Add an AWS account using a cross-account role

• If your manager resides inside AWS, complete all the tasks in Add an AWS account using a manager instance role to add the AWS Primary Account.
• If your manager resides outside AWS, complete all tasks in Add an AWS account using an access key to add the AWS Primary Account.

If you added the AWS Primary Account using a manager instance account role, do the following:

1. Make sure you're logged in to the AWS Primary Account.
2. Go to the IAM service.
3. Click Roles.
4. Find the manager instance role that you created in Add an AWS account using a manager instance role. For example: Deep_Security_Manager_Instance_Role
5. Select the role in the list to reveal its details.
6. Look for the Role ARN field at the top of the page. Its value is similar to:
   arn:aws:iam::1111111111:role/Deep_Security_Manager_Instance_Role
   
7. Note the role's account ID in the ARN. It is the number (1111111111). You'll need it later to create the cross-account role.

If you added the AWS Primary Account using an access key, do the following:

1. Make sure you're logged in to the AWS Primary Account.
2. At the top-right of AWS, click Support > Support Center.
3. Note the Account Number shown at the top-right (1111111111, in this example). You'll need it later to create the cross-account role.

1. Log in to Deep Security Manager.
2. Click Computers at the top.
3. Click Add > Add AWS Account. A wizard appears.
4. Click the eye icon next to the obscured external ID to reveal it. For more on this ID, see What is the external ID?
5. Copy the external ID to a secure place. You will need it in the next step to configure AWS Account A and any other AWS accounts you want to add.
6. (Optional.) Close the wizard and the manager.

This IAM policy is the same as the policy for the AWS Primary Account, except it does not require the sts:AssumeRole permission.

1. Make sure you're logged in to AWS Account A.
2. In the Amazon Web Services Console, go to the IAM service.
3. In the left navigation pane, click Policies.

   If this is your first time on this page, you'll need to click Get Started.

4. Click Create policy.
5. Select the JSON tab.
6. Copy the following JSON code into the text box:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "cloudconnector",
               "Action": [
                   "ec2:DescribeImages",
                   "ec2:DescribeInstances",
                   "ec2:DescribeRegions",
                   "ec2:DescribeSubnets",
                   "ec2:DescribeTags",
                   "ec2:DescribeVpcs",
                   "ec2:DescribeAvailabilityZones",
                   "ec2:DescribeSecurityGroups",
                   "workspaces:DescribeWorkspaces",
                   "workspaces:DescribeWorkspaceDirectories",
                   "workspaces:DescribeWorkspaceBundles",
                   "workspaces:DescribeTags",
                   "iam:ListAccountAliases",
                   "iam:GetRole",
                   "iam:GetRolePolicy"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ]
   }

   The "iam:GetRole" and "iam:GetRolePolicy" permissions are optional, but recommended because they allow Deep Security to determine whether you have the correct policy when an update to the manager occurs that requires additional AWS permissions.

7. Click Review policy.
8. Give the policy a name and description. Example name: Deep_Security_Policy_Cross.
9. Click Create policy. Your policy is now ready to use.

1. Make sure you're logged in to AWS Account A.
2. Go to the IAM service.
3. In the left navigation pane, click Roles.
4. In the main pane, click Create role.
5. Click the Another AWS account box.
6. In the Account ID field:
   • If you are using Deep Security Manager inside AWS, enter the manager instance role ID of AWS Primary Account that you noted in a previous step. For example: 1111111111
   • If you are using Deep Security Manager outside AWS, enter the account ID of AWS Primary Account that you noted in a previous step. For example: 1111111111
     
7. Next to Options, enable Require external ID. In the External ID field, enter the external ID you retrieved from the manager earlier.
8. Click Next: Permissions.
9. Select the IAM policy that you just created (the example name was Deep_Security_Policy_Cross) and then click Next: Review.
10. On the Review page, enter a role name and description. Example role name: Deep_Security_Role_Cross.
11. On the main role page, search for the role you just created (Deep_Security_Role_Cross).
12. Click it.
13. Find the Role ARN field at the top. It looks similar to:
    arn:aws:iam::2222222222:role/Deep_Security_Role_Cross
14. Note the Role ARN value. You'll need it later.

You now have a cross-account role under AWS Account A that includes the correct policy and references the account ID or manager instance role of the AWS Primary Account.

1. Log in to Deep Security Manager.
2. Click Computers at the top.
3. Click Add > Add AWS Account.
4. Select Use Cross Account Role.
5. Enter AWS Account A's Cross Account Role ARN. You noted this earlier, when you created the cross-account role. In this example, it is arn:aws:iam::2222222222:role/Deep_Security_Role_Cross
6. If AWS Account A includes Amazon WorkSpaces, select Include Amazon WorkSpaces to include them with your Amazon EC2 instances. By enabling the check box, you ensure that your Amazon WorkSpaces appear in the correct location in the tree structure in Deep Security Manager and are billed at the correct rate.
7. Click Next.
   AWS Account A's Amazon EC2 instances and Amazon WorkSpaces are loaded.
   

You have now added AWS Account A to the manager.