Creating AWS Access Policy and Role for Monitored Accounts

Follow the steps to create AWS Access Policy and Role for Monitored Accounts.

1. Go to Policies in Identity and Access Management (IAM).
2. Create a new resource access policy to grant read access to the services for monitoring purposes.
   
   
   

Once the policy is created, you need to attach this policy to the role.

Follow the steps below to configure the role (NetBrainAccessRole):

1. Go to Roles in Identity and Access Management (IAM).
2. Create a new role by selecting Trusted entity type as Custom trust Policy. Add a Trust policy to allow the user from the gateway account to assume this role.
   
   
   
   
   
   The sample trust relationship JSON statements are as follows. In the policy JSON, instead of the placeholder value, you should specify the full ARN of the user created in the gateway account.
   The ExternalId value in the policy JSON can be any user-defined string. This same value must be entered in the NetBrain API Server configuration to ensure successful role assumption.
   

   Note: The role name of the EC2 instance, for example, NetbrainAccessRoleForEC2, must match the EC2 instance role name configured in the gateway account.
3. Attach the policy (created previously) to the role.