Onboarding AWS Accounts to Yotascale™ Software
Prerequisites:
- User must have AWS admin rights in each account to be added to Yotascale
Description:
Steps to complete:
- Prerequisites (5 minutes - AWS Console)
- Access Rights - IAM Policy Configuration (10 minutes - AWS Console)
- Onboarding AWS Accounts in the Yotascale Software (10 minutes per account - Yotascale software & AWS Console)
- Appendix A: AWS Policies
Prerequisites
Note: You may skip this step if you already have your AWS billing data configured to go to an S3 bucket and have enabled billing tags.
Enable Billing Reports and Tags
- Sign in to the AWS Management Console and navigate to the Billing & Cost Management Dashboard.
- In the navigation pane, select Preferences.
- Enable Receive Billing Reports.
- Select Configure next to Save to S3 Bucket and type a valid Amazon S3 bucket name. This is typically a bucket dedicated to your AWS billing files, feel free to create a new one if you prefer.
- In the Report list, select the check box for Detailed billing report with resources and tags*.
- Select Save Preferences.
- Select Manage report tags.
The page displays a list of tags actively in use. Tag keys that currently appear in the report are selected, while the check boxes for excluded tag keys are cleared. - Select Activate to enable AWS-Generated Cost Allocation Tags.
- Select the tags that you want to activate for your report.
- Select Activate to enable them.
Note: For more information about creating an organization tag policy refer to the AWS Tagging Strategies documentation.
Access Rights - AWS IAM Policy Configuration
The Yotascale software supports both IAM user and role-based authentication into AWS. Role based authentication is the more secure method and is described below.
- Navigate to the AWS IAM console.
- Create an IAM Policy in each account you will be onboarding to the Yotascale software for monitoring. The Yotascale software uses READ-ONLY access for all but two use cases: Tagging and RI purchasing. These can be deactivated and core Yotascale software functionality will remain.
- Consolidated Billing Policy
Allows access to Billing files (CUR/DBR), Organization metadata, RI purchasing, Resource tagging & metadata, and CloudWatch metrics - Linked Account Policy
Allows access to RI purchasing, Resource tagging & metadata, and CloudWatch metrics
- Consolidated Billing Policy
Onboarding AWS Accounts in the Yotascale Software
Providing Yotascale Software Access with an IAM Role
This is done for every account you want to provide access to the Yotascale software.
- Log in to the Yotascale software and select Cloud Accounts from the top right menu.
- Select IAM Role Auth.
- Note the Yotascale Account ID: 819983868943
- Note the External ID. This is a random alphanumeric ID that we will associate to the AWS Role when we create it.
- Navigate to the AWS IAM Console
- Create an IAM Role in AWS
- Select Another AWS account
- Enter the Yotascale Account ID: 819983868943
- Enable the "Require external ID..." option.
- Enter the External ID generated by the Yotascale console.
- Select Next: Permissions.
- Select the previously created policy.
- Select Next: Tags.
- Assign a Role name and description.
- Confirm the configuration and select Create role.
Note: Creating a Role to Delegate Permissions to an IAM User AWS documentation.
- For additional security you can even limit the access to a specific IAM role for the Yotascale software. To achieve this select Edit trust relationship under Trust relationships tab of the IAM role details. Update the Trust Relationship policy document and replace arn:aws:iam::819983868943:rootwith arn:aws:iam::819983868943:role/Master-Role
- Return to the Yotascale software console.
- If you are adding the Consolidated Billing account, select the billing bucket where your DBR is stored. For Linked Accounts select nothing.
- Select Next.
- The Yotascale software validates the policy permissions have been granted. You should get Allowed for all permissions but it is okay to get ‘Undetermined’ against Add/Delete tags if you don't have those resources in use in AWS. Select Finish when you are done reviewing the permissions status.
- Once the account is added, it will appear in the account list as shown in the figure below. This means the account was added successfully.
Note: The Yotascale software initially pulls in as much as 6 months of historic data. This ingest can take up to 48 hours to transfer, analyze, and display your data.
Appendix A: AWS Policies for Yotascale Software Access
There are two policies listed below. One for the Consolidated BIlling Account (mandatory) and another that is to be used for any Linked Accounts you are adding. Adding Linked Accounts is highly recommended as it provides inventory and utilization data that allows the Yotascale software to find the optimal recommendations and configurations for your cloud deployment. Ensure that the following policy is attached to the IAM Role that you would like to use with the Yotascale software. Don’t forget to replace "YOUR-DBR-BILLING-BUCKET" and "YOUR-CUR-BILLING-BUCKET" with your actual DBR or CUR billing bucket’s name for the Consolidated Billing Account Policy discussed in the Prerequisites.
Consolidated Billing Account Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1454926263000",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:GetBucketLocation",
"autoscaling:Describe*",
"ec2:Describe*",
"elasticloadbalancing:Describe*",
"cloudwatch:ListMetrics",
"rds:Describe*",
"rds:ListTagsForResource",
"cloudwatch:GetMetricStatistics",
"cloudwatch:Describe*",
"redshift:Describe*",
"dynamodb:Describe*",
"dynamodb:List*",
"lambda:List*",
"cloudtrail:List*",
"cloudtrail:Describe*",
"elasticache:Describe*",
"sqs:Get*",
"sqs:List*",
"sns:Get*",
"sns:List*",
"elasticmapreduce:Describe*",
"elasticmapreduce:List*",
"kinesis:Describe*",
"kinesis:List*",
"glacier:Describe*",
"glacier:List*",
"route53:Get*",
"route53:List*",
"workspaces:Describe*"
],
"Resource": [
"*"
]
},
{
"Sid": "Stmt1454926263001",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:GetAccelerateConfiguration"
],
"Resource": [
"arn:aws:s3:::YOUR-DBR-BILLING-BUCKET/*",
"arn:aws:s3:::YOUR-DBR-BILLING-BUCKET"
]
},
{
"Sid": "Stmt1454926263005",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket",
"s3:GetAccelerateConfiguration"
],
"Resource": [
"arn:aws:s3:::YOUR-CUR-BILLING-BUCKET/*",
"arn:aws:s3:::YOUR-CUR-BILLING-BUCKET"
]
},
{
"Sid": "Stmt1454926263003",
"Effect": "Allow",
"Action": [
"organizations:List*",
"organizations:Describe*",
"ce:Get*",
"cur:Describe*"
],
"Resource": [
"*"
]
},
{
"Sid": "Stmt1454926263002",
"Effect": "Allow",
"Action": [
"ec2:*Tags*",
"autoscaling:*Tags*",
"rds:*Tags*",
"redshift:*Tags*",
"s3:*Tagging*",
"elasticache:*Tags*",
"elasticloadbalancing:*Tags*",
"cloudtrail:*Tags*",
"elasticmapreduce:*Tags*",
"glacier:*Tags*",
"kinesis:*Tags*",
"route53:*Tags*",
"workspaces:*Tags*",
"dynamodb:TagResource",
"dynamodb:UntagResource",
"lambda:TagResource",
"lambda:UntagResource"
],
"Resource": [
"*"
]
},
{
"Sid": "Stmt1454926263004",
"Effect": "Allow",
"Action": [
"ec2:PurchaseReservedInstancesOffering",
"rds:PurchaseReservedDBInstancesOffering"
],
"Resource": [
"*"
]
}
]
}
Linked Account Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1454926263000",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:GetBucketLocation",
"autoscaling:Describe*",
"ec2:Describe*",
"elasticloadbalancing:Describe*",
"cloudwatch:ListMetrics",
"cloudwatch:GetMetricStatistics",
"cloudwatch:Describe*",
"rds:Describe*",
"rds:ListTagsForResource",
"redshift:Describe*",
"dynamodb:Describe*",
"dynamodb:List*",
"lambda:List*",
"cloudtrail:List*",
"cloudtrail:Describe*",
"elasticache:Describe*",
"sqs:Get*",
"sqs:List*",
"sns:Get*",
"sns:List*",
"elasticmapreduce:Describe*",
"elasticmapreduce:List*",
"kinesis:Describe*",
"kinesis:List*",
"glacier:Describe*",
"glacier:List*",
"route53:Get*",
"route53:List*",
"workspaces:Describe*"
],
"Resource": [
"*"
]
},
{
"Sid": "Stmt1454926263002",
"Effect": "Allow",
"Action": [
"ec2:*Tags*",
"autoscaling:*Tags*",
"rds:*Tags*",
"redshift:*Tags*",
"s3:*Tagging*",
"elasticache:*Tags*",
"elasticloadbalancing:*Tags*",
"cloudtrail:*Tags*",
"elasticmapreduce:*Tags*",
"glacier:*Tags*",
"kinesis:*Tags*",
"route53:*Tags*",
"workspaces:*Tags*",
"dynamodb:TagResource",
"dynamodb:UntagResource",
"lambda:TagResource",
"lambda:UntagResource"
],
"Resource": [
"*"
]
},
{
"Sid": "Stmt1454926263004",
"Effect": "Allow",
"Action": [
"ec2:PurchaseReservedInstancesOffering",
"rds:PurchaseReservedDBInstancesOffering"
],
"Resource": [
"*"
]
}
]
}