Create IAM Role

(Recommended) Learn how to create an IAM Role in order to securely delegate Sedai uninterrupted access to your AWS resources.

Use CloudFormation to automatically create an IAM Role and attach Sedai's policies.

If you prefer to manually create an IAM Role with sufficient privileges for Sedai to access your topology, you must have access to your organization's AWS Console and permission to create a new IAM Role.

To grant Sedai access to your resources, you will create an IAM Role and link

If you plan to connect multiple EKS clusters from the same environment to Sedai, you will only need to create one IAM Role. The same ARN can be used to connect each cluster to Sedai.

Choose your preferred method of creating the IAM Role:

From Sedai

1. Go to Settings > Integrations and select Connect Cloud.

2. Select AWS as your cloud provider & select your resource types and the cloud products you'd like Sedai to manage.

3. After giving you cloud a nickname, click the button the Launch CloudFormation (Make sure you're logged in to the AWS account you wish to integrate with Sedai)

4. On the screen that will open in the CloudFormation console, leave the selections as is and click Next.

5. In the Specify stack details page, enter the stack name.

6. In the Sedai app configuration section, leave the custom external ID field empty (unless a custom external ID was provided previously).

7. In the Permission section, select which cloud products you'd like Sedai to manage (please ensure this matches the selections you previously made within Sedai when connecting your account)

8. Click Next, then scroll down and click Next again.

9. In the Review and create page, check the capabilities and click Submit

With Template URL

1. Make sure you're logged in to the AWS account you'd like to integrate with Sedai.

2. Go to the CloudFormation console

3. Click Create Stack and select With new resources (standard)

4. Under Prepare template, select Template is ready

5. Under Specify template, select Amazon S3 URL. Provide the following link then click Next:

https://sedai-onboarding-templates-prod.s3.amazonaws.com/nested/sedai-integration-main.yml

5. In the Specify stack details page, enter the stack name.

6. In the Sedai app configuration section, leave the custom external ID field empty (unless a custom external ID was provided previously).

7. In the Permission section, select which cloud products you'd like Sedai to manage (please ensure this matches the selections you previously made within Sedai when connecting your account)

8. Click Next, then scroll down and click Next again.

9. In the Review and create page, check the capabilities and click Submit.

Within AWS Console

1. Navigate to Identity and Access Management (IAM) within your AWS Console.

2. Create Sedai's IAM policy.

3. Select Role > Create Role.

4. Under Trusted entity type, select AWS account and then choose Another AWS account. Enter Sedai's unique Account ID (this will be displayed within the platform when you add a new cloud from the Integrations page and opt to manually set up IAM authentication with an IAM Role). Optionally, add the External Id, which is also displayed along with the Account Id in the previous page. Skip the additional options and select Next.

5. Select the policy created in Step 2.

6. Enter a Role name and Description, and select Create to complete setup.

7. Copy the ARN. This will be used to add your connect your resources to Sedai from the Integrations page.

Within AWS CLI

This approach requires your AWS CLI to be configured.

1. Download the Sedai IAM Policy.

2. Create IAM policy:

aws --profile AWS_PROFILE iam create-policy --policy-name SedaiAWSIntegrationIamPolicy --policy-document file://sedai-policy.json

3. Create IAM Role and attach policy:

curl -o assume-role-policy.json https://raw.githubusercontent.com/SedaiEngineering/sedai-onboarding/main/aws/sedai-assume-role-policy-document.json
aws --profile AWS_PROFILE iam create-role --role-name SedaiAWSIntegrationRole --assume-role-policy-document file://assume-role-policy.json
aws --profile AWS_PROFILE iam attach-role-policy --role-name SedaiAWSIntegrationRole --policy-arn "arn:aws:iam::737058061372:policy/SedaiAWSIntegrationIamPolicy"

4. Copy the ARN. This will be used to add your connect your resources to Sedai from the Integrations page.

Manually

If you are restricted from using CloudFormation, you can create an IAM role with S3 URLs for either the Autonomous Policies or Read-only Policies.

🔗 View Autonomous Policy URLs

🔗 View Read-only Policy URLs

---

Updating a CloudFormation Stack with Change Sets

When updating a CloudFormation stack, change sets allow you to preview planned changes before applying them, ensuring no unintended consequences. To do this, follow this proces:

1. Access the CloudFormation console within the AWS Management Console.

2. Select the desired stack from the list and select the Change Sets tab.

3. Click Create change set then name the change set.

4. On the page to specify the template, choose Use current template and click Next.

5. Update the Permission section to add or remove permissions.

6. Click Next, then scroll down and click Next again.

7. In the Review and create page, check the capabilities and click Submit.

8. Review the planned changes then click Execute change set.

9. On the Execute change set? pop up, review the planned changes and specify your preferred options (We recommend using the pre-selected options).

10. Click Execute change set to enact the changes.

After updating a CloudFormation stack, we recommend monitoring the deployment.

---

Monitoring the Deployment

When you create or update a CloudFormation stack, you can track the update's progress ensure to it's functioning properly. Within the CloudFormation console, the Events tab displays the status of each resource during the update process. Refresh this tab to ensure it shows the CREATE_COMPLETE or UPDATE_COMPLETE status. If the deployment has failed, try re-deploying it.

---

Learn more about IAM Roles:

IAM roles - AWS Identity and Access ManagementAWS Identity and Access Management