Skip to main content

Add AWS credentials to workload factory

Contributors netapp-bcammett netapp-rlithman netapp-tonacki
PDFs

Add and manage AWS credentials so that workload factory has the permissions that it needs to deploy and manage cloud resources in your AWS accounts.

Overview

Workload factory will operate in basic mode unless you add AWS account credentials. You can add credentials to enable other operation modes, such as Read mode and Automate mode. Learn more about operational modes.

You can add AWS credentials to an existing workload factory account from the Credentials page. This provides workload factory with the permissions needed to manage resources and processes within your AWS cloud environment.

You can add credentials using two methods:

  • Manually: You create the IAM policy and the IAM role in your AWS account while adding credentials in workload factory.

  • Automatically: You capture a minimal amount of information about permissions and then use a CloudFormation stack to create the IAM policies and role for your credentials.

Add credentials to an account manually

You can add AWS credentials to workload factory manually to give your workload factory account the permissions needed to manage the AWS resources that you'll use to run your unique workloads. Each set of credentials that you add will include one or more IAM policies based on the workload capabilities you want to use, and an IAM role that is assigned to your account.

There are three parts to creating the credentials:

  • Select the services and permissions level that you would like to use and then create IAM policies from the AWS Management Console.

  • Create an IAM role from the AWS Management Console.

  • From workload factory, enter a name and add the credentials.

Before you begin

You'll need to have credentials to log in to your AWS account.

Steps

  1. Log in using one of the console experiences.

  2. Navigate to the Credentials page.

    1. In the workload factory console, select the Account icon, and select Credentials.

      A screenshot that shows the Account Settings icon in the workload factory console.

    2. In the BlueXP console, select the Settings icon, and select Credentials.

  3. On the Credentials page, select Add credentials and the Add credentials page is displayed.

  4. Select Add manually and then follow the steps below to fill out the three sections under Permissions configuration.

    A screenshot showing the items that you need to define manually for each set of credentials.

Step 1: Select the workload capabilities and create the IAM policies

In this section you'll choose which types of workload capabilities will be manageable as part of these credentials, and the permissions enabled for each workload. You'll need to copy the policy permissions for each selected workload from the Codebox and add them into the AWS Management Console within your AWS account to create the policies.

A screenshot showing which types of workload capabilities will be manageable as part of the policies in these credentials.

Steps

  1. From the Create policies section, enable each of the workload capabilities that you want to include in these credentials.

    You can add additional capabilities later, so just select the workloads that you currently want to deploy and manage.

  2. For those workload capabilities that offer a choice of permission levels (operate, view, and so on), select the type of permissions that will be available with these credentials.

  3. In the Codebox window, copy the permissions for the first IAM policy.

  4. Open another browser window and log in to your AWS account in the AWS Management Console.

  5. Open the IAM service, and then select Policies > Create Policy.

  6. Select JSON as the file type, paste the permissions you copied in step 3, and select Next.

  7. Enter the name for the policy and select Create Policy.

  8. If you've selected multiple workload capabilities in step 1, repeat these steps to create a policy for each set of workload permissions.

Step 2: Create the IAM role that uses the policies

In this section you'll set up an IAM role that workload factory will assume that includes the permissions and policies that you just created.

A screenshot showing which permissions will be part of the new role.

Steps

  1. In the AWS Management Console, select Roles > Create Role.

  2. Under Trusted entity type, select AWS account.

    1. Select Another AWS account and copy and paste the account ID for FSx for ONTAP workload management from the workload factory UI.

    2. Select Required external ID and copy and paste the external ID from the workload factory UI.

  3. Select Next.

  4. In the Permissions policy section, choose all the policies that you defined previously and select Next.

  5. Enter a name for the role and select Create role.

  6. Copy the Role ARN.

  7. Return to the Credentials page in workload factory, expand the Create role section, and paste the ARN in the Role ARN field.

Step 3: Enter a name and add the credentials

The final step is to enter a name for the credentials in workload factory.

Steps

  1. From the Credentials page in workload factory, expand Credentials name.

  2. Enter the name that you want to use for these credentials.

  3. Select Add to create the credentials.

Result

The credentials are created and you are returned to the Credentials page.

Add credentials to an account using CloudFormation

You can add AWS credentials to workload factory using an AWS CloudFormation stack by selecting the workload factory capabilities that you want to use, and then launching the AWS CloudFormation stack in your AWS account. CloudFormation will create the IAM policies and IAM role based on the workload capabilities you selected.

Before you begin

  • You'll need to have credentials to log in to your AWS account.

  • You'll need to have the following permissions in your AWS account when adding credentials using a CloudFormation stack:

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:UpdateStack",
                "cloudformation:DeleteStack",
                "cloudformation:DescribeStacks",
                "cloudformation:DescribeStackEvents",
                "cloudformation:DescribeChangeSet",
                "cloudformation:ExecuteChangeSet",
                "cloudformation:ListStacks",
                "cloudformation:ListStackResources",
                "cloudformation:GetTemplate",
                "cloudformation:ValidateTemplate",
                "lambda:InvokeFunction",
                "iam:PassRole",
                "iam:CreateRole",
                "iam:UpdateAssumeRolePolicy",
                "iam:AttachRolePolicy",
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": "*"
        }
    ]
}
Steps

  1. Log in using one of the console experiences.

  2. Navigate to the Credentials page.

    1. In the workload factory console, select the Account icon, and select Credentials.

      A screenshot that shows the Account Settings icon in the workload factory console.

    2. In the BlueXP console, select the Settings icon, and select Credentials.

  3. On the Credentials page, select Add credentials.

  4. Select Add via AWS CloudFormation.

    A screenshot showing the items that need to be defined before you can launch CloudFormation to create the credentials.

  5. Under Create policies, enable each of the workload capabilities that you want to include in these credentials and choose a permission level for each workload.

    You can add additional capabilities later, so just select the workloads that you currently want to deploy and manage.

  6. Under Credentials name, enter the name that you want to use for these credentials.

  7. Add the credentials from AWS CloudFormation:

    1. Select Add (or select Redirect to CloudFormation) and the Redirect to CloudFormation page is displayed.

      A screenshot showing how to create the CloudFormation stack for adding policies and a role for workload factory credentials.

    2. If you use single sign-on (SSO) with AWS, open a separate browser tab and log in to the AWS Console before you select Continue.

      You should log in to the AWS account where the FSx for ONTAP file system resides.

    3. Select Continue from the Redirect to CloudFormation page.

    4. On the Quick create stack page, under Capabilities, select I acknowledge that AWS CloudFormation might create IAM resources.

    5. Select Create stack.

    6. Return to workload factory and monitor to Credentials page to verify that the new credentials are in progress, or that they have been added.