This page describes how to create a IAM role and enable access for Usage Measurement and Collection. There are two alternative ways described below to create the IAM role and enable access for Paigo to query your account in order to determine usage.
Requirements
The CLI method requires you have the latest AWS CLI installed. Both ways require you have access to create and manage IAM policies within the AWS account that Paigo will interact with.
Create IAM role with AWS CLI
Prepare for the Configurations
Below are two JSON files that you need in order to enable Paigo to measurement usage. Save the below file on the file system, and name it trust-relationships.json. This JSON document defines an AWS IAM policy that allows Paigo to assume a role with access to the AWS account owned by SaaS business. Line 8 is the AWS account owned by Paigo. There is an optional field called external ID for assuming role. Change the line 12 to some other External ID for enhanced security. It is a strongly recommended practice to use External ID. However, if you want to opt out using External ID, use the JSON document of the Without External ID tab.
Save the below file in the same directory as above, and name this file permissions.json. This file defines the minimal list of permission granted to Paigo for measurement, billing and analytics functionalities.
In the above script, a role named paigo-assumed-role will created with the policy specified above.
Create IAM role with AWS Console
Alternatively, an IAM role can be created from AWS Console.
Navigate to the IAM Role Policy after logging in to AWS Console
On the next page for permissions choose the Create a Policy option and then chose the JSON tab. You should be presented with a page that looks like the following:
Paste the following JSON document into the JSON editor. This file defines the minimal list of permission granted to Paigo for measurement, billing and analytics functionalities.
4. Click Next Tags , no fields are required on this page.
5. Click through to the finalize page, and enter a name you can remember, such as paigo-policy.
6. Navigate to IAM Role Page. You should see the following layout:
To configure the External ID select the Require external ID (Best practice when a third party will assume this role) near the bottom and fill in an custom string. Take note of this for entering into Paigo later.
7. Select the AWS Account option and choose the External Account choice on the next page:
8. Enter the Paigo AWS account ID: 647662420899
9. Click Next and on the following page select the paigo-policy you just created:
10. Click Next, then give it a role name you want to call it on the following page:
11. Click Create Role to save the role just created.
12. Copy the role ARN by search for the role name in the list, and click on the Copy icon below ARN. See below screenshot for an example. The role ARN and externalID will be needed by Paigo.
