Add an AWS account using a cross-account role

Workload Security Account ID: 147995105371
You will need this ID later, when creating the cross-account role.

1. In the Workload Security console, click Administration at the top.
2. Click System Settings on the left.
3. Click the Advanced tab in the main pane.
4. Scroll to the bottom and look for the Manager AWS Identity section.
5. Make sure Use Manager Instance Role is selected.
6. Click Save.

1. Log in to Workload Security.
2. Click Computers at the top.
3. Click Add > Add AWS Account. A wizard appears.
4. Click Advanced, then click Next.
5. Click the eye icon next to the obscured external ID to reveal it. For more on this ID, see What is the external ID?
6. Copy the external ID to a secure place. You will need it in the next step to configure AWS Account A and any other AWS accounts you want to add.
7. Optionally, close the wizard and the Workload Security console.

1. Make sure you're logged in to AWS Account A.
2. In the Amazon Web Services Console, go to the IAM service.
3. In the left navigation pane, click Policies.
   

   If this is your first time on this page, you'll need to click Get Started.

4. Click Create policy.
5. Select the JSON tab.
6. Copy the following JSON code into the text box:
   

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "cloudconnector",
               "Action": [
                   "ec2:DescribeImages",
                   "ec2:DescribeInstances",
                   "ec2:DescribeRegions",
                   "ec2:DescribeSubnets",
                   "ec2:DescribeTags",
                   "ec2:DescribeVpcs",
                   "ec2:DescribeAvailabilityZones",
                   "ec2:DescribeSecurityGroups",
                   "workspaces:DescribeWorkspaces",
                   "workspaces:DescribeWorkspaceDirectories",
                   "workspaces:DescribeWorkspaceBundles",
                   "workspaces:DescribeTags",
                   "iam:ListAccountAliases",
                   "iam:GetRole",
                   "iam:GetRolePolicy"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ]
   }

   The "iam:GetRole" and "iam:GetRolePolicy" permissions are optional, but recommended because they allow Workload Security to determine whether you have the correct policy when an update to Workload Security occurs that requires additional AWS permissions.

7. Click Review policy.
8. Give the policy a name and description. Example name: Workload_Security_Policy_Cross.
9. Click Create policy. Your policy is now ready to use.

1. Make sure you are logged in to AWS Account A.
2. Go to the IAM service.
3. In the left navigation pane, click Roles.
4. In the main pane, click Create role.
5. Click Another AWS account.
6. In the Account ID field, enter the Workload Security account ID. It is: 147995105371
7. Next to Options, enable Require external ID. In the External ID field, enter the external ID you retrieved from the Workload Security console earlier.
8. Click Next: Permissions.
9. Select the IAM policy that you just created (the example name was Workload_Security_Policy_Cross) and then click Next: Review.
10. On the Review page, enter a role name and description. Example role name: Workload_Security_Role_Cross.
11. On the main role page, search for the role you just created (Workload_Security_Role_Cross).
12. Click it.
13. Find the Role ARN field at the top. It looks similar to:
    arn:aws:iam::2222222222:role/Workload_Security_Role_Cross
14. Note the Role ARN value. You will need it later.
    You now have a cross-account role under AWS Account A that includes the correct policy and references the of the AWS Primary Account.

1. Log in to Workload Security.
2. Click Computers at the top.
3. Click Add > Add AWS Account.
4. Select Advanced and click Next.
5. Select Use Cross Account Role.
6. Enter AWS Account A's Cross Account Role ARN. You noted this earlier, when you created the cross-account role. In this example, it is arn:aws:iam::2222222222:role/Workload_Security_Role_Cross
7. If AWS Account A includes Amazon WorkSpaces, select Include Amazon WorkSpaces to include them with your Amazon EC2 instances. By enabling the check box, you ensure that your Amazon WorkSpaces appear in the correct location in the tree structure in the Workload Security console and are billed at the correct rate.
8. Click Next.
   AWS Account A's Amazon EC2 instances and Amazon WorkSpaces are loaded.

You have now added AWS Account A to Workload Security.