Add AWS Account Manually

Prerequisites

Make sure the AWS account user you use to perform the tasks below is an Administrator User. For instruction on creating an Administrator User for your AWS account please refer to https://docs.aws.amazon.com/mediapackage/latest/ug/setting-up-create-iam-user.html.

Use the Administrator User to create new AWS Policy, Role, and configure the CloudTrail setting:

• Policy Types
• Step 1 - Policy Creation
• Step 2 - Role Creation
• Step 3 - Increase AWS Role Session Duration
• Step 4 - Activate Security Token Service (STS)
• Step 5 - Configure CloudTrail Setting
• Step 6 - Fill Account Info on FortiCNP

Policy Types

Before getting started to add AWS account, there are 3 types of permissions to be granted to FortiCNP to add the AWS account, consider adding the optional permissions or only the required one that best fits the need of your organization.

Basic Permissions (required) - This permission list is mandatory for adding AWS accounts to FortriCWP. This includes the permissions related to S3, CloudTrail, CloudFormation, IAM User Permissions and EC2.

AutoFix Permissions (optional) - This permission list includes the minimum write permissions of the AWS resources such as EC2, S3, IAM etc

Notification Permissions (optional) - This permission is required for FortiCNP to send notifications. This consists of SQS (Simple Queue Service) and SNS (Simple Notification Service).

Copy the permission JSON file below to create AWS policies.

Basic Permissions (Required)

AutoFix Permissions (Optional)

Notification Permission (Optional)

Step 1 - Policy Creation

Policy creation is the first step in creating IAM role. Create AWS policies using the permission JSON files above.

The Basic Permissions are required to add the AWS account to FortiCNP, other permissions are optional.

The policy name must include the UUID obtained from FortiCNP add account page.

Please use the following naming convention for each policy type. The purpose of using standard naming convention is when updating accounts later, only permissions with standard naming conventions can be removed automatically.

1. Go to your AWS console dashboard, search and click IAM.
2. Click Policies from the left navigation menu.



3. Click Create policy, go to the JSON tab.
4. Replace the existing JSON code with one of the permission JSON code above.



5. Click Next: Tags, then click Next: Review.
6. Name the policy as "forticnp_basic_permission_895146", scroll down and click Create policy.

Repeat the instruction above for each type of permission.

Please keep the policy names later for role creation.

For the purpose behind the AWS services being used to create the custom policy, please refer to Appendix A - Cloud Protection Amazon Policy Usage

Step 2 - Role Creation

Before creating an AWS Role, you will need to create an External ID from FortiCNP. The External ID is an unique 32-bit token that meets AWS security requirement to protect the AWS Role. Go back to the Add Cloud Account page on FortiCNP to generate an External ID.

The UUID also needs to be included as part of the Role name, copy the UUID for use later.

Enter your AWS account ID and click Check Duplicate. If the AWS account ID is valid, it will prompt you to generate the External ID.

Click Generate to generate the External ID. Click copy to save it later for creating AWS Role.

If you already have an AWS Role associated with FortiCNP, and only need to update the External ID. Please refer to Update AWS Role External ID

Steps to create AWS Role

1. Go to your AWS console dashboard. Click Roles from the menu on the left.
2. Click Create role.
3. In Trusted entity type, select AWS account.



4. In An AWS account, select Another AWS Account, and enter the following Account ID: 854209929931.



Note: This is the Amazon AWS account that FortiCNP uses to monitor the new role that is being created.

5. Select the box Require external ID and enter in the External ID generated earlier.

The External ID must be the one generated earlier through FortiCNP using the same AWS account. If the External ID is not generated from FortiCNP, the AWS account cannot be added to FortiCNP.

6. Make sure the box Require MFA is not selected, then click Next.
7. In Add permissions, click search bar to select Type > Customer managed to filter.



8. Select all the permission policies you created earlier, and click Next.



9. In Role details, enter a role name. Review the rest of the role details, and click Create role.
10. Go back to list of Roles, click on the new role created to enter the role summary, and copy the AWS Role ARN.

Example of AWS Role ARN: arn:aws:iam::123456123456:role/aws_role_test

Please keep the AWS Role ARN later for AWS authentication during installation.

Step 3 - Increase AWS Role Session Duration

The AWS role session duration needs to be increased to avoid session timeout, thus allowing enough time for account onboarding process.

1. In AWS Console, go to IAM.
2. Select the AWS role that was created from Step 2 - Role Creation, click Edit.



3. Click Maximum session duration drop down menu and select 12 hours.



4. Click Save changes to apply.

Step 4 - Activate Security Token Service (STS)

FortiCNP uses regional Security Token Service (STS) to reduce latency and provide smoother user experience.

Follow these steps to turn on Security Token Service (STS) on AWS console.

1. From your AWS console dashboard, go to Identity and Access Management (IAM).
2. Click Account settings from the left navigation panel, and click to expand Security Token Service (STS).



3. Based on your location, activate EU (Ireland) if you are located in European Union, otherwise, activate US West (Oregon).

Step 5 - Configure CloudTrail Setting

1. From AWS console dashboard, search and go to "CloudTrail"
2. Click on Trails in the left navigation pane, and click Create trail.



3. In General details page, enter a Trail name that includes the UUID, for example, "forticnp_trail_895146". keep the default selection to Create a new S3 bucket.



4. Uncheck the options to enable Log file SSE-LMS encryption and Log file validation.
5. Scroll down and click Next to continue to Choose log events page.
6. In Events > Event type, select Mangement events and Data events types.



7. In Manage events > API activity: keep Read and Write options selected, then click Next.
8. Review the trail settings, make sure it is configured as multi-region trail, scroll down and click Create Trail.



9. Go back to FortiCNP and click Next Step.

Step 6 - Fill Account Info on FortiCNP

Go back to FortiCNP and proceed with the rest of configurations.

1. Enter the Role ARN that was saved from Step 2 - Role Creation.



2. Enter an Account Name (optional)
3. If you would like to receive notification when the add account process is completed (recommended), click Get Email Notification drop down menu, enter an e-mail address and press Enter. Add additional email addresses as needed.



4. Click Add AWS Account to go to the next page.