CloudThrottle Detail Integrating Instruction

CloudThrottle Integration Insstep-by-step approach for tenants to configure their AWS infrastructure to integrate with the CloudThrottle SaaS platformtruction for AWS Tenant Setup:

This guide provides a complete, step-by-step approach for tenants to configure their AWS infrastructure to integrate with the CloudThrottle SaaS platform for comprehensive resource management, budget control, and monitoring.

Definitions and Prerequisites

1. Tenant Root/Master Account: The main AWS account in the tenant's infrastructure, primarily used for organizational management and budget control.
2. Tenant Management Account (CT7_Mng): A dedicated management account that acts as a "jump" account, securely linking CloudThrottle with the tenant’s AWS environment.
3. CloudThrottle SaaS Account: The CloudThrottle account that facilitates communication with and management of tenant resources.
4. Child Accounts: Sub-accounts within the AWS Organization (e.g., Dev, Prod, Test) that CloudThrottle will manage.
5. Note: CT7 is the alias for CloudThrottle used in account, role, and permission prefixes. For security, the following are placeholders; please contact CloudThrottle Support for the actual account IDs.
6. Assumptions: For security purposes, the following account IDs are provided as placeholders; please contact CloudThrottle support for the exact CloudThrottle SaaS Account ID.
   • Tenant Root/Master Account ID: 555555555
   • Tenant Management Account (CT7_Mng): 222222222
   • CloudThrottle SaaS Account: 777777777

1. Set Up Organizational Structure

1. If you have an existing AWS Organization: Ensure it includes all relevant accounts that CloudThrottle will manage.
2. Optional: Create identifiable organizational units (OUs) within AWS Organization to represent various environments, such as:
   • Dev – Development environment
   • Prod – Production environment
   • Test – Testing environment
3. Naming Conventions: Standardize OU names to maintain a clear and manageable structure.

2. Configure Roles and Permissions for CloudThrottle Access

2.1 Create the Tenant Management Account (CT7_Mng)

1. Log in to the Master Account and create a new account (if not already existing) designated as the Tenant Management Account (CT7_Mng).
2. Move this account under the appropriate OU, such as CT7_Org (or another chosen OU based on your organizational structure).

2.2 Create the ct7-cross-account-role in the Tenant Management Account

This role will enable CloudThrottle to assume control of resources within the tenant’s AWS infrastructure securely.

Steps:

1. In the Tenant Management Account (CT7_Mng), create a role named ct7-cross-account-role.
2. Set up the Trust Policy for the role to allow only the CloudThrottle SaaS Account (777777777) to assume this role:
3. No specific permissions need to be attached, as this role is intended solely as a trust-based gateway.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::777777777:role/CloudThrottleRole" },
      "Action": "sts:AssumeRole"
    }
  ]
}
    

‍

3. Create and Deploy StackSet for CT7MemberExecutionRole in Child Accounts

This StackSet will automatically create and manage the CT7MemberExecutionRole in each child account as they are added under the specified organizational unit (CT7_Org). The role will allow CloudThrottle to manage resources in each account.

3.1 Steps for StackSet Creation

1. Log into the AWS Management Console as the Master Account.
2. Navigate to CloudFormation:
   • Go to Services > CloudFormation.
3. Create a New StackSet:
   • Click on StackSets in the left-hand menu.
   • Choose Create StackSet.
4. Specify StackSet Details:
   • StackSet Name: Enter a descriptive name, like CT7MemberExecutionRoleStackSet.
   • Template Source: Select Upload a template file.
     • Upload the "ct7-stackset- v1.00.yml" file (download link provided below), which includes the configurations for CT7MemberExecutionRole.
5. Configure StackSet Parameters:
   • Management Account ID: Enter the Tenant Management Account ID (222222222) in the ManagementPrincipal parameter.
   • Leave other parameters as default unless specified otherwise by CloudThrottle.
6. Execution Options:
   • Under Administration Role, use the default settings if creating this StackSet in the Master Account.
   • Ensure Self-managed permissions is selected.
7. Set Deployment Options:
   • Deployment Targets: Choose Organizational units (OUs) and specify CT7_Org as the target OU.
   • Regions: Select the AWS regions where the role should be created (typically where your resources are hosted).
   • Deployment Options: Choose Deploy stacks in parallel.
8. Permissions:
   • Verify that the Master Account has the necessary permissions to create the StackSet and deploy resources across target accounts.
9. Review and Acknowledge:
   • Review all configurations, confirm deployment targets and parameters.
   • Check the box to Acknowledge that AWS CloudFormation might create IAM resources.
10. Create StackSet:
    • Click Submit to create the StackSet.
    • CloudFormation will now deploy the CT7MemberExecutionRole across all child accounts in the specified OU (CT7_Org).

‍

Sample StackSet Template for CT7MemberExecutionRole

Resources:
  CT7MemberExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "CT7MemberExecutionRole"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              AWS: "arn:aws:iam::222222222:role/ct7-cross-account-role"
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: "CT7MemberPolicy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "ec2:DescribeInstances"
                  - "rds:DescribeDBInstances"
                  - "ecs:DescribeClusters"
                Resource: "*"
    

Note: Customize actions based on the resources CloudThrottle needs to manage within each child account.

4. Create CT7OrganizationsRole in the Master Account

This role enables CloudThrottle to interact with AWS Organizations for account and budget management.

Steps:

1. In the Master Account, create a role named CT7OrganizationsRole.
2. Attach the below Trust Policy:
3. Permissions Policy for CT7OrganizationsRole:
   • Actions: organizations:ListAccounts, organizations:CreateAccount, organizations:MoveAccount, etc.
   • Resource Scope: Only organizational resources within the tenant's AWS environment.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::222222222:role/ct7-cross-account-role" },
      "Action": "sts:AssumeRole"
    }
  ]
}
    

‍5. Verification and Testing

1. Verify StackSet Deployment:
   • Monitor the StackSet status in CloudFormation to ensure it’s successfully deployed across all targeted child accounts.
2. Check Role in Child Accounts:
   • Verify that the CT7MemberExecutionRole is created in each child account with correct permissions.
3. Testing Access:
   • Confirm that the Tenant Management Account (CT7_Mng) can assume the CT7MemberExecutionRole in each child account and perform necessary actions, such as listing EC2 instances.

‍Permissions Summary Table