AWS Single Account (SA) Setup

CloudShare’s AWS single account setup enables you to run all of your training, demos, and POCs through a single account with your own licenses.

This article includes the following:

• Basic customer setup guide - IAM role (Preferred)
• Setup guide for AMIs/CMKs

Basic Customer Setup - IAM Role

To use AWS SA with access role create role and policy, give the permissions to the resources that you want to read/write/delete in the AWS SA flow. Contact CloudShare Support <support@cloudshare.com> for CloudShare’s AWS account ID. Then set this AWS account ID as a trusted account in the Trust relationships tab.



 

• Required Data for CloudShare: Provide CloudShare with the AWS Account ID and the IAM role name.
• Using resources from other AWS accounts: If you require using AMIs/CMKs that are hosted on other AWS accounts, you can request the additional guide covering those topics.

Setup Guide for AMIs/CMKs

To use existing functionality for AMIs and CMKs that are stored in different accounts/organizations, follow the steps below (for accounts where AMIs and CMKs are stored).

CMKs

1.  Go to Key Management Service (KMS) → Customer managed keys, and select a region.
   
   
    
2. Create a key with:
   1. Key type - Symmetric.
   2. Key usage - Encrypt and decrypt.

3. Enter the AWS_SA_KMS alias name, and create a key.
   
   
4. Skip the Define key administrative permissions and Define key usage permissions steps, and finish the key creation.

Policies

1. Go to IAM → Policies.
2. Create a policy with JSON, skip the tags step, and name it ModifyImage.

{

   "Version": "2012-10-17",

   "Statement": [

       {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ec2:ModifyImageAttribute",
            "Resource": "*",
            "Condition": {}
        }
    ]
}

.

3. Create a ModifyImageCMK policy with the JSON (edit the JSON resource with your values "arn:aws:kms:{your-region}:{account-id}:key/{cmk-key-id}").

{

    "Version": "2012-10-17",

    "Statement": [

    {

      "Sid": "VisualEditor0",

      "Effect": "Allow",

      "Action": [

         "kms:Encrypt",

         "kms:Decrypt",

         "kms:ReEncrypt*",

     "kms:GenerateDataKey*",

         "kms:DescribeKey",

         "kms:PutKeyPolicy",

         "kms:GetKeyPolicy"

      ],

      "Resource":

        "arn:aws:kms:us-east-1:123456789012:key/aaaabbbb-0000-1111-2222-bbbbccccdddd"

    }

 ]

}

Roles

1.  Go to IAM → Roles.



 

2. Create a role with: Trusted entity type - AWS Account; and An AWS account – the account you will use.

3. Select Require external ID and enter a valid external ID value.



 

4.  Attach ModifyImage and ModifyImageCMK to the role.



 

5.  Enter the ModifyImage role name and create a role.



 

6. If you want to add more trusted accounts, open the ModifyImage role → Trust relationships → Edit trust policy. Then add your accounts into the AWS section.

AMI

1.  Create your AMI. For example, EC2 → Instances, and then create an instance.



 

2. Enter the instance name and select the appropriate image.



 

3.  In the Key pair section, select Proceed without a key pair and launch the instance.



 

4. Wait for the instance to start.



 

5. Open an instance, create the AMI, and wait for the creation process to finish.