left navigation menu.
3. Click Activate button.

The recommended tags to be activated are: Application, Environment, Cost Center, Owner. You can also choose to add additional tags as per your requirement.

Impact on the AWS Account

Read-Only Access (Assessment Only):

Since the access is read-only, there are no resources with configurations done by CoreStack in your AWS account. There is absolutely no resource or billing impact in this case.

📘

Note:

1. If you had enabled Cost & Usage Report specifically for CoreStack, the S3 Bucket will incur some minimal cost based on the size of the usage reports placed by AWS.
2. If you had enabled AWS Cost Explorer API to be used by CoreStack for a faster cost data retrieval, additional cost will be incurred based on the API requests initiated. Approximately, each request will incur a cost of $0.01. Refer to AWS Cost Explorer API pricing page for more details.

Read-Write Permissions (Assessment + Governance):

Following resources will be created based on your selection during onboarding:

1. Cloud Trail: CoreStack requires a cloud trail to be available in each of your preferred AWS regions. You may select an existing trail to be used or choose the option to create a new trail. Such new trails created may attract additional charges.

📘

Note:

If the one created is the first trail, it is free of cost. If it is an additional trail, it may involve charges.

2. S3 Buckets: As part of the Cloud Trail configurations, S3 buckets are also created in the respective AWS regions to collect the logs.
   1. If you had chosen to use existing trail, there are no new buckets created.
   2. If you had chosen to create a new trail, the corresponding S3 Bucket will be created and there will be a charge associated.
3. CloudWatch Alarms will be created for selected metrics for various resource types supported by CoreStack. As part of post onboarding, you will see the list of metrics for each resource type for which you can define monitoring thresholds and alerts.

Billing Impact due to CoreStack Onboarding

There could be additional charges based on the configuration done for your accounts after onboarding:

Onboarding

The following steps need to be performed to onboard an AWS account.

1. Click Governance > Account Governance > Add New button in the CoreStack dashboard and select Single Account.
2. Click Start Now. The onboarding screen appears.

3. Select AWS option in the Public Cloud field.
4. Click Get Started button.

5. Select the required option in the Access Type field. The options are: Assessment and Assessment + Governance.
6. Select the Linked Account option in the Account Type field.
7. Select the required option in the AWS Environment field. The options are: AWS Standard and AWS Gov Cloud.

8. Select the required option in the Authentication Protocol field. The options are: Assume Role and Access Key.
9. In the Environment list, select an appropriate option. The options are: All, Production, Staging, QA, and Development.
10. Click Next.

11. Provide the necessary details (Amazon Resource Name ID (ARN), External ID, & MFA Enabled OR Access Key & Secret Key) explained in the Pre-onboarding section based on the option selected in the Authentication Protocol field.

📘

Note:

For MFA Enabled field, select True or False based on whether your account is restricted with Multi-Factor Authentication.

11. Click Validate button.

12. The Advanced Settings section will be displayed with additional fields (Name, Master Account, Cost Report Access, S3 Bucket URI, Preferred Regions, and Scope).
13. Modify the pre-populated name of the account in the Name field, if required.
14. Select the associated AWS management account in the Master Account drop-down list. This field will be displayed only while onboarding an AWS Member Account.
15. Select the required option in the Cost Report Access field. The options are: Master Account, Delegated Account, Current Account, and None.
    1. Master Account: This option will enable the cost reports be gathered in the associated AWS management account and utilized by CoreStack. S3 Buckets and Cost & Usage Reports must be configured in the relevant AWS management account. The S3 Bucket URI field will not be available for this selection.
    2. Delegated Account: This option will enable the cost reports be gathered in any one of your AWS Account and utilized by CoreStack. S3 Buckets and Cost & Usage Reports must be configured in the relevant AWS Account. Specify the URL of the S3 Bucket in the S3 Bucket URI field.
    3. Current Account: This option will enable the cost reports be gathered in the AWS Account that is being onboarded and utilized by CoreStack. S3 Buckets and Cost & Usage Reports must be configured in the AWS member account that is onboarded. Specify the name of the S3 Bucket in the S3 Bucket URI field.
    4. None: This option can be used if you do not want to use the cost data of your AWS member account. The S3 Bucket URI field will not be available for this selection.

📘

Note:

The S3 Buckets and Cost & Usage Reports must be configured, as explained in the Pre-onboarding section, in the relevant AWS accounts associated with this selection.

16. Specify the required S3 Bucket details, as explained above, in the S3 Bucket URI field.
17. Select the required regions in the Preferred Regions dropdown list. Multiple regions can be selected.
18. Select the required option in the Scope field. The options are: Account, Private, and Tenant.
19. Click I’m Done button.

The AWS Account will be onboarded successfully into CoreStack. Relevant insights and information about the resources available in the account will be populated under each cloud governance pillars in CoreStack.