Create AWS Role

This is the manual version of what the Helper: AWS CloudShell setup does for you (see AWS automations for the script, the Terraform and the permissions of every service).

Step 1: Open IAM

1. Open the AWS Management Console: https://aws.amazon.com/console/, in the account you want CloudPlans to manage.
2. Go to the IAM service and click Roles in the left navigation pane.

Step 2: Create the role with the CloudPlans trust policy

1. Click Create role.
2. Under Trusted entity type, choose Custom trust policy.
3. Paste the following policy. It lets only the CloudPlans role assume yours, and only with the external ID cloudplans:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::605134468875:role/cloudplansbatch" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "cloudplans" } }
  }]
}

4. Click Next.

Step 3: Attach the permissions

1. On the Add permissions page click Create policy and choose the JSON tab.
2. Paste a policy with the actions of the services you manage with CloudPlans. These two read actions are always needed (they validate the credential and list your regions); the example adds the actions to start and stop EC2 instances:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "ec2:DescribeInstances",
      "ec2:DescribeRegions",
      "ec2:StartInstances",
      "ec2:StopInstances"
    ],
    "Resource": "*"
  }]
}

3. For other services (RDS, EKS, ECS, Auto Scaling, Elastic Beanstalk, DocumentDB, SageMaker, ElastiCache, Redshift, DynamoDB, Amazon MQ, EC2 resize...) add the actions listed for each one in AWS automations.
4. Name the policy (for example CloudPlansSchedulerPolicy), create it, go back to the role wizard, refresh the list and select it.

Step 4: Name the role and copy its ARN

1. Click Next, name the role (for example CloudPlansSchedulerRole) and click Create role.
2. Open the role and copy its ARN (arn:aws:iam::<your-account-id>:role/CloudPlansSchedulerRole).
3. Paste it in the IAM Role ARN field of the credential (Create).