Documentation

AWS Identity Center - Personal Role

Suggest Edits

❗️

Note - internal

This guide is currently unavailable.

If that does become available, please make sure you add the following info to the root page, under the different types of integration setups:

Using a persistent Personal Role for each user assuming. This is the best practice for a streamlined user experience.

How Does It Work

  • Entitle connects to the root account of your organization.
  • From the root account, Entitle retrieves and manages SSO users, groups, and permission sets.
  • From the root account, Entitle assumes the roles configured for each sub-account.
  • For each sub-account, Entitle collects and manages the resources via the role.
  • A personal role will be created for each employee requesting access through Entitle, to which they will assume through a dedicated permission set.
  • Access will be granted and removed to that personal role.

End User Experience

  • The employee will log into the desired AWS account using a dedicated Entitle permission set, called entitle-ps.
  • Upon receiving JIT access using Entitle, the employee will receive a dedicated message either through Teams/Slack, which contains 2 login options:
    • An AWS Management Console URL.
    • A CLI command to assume his/her personal role.
Slack Message Example

Slack Message Example

  • Using the AWS Management Console URL above will refer the employee to the assume-role AWS page with the details already filled, just click Switch Role and you’re all set.

Setup

AWS Setup

  1. Step 1: Get the SSO instance ARN and region, as well as the management account ID.
  2. Step 2: Create a dedicated permission set.
  3. Step 3: Create a set of policies for Entitle to manage access to your AWS accounts.
  4. Step 4: Create an IAM user with programmatic credentials and permissions which will be used by Entitle.
  5. Step 5: For each selected sub-account - create a role with the required permissions.

Step 1: Get Your SSO Instance ARN, Region, And Management Account ID

  1. Log in to your AWS account and navigate to your management account.
  2. Click IAM Identity Center on the top left.
  3. Click the Settings option on the left-side menu
  4. Under the Details section, you will find the SSO instance ARN, and the region in which the SSO resides in.
  5. Copy both values, as you will use them later on in the configuration.
  1. Copy your management account ID by copying the Account ID by clicking on your role at the top right. It will be used later on.

Step 2: Create A Dedicated Permission Set

  1. Log in to your AWS account and navigate to your management account.
  2. Click IAM Identity Center on the top left.
  3. Click the Permission sets option on the left-side menu.
  4. Click the orange Create Permission Set button.
  1. Click Custom Permission Set, and then click Next.
  1. Choose Inline Policy and paste the following JSON:
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": "sts:AssumeRole",
			"Resource": "arn:aws:iam::*:role/EntitleRole-*"
		}
	]
}
  1. The Inline policy for the permission set ensures the user logged in via the dedicated permission set can assume his Personal Role.
  1. Name it entitle-ps,.
  2. Click Save.
  3. In the Permission Sets page, locate the newly-created Entitle permission set, entitle-ps, and copy the ARN, as you will use it later on in the configuration.

Step 3: Create Policies - Root Account

In that stage, we will configure a few policies that are required in order for Entitle to manage access to your AWS accounts. Later on in Stage 3, you will create an IAM user and attach these policies to it.

  1. Click IAM on the top left.
  2. Click Policies.
  3. Click Create Policy.
  4. In this window, click on the blue JSON button on the right.
  5. Paste the JSON below to the Policy editor.
  6. Name that policy with the title of the JSON below.
  7. Click Save.
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:AttachUserPolicy",
                "iam:CreateRole",
                "iam:CreatePolicy",
                "iam:CreatePolicyVersion",
                "iam:DetachUserPolicy",
                "iam:DetachRolePolicy",
                "iam:DeleteRole",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:GetSAMLProvider",
                "iam:ListAttachedRolePolicies",
                "iam:ListEntitiesForPolicy",
                "iam:ListPolicies",
                "iam:ListPolicyTags",
                "iam:ListPolicyVersions",
                "iam:ListRolePolicies",
                "iam:ListUserPolicies",
                "iam:ListUsers",
                "identitystore:CreateGroupMembership",
                "identitystore:DeleteGroupMembership",
                "identitystore:DescribeGroup",
                "identitystore:DescribeGroupMembership",
                "identitystore:DescribeUser",
                "identitystore:GetGroupId",
                "identitystore:GetGroupMembershipId",
                "identitystore:GetUserId",
                "identitystore:IsMemberInGroups",
                "identitystore:ListGroupMemberships",
                "identitystore:ListGroupMembershipsForMember",
                "identitystore:ListGroups",
                "identitystore:ListUsers",
                "organizations:ListAccounts",
                "sso-directory:DescribeUsers",
                "sso:AttachCustomerManagedPolicyReferenceToPermissionSet",
                "sso:AttachManagedPolicyToPermissionSet",
                "sso:CreateAccountAssignment",
                "sso:CreatePermissionSet",
                "sso:DeleteAccountAssignment",
                "sso:DeletePermissionSet",
                "sso:DescribeAccountAssignmentCreationStatus",
                "sso:DescribeAccountAssignmentDeletionStatus",
                "sso:DescribePermissionSet",
                "sso:DetachCustomerManagedPolicyReferenceFromPermissionSet",
                "sso:ListAccountAssignments",
                "sso:ListCustomerManagedPolicyReferencesInPermissionSet",
                "sso:ListInstances",
                "sso:ListPermissionSets",
                "sso:ListTagsForResource",
                "sso:TagResource",
                "sso:UntagResource"
            ],
            "Resource": "*"
        }
    ]
}
  1. Repeat steps 1-7 to create the following policies:
    1. entitle-integration-base-permissions-management
    2. entitle-integration-cross-account-assume-role
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
								"iam:PutRolePolicy",
                "iam:AttachUserPolicy",
                "iam:CreateRole",
                "iam:CreatePolicy",
                "iam:CreatePolicyVersion",
                "iam:DetachUserPolicy",
                "iam:DetachRolePolicy",
                "iam:DeleteRole",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
								"iam:ListRoles",
                "iam:ListAttachedRolePolicies",
                "iam:ListEntitiesForPolicy",
                "iam:ListPolicies",
                "iam:ListPolicyTags",
                "iam:ListPolicyVersions",
                "iam:ListRolePolicies",
                "iam:ListRoleTags",
                "iam:ListUserPolicies",
                "iam:ListUsers",
                "iam:TagPolicy",
                "organizations:ListAccounts",
                "organizations:DescribeAccount",
								"iam:TagRole",
								"iam:UnTagRole",
								"iam:TagPolicy",
			    "iam:UntagPolicy"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::*:role/entitle-integration-sub-account-role"
        }
    ]
}

📘

Note

Make sure you created 3 policies in total:

  1. entitle-integration-sso-management
  2. entitle-integration-base-permissions-management
  3. entitle-integration-cross-account-assume-role
    1. If the role name was edited, please note that you will be requested to edit the configuration at Stage 5, step 19.

Step 4: Create An IAM User For Entitle - Root Account

  1. Click IAM on the top left.
  2. Click Users.
  3. Click Create User.
  1. Name the user entitle-integration-user, and click Next.
  2. Choose the Attach policies directly option.
  1. Add the policies created on the previous stage by searching and checking them.
  2. Click Next.
  3. Click Create User.
  4. Search for the newly created user, and click on it.
  5. Click Security Credentials.
  6. Scroll down, and click Create access key.
  7. Click Command Line Interface.
  8. Click Next, and then click Create.
  1. Copy the Access key and Secret access key, you will use them later on in the configuration.

Step 5: Add Sub-Account permissions

In this stage, you will create a role in each sub-account you wish to manage access using Entitle.

Repeat the steps in the stage for each sub-account.

📘

Note

Entitle supports auto-discovery of the sub-accounts, after the step was completed for all of them.

In case you want to select a specific set of sub-accounts - please copy the new role ARN and the sub-account ID for each of the sub-accounts you completed the steps below for.

Create Policies to Manage Access To Your Sub-Account

  1. Navigate to the selected sub-account.
  2. Click IAM on the top left.
  3. Click Policies.
  4. Click Create Policy.
  5. In this window, click on the blue JSON button on the right.
  1. Paste the JSON below to the Policy editor. That Base Permissions Management Policy is required to allow Entitle manage permissions to the account.
  2. Name that policy with the title of the JSON below.
  3. Click Save.
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
								"iam:PutRolePolicy",
                "iam:AttachUserPolicy",
                "iam:CreateRole",
                "iam:CreatePolicy",
                "iam:CreatePolicyVersion",
                "iam:DetachUserPolicy",
                "iam:DetachRolePolicy",
                "iam:DeleteRole",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
								"iam:ListRoles",
                "iam:ListAttachedRolePolicies",
                "iam:ListEntitiesForPolicy",
                "iam:ListPolicies",
                "iam:ListPolicyTags",
                "iam:ListPolicyVersions",
                "iam:ListRolePolicies",
                "iam:ListRoleTags",
                "iam:ListUserPolicies",
                "iam:ListUsers",
                "iam:TagPolicy",
                "organizations:ListAccounts",
                "organizations:DescribeAccount",
								"iam:TagRole",
								"iam:UnTagRole",
								"iam:TagPolicy",
			    "iam:UntagPolicy"
            ],
            "Resource": "*"
        }
    ]
}
  1. Below listed the policies which are required in order to manage access to specific resource types in AWS. Repeat steps 2-8 for each of those resource types you wish to manage access.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:ListPolicies",
                "iam:GetRole",
                "iam:GetPolicyVersion",
                "s3:GetBucketTagging",
                "ec2:DescribeInstances",
                "iam:GetPolicy",
                "ec2:DescribeTags",
                "ec2:DescribeRegions",
                "iam:ListEntitiesForPolicy",
                "iam:AttachUserPolicy",
                "s3:ListBucket",
                "iam:ListUserPolicies",
                "iam:CreatePolicy",
                "s3:ListAllMyBuckets",
                "iam:ListUsers",
                "iam:ListPolicyTags",
                "iam:DetachUserPolicy"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:ListPolicies",
                "iam:GetPolicyVersion",
                "iam:GetPolicy",
                "iam:TagRole",
                "iam:ListEntitiesForPolicy",
                "iam:AttachUserPolicy",
                "iam:ListUsers",
                "iam:ListUserPolicies",
                "iam:ListPolicyTags",
                "iam:TagPolicy",
                "iam:TagUser"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:ListPolicies",
                "iam:GetRole",
                "iam:GetPolicyVersion",
                "iam:ListRoleTags",
                "iam:GetPolicy",
                "iam:AttachUserPolicy",
                "iam:ListEntitiesForPolicy",
                "iam:ListRoles",
                "iam:ListUserPolicies",
                "iam:CreatePolicy",
                "iam:ListUsers",
                "iam:ListPolicyTags",
                "iam:DetachUserPolicy"
            ],
            "Resource": "*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:ListPolicies",
                "iam:GetPolicyVersion",
                "iam:GetPolicy",
                "iam:ListEntitiesForPolicy",
                "iam:AttachUserPolicy",
                "iam:ListUserPolicies",
                "iam:CreatePolicy",
                "iam:ListUsers",
                "iam:ListPolicyTags",
                "iam:DetachUserPolicy",
                "secretsmanager:ListSecrets",
                "secretsmanager:DescribeSecret"
            ],
            "Resource": "*"
        }
    ]
}

Create A Role to Manage Access To Your Sub-Account

  1. Click IAM on the top left.
  2. Click Roles.
  3. Click Create Role.
  4. Under Trusted entity type, select AWS account.
  5. Under An AWS Account, choose Another AWS account between the two options.
  6. Insert the Account ID of your management account you copied on Stage 1, step 6.
  1. Click Next.
  2. Assign the policies created in the sub-account to this role.
  3. Click Next.
  4. Name the role entitle-integration-sub-account-role.
  5. Click Save.

📘

Note!

The IAM role name should be identical to the role name you set in the entitle-integration-cross-account-assume-role policy in Stage 3.


Entitle Integration Setup

All that is left to do is create an integration on the Entitle application (for more information on how to create a new Entitle integration, see Here).

  1. Log into Entitle and navigate to the Integrations page.

  2. After clicking the Add Integration button, type AWS in the Application field. You can find more information about integration creation in Entitle here.

  3. Don’t forget to set the Save on field with your configuration, i.e. your own hosted agent or Entitle’s cloud.

  4. Under Connection choose SSO Personal Role.

  5. Under the root_account configuration:

    1. Paste the access key and the secret access key created in Stage 4, step 14, to the access_key_id and secret_access_key respectively.
    2. Paste the region copied on Stage 1, step 5, to the region value.

  6. Under the sub_accounts configuration:

    1. If auto-discovery of the sub-account was selected - please complete the Entitle Configuration - Sub-Account Auto Discovery configuration below.
    2. If a set of sub-accounts was selected - please complete the Entitle Configuration - Sub-Account Selection configuration below, and provide for each sub-account instance its ID and role ARN at the corresponding place.

  7. Under the options configuration:

    1. Paste the SSO instance ARN copied on Stage 1, step 5, to the sso_instance_arn value.
    2. Paste the Entitle permission set ARN copied on Stage 3, step 6, to the corresponding entitle_permission_set_arn value.
    3. If you wish to attach the policies employees are already permitted to (via other permission sets) to their Personal Role - set the "copy_permission_sets_permissions" to true. Otherwise - keep that as false.
      1. Note - A role is limited to 10 attached policies.
    4. Optional - tags - this will enable the retrieval of only resources with the listed tags.

Example Connection JSON: 

{
    "root_account": { 
        "access_key_id": "<ACCESS-KEY-ID>",
        "secret_access_key": "<SECRET-ACCESS-KEY>",
        "region": "<AWS-REGION>" 
    },
    "sub_accounts": [
        {
            "account_id": "*",
            "access_role_arn": "arn:aws:iam::*:role/entitle-integration-sub-account-role"
        }
    ],
    "options": {
        "sso_instance_arn": "<SSO-INSTANCE_ARN>",
        "entitle_permission_set_arn": "<DEDICATED-PS-ARN>",
        "copy_permission_sets_permissions": false,
        "tags": [ 
            {
                "key": "env",
                "value": "production"
            }

        ]
    }
}

{
    "root_account": { 
        "access_key_id": "<ACCESS-KEY-ID>",
        "secret_access_key": "<SECRET-ACCESS-KEY>",
        "region": "<AWS-REGION>" 
    },
    "sub_accounts": [
        {
            "account_id": "<SUB_ACCOUNT_ID>",
            "access_role_arn": "arn:aws:iam::<SUB_ACCOUNT_ACCESS_ROLE_ARN>:role/entitle-integration-sub-account-role"
        }
    ],
    "options": {
        "sso_instance_arn": "<SSO-INSTANCE_ARN>",
        "entitle_permission_set_arn": "<DEDICATED-PS-ARN>",
        "copy_permission_sets_permissions": false,
        "tags": [ 
            {
                "key": "env",
                "value": "production"
            }

        ]
    }
}
  1. Click Save, you are done!🎉

Updated about 1 month ago

What’s Next