Configuring the IAM User

Configuring Assume Role Policy

To include AWS sub-account in the Route53 sync, AWS Role ARN is a mandatory parameter. The credentials and the role ARN requires AssumeRole permissions.

Complete the following steps to configure a role in AWS:

1. Complete the following steps to create an IAM case:

   • Create a policy with the following settings: 

     • Choose service: Choose STS.

     • Actions: Choose AssumeRole (Write Access).

     • Resources: Configure the following: 

       • Add ARN:

         • Choose any account.

         • Specify the Role Name. 

     • Add and Review Policy. 

     • Specify a Name. 

     • Create Policy

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Sid": "VisualEditor0",

            "Effect": "Allow",

            "Action": [

                "sts:AssumeRole"

            ],

            "Resource": [

                "arn:aws:iam::*:role/demorole"

            ]

        }

    ]

}

2. Create a user and attach the policy to the user. 

3. Create a Role (AssumeRole).

   1. Select AWS Account: This account

   2. Permissions

      1. Attach the policy as specified in the section Permissions required in AWS R53.

      2. Attach AWSOrganizationsReadOnlyAccess to discover accounts.

      3. Attach policy created in the following section.

   3. Tags: This is optional. Provide some meaningful tags.

   4. Role Name: Specify a name for the role.

   5. Click Create Role.

Configuration in AWS sub-accounts

The steps in this section are required to be configured on the Trusting/Sub-account.

Fore creating a role with proper permissions, complete the following steps:

IAM Create Role  (AssumeRole):

1. In Select type of trusted entity, configure the following:

   1. Select AWS Account: Select Another AWS account.

   2. Provide the Account ID of the Trusted/Management account.

2. Permissions: Configure the following permissions:

   1. Attach Policy: Attach the policy that has permissions required for R53 sync (R53ReadWrite access).

3. Tags: This is optional. Provide some meaningful tags.

4. Role Name: Specify the same name as provided in step 3.d.

5. Click Create Role.