--- sidebar_label: Granting AWS access to nullplatform doc_id: c87538aa-23a8-4d3e-9e6f-394eaa142650 description: >- Guide for configuring secure AWS access for nullplatform using API keys or cross-account roles keywords: - AWS - nullplatform - cross-account roles - API credentials - authentication --- # Granting AWS access to nullplatform Nullplatform uses the AWS API to interact with AWS services and supports several methods to establish secure access to AWS. ## Required users/roles Nullplatform divides responsibilities into three distinct parts, each requiring specific users or roles: - **Application Management**: This component handles the creation of AWS components during application creation or import. The most critical creation is the `ECR repository`. - **Telemetry**: Responsible for processing logs and metrics, communicating with AWS CloudWatch. - **Scope & Deployment Manager**: Controls scope and deployment, communicating with AWS EC2, Lambda, and Elastic Load Balancing APIs. ## Access key and secret key :::warning While this method is simple, it is NOT recommended. Please try [cross-account roles](#cross-account-roles-recommended) instead. ::: The simplest way to configure nullplatform's communication with the AWS API is by creating AWS users and generating API credentials for each user. To configure this authentication mode, the required `NRN` keys are as follows: - **Application Management**: - `aws.application_workflow_access_key` - `aws.application_workflow_secret_access_key` - **Telemetry**: - `aws.log_reader_access_key` - `aws.log_reader_secret_access_key` - **Scope & Deployment Manager**: - `aws.region` - `aws.scope_workflow_access_key` - `aws.scope_workflow_secret_access_key` ## Cross-Account Roles (recommended) In this approach, instead of using keys and secrets, nullplatform employs Amazon roles. These roles allow you to grant access to specific resources in another AWS account, ensuring that only authorized services (such as nullplatform instances) can connect to AWS. Nullplatform defines unique roles for each component, which need to be trusted in your AWS account. The roles are as follows: | **Component** | **Nullplatform Role** | | -------------------------- | ------------------------------------------------------- | | Application Management | arn:aws:iam::283477532906:role/application_manager | | Telemetry | arn:aws:iam::283477532906:role/telemetry_manager | | Scope & Deployment Manager | arn:aws:iam::283477532906:role/scope_and_deploy_manager | To configure this authentication mode, the required `NRN` keys are: - **Application Management**: - `aws.application_workflow_role` - (optional) `aws.application_workflow_role_external_id` - **Telemetry**: - `aws.log_reader_role` - (optional) `aws.log_reader_role_external_id` - **Scope & Deployment Manager**: - `aws.scope_workflow_role` - (optional) `aws.scope_workflow_role_external_id` *In all cases, the role is configured in your AWS account.* ### Granting access to multiple AWS accounts using an intermediate role In scenarios involving multiple AWS accounts, an `intermediate role` can be used. Nullplatform first authenticates with the intermediate role, and then uses that role to authenticate with the required component role. ```mermaid graph LR nullaccount[nullplatform role] --> intermediaterole(assume intermediate role) --> finalrole[assume final role] ``` To configure this authentication mode, the required `NRN` keys are: - **Application Management**: - `aws.application_workflow_role` - `aws.application_workflow_intermediate_role` - (optional) `aws.application_workflow_role_external_id` - (optional) `aws.application_workflow_intermediate_role_external_id` - **Telemetry**: - `aws.log_reader_role` - `aws.log_reader_intermediate_role` - (optional) `aws.log_reader_role_external_id` - (optional) `aws.log_reader_intermediate_role_external_id` - **Scope & Deployment Manager**: - `aws.scope_workflow_role` - `aws.scope_workflow_intermediate_role` - (optional) `aws.scope_workflow_role_external_id` - (optional) `aws.scope_workflow_intermediate_role_external_id` *In all cases, the roles are configured in your AWS account.* ### Required permissions for each role/user When a new nullplatform account is set up, our team configures these permissions: - **Application management** - ECR - `ecr-public:BatchCheckLayerAvailability` - `ecr-public:PutImage` - `ecr-public:CompleteLayerUpload` - `ecr-public:UploadLayerPart` - `ecr-public:InitiateLayerUpload` - `ecr:GetDownloadUrlForLayer` - `ecr:BatchGetImage` - `ecr:CompleteLayerUpload` - `ecr:UploadLayerPart` - `ecr:InitiateLayerUpload` - `ecr:BatchCheckLayerAvailability` - `ecr:PutImage` - `ecr:CreateRepository` - `sts:GetServiceBearerToken` - `ecr:GetAuthorizationToken` - `ecr-public:GetAuthorizationToken` - **Telemetry**: - `ec2:DescribeInstances` - `cloudwatch:GetMetricData` - `cloudwatch:ListMetrics` - `logs:Describe*` - `logs:Get*` - `logs:List*` - `logs:StartQuery` - `logs:StopQuery` - `logs:TestMetricFilter` - `logs:FilterLogEvents` - **Scope & Deployment manager**: - Lambda - `lambda:CreateFunction` - `lambda:DeleteProvisionedConcurrencyConfig` - `lambda:GetFunctionConfiguration` - `lambda:ListProvisionedConcurrencyConfigs` - `lambda:GetProvisionedConcurrencyConfig` - `lambda:ListLayers` - `lambda:ListLayerVersions` - `lambda:DeleteFunction` - `lambda:GetAlias` - `lambda:ListCodeSigningConfigs` - `lambda:UpdateFunctionUrlConfig` - `lambda:CreateFunctionUrlConfig` - `lambda:UpdateFunctionEventInvokeConfig` - `lambda:DeleteFunctionCodeSigningConfig` - `lambda:InvokeFunctionUrl` - `lambda:ListFunctions` - `lambda:GetEventSourceMapping` - `apigateway:*` - `lambda:ListAliases` - `lambda:GetFunctionUrlConfig` - `lambda:GetFunctionCodeSigningConfig` - `lambda:UpdateAlias` - `lambda:UpdateFunctionCode` - `lambda:ListFunctionEventInvokeConfigs` - `lambda:PutRuntimeManagementConfig` - `lambda:ListFunctionsByCodeSigningConfig` - `lambda:GetFunctionConcurrency` - `lambda:PutProvisionedConcurrencyConfig` - `lambda:ListEventSourceMappings` - `lambda:PublishVersion` - `lambda:DeleteEventSourceMapping` - `lambda:CreateAlias` - `lambda:ListVersionsByFunction` - `lambda:GetLayerVersion` - `lambda:PublishLayerVersion` - `lambda:GetAccountSettings` - `lambda:CreateEventSourceMapping` - `lambda:GetLayerVersionPolicy` - `lambda:PutFunctionConcurrency` - `lambda:DeleteCodeSigningConfig` - `lambda:ListTags` - `lambda:AddPermission` - `lambda:TagResource` - `lambda:GetRuntimeManagementConfig` - `lambda:DeleteLayerVersion` - `lambda:PutFunctionEventInvokeConfig` - `lambda:DeleteFunctionEventInvokeConfig` - `lambda:CreateCodeSigningConfig` - `lambda:PutFunctionCodeSigningConfig` - `lambda:UpdateEventSourceMapping` - `lambda:UpdateFunctionCodeSigningConfig` - `lambda:GetFunction` - `lambda:UpdateFunctionConfiguration` - `lambda:ListFunctionUrlConfigs` - `lambda:UpdateCodeSigningConfig` - `lambda:GetFunctionEventInvokeConfig` - `lambda:DeleteAlias` - `lambda:DeleteFunctionConcurrency` - `lambda:GetCodeSigningConfig` - `lambda:DeleteFunctionUrlConfig` - `lambda:GetPolicy` - Balancer - `ec2:DescribeAccountAttributes` - `ec2:DescribeAddresses` - `ec2:DescribeInternetGateways` - `ec2:DescribeSecurityGroups` - `ec2:DescribeSubnets` - `ec2:DescribeVpcs` - `ec2:DescribeVpcClassicLink` - `ec2:DescribeInstances` - `ec2:DescribeNetworkInterfaces` - `ec2:DescribeClassicLinkInstances` - `ec2:DescribeRouteTables` - `ec2:DescribeCoipPools` - `ec2:GetCoipPoolUsage` - `ec2:DescribeVpcPeeringConnections` - `cognito-idp:DescribeUserPoolClient` - `arc-zonal-shift:*` - Autoscaling - `ec2:DescribeAccountAttributes` - `ec2:DescribeAvailabilityZones` - `ec2:DescribeImages` - `ec2:DescribeInstanceAttribute` - `ec2:DescribeInstances` - `ec2:DescribeKeyPairs` - `ec2:DescribeLaunchTemplateVersions` - `ec2:DescribePlacementGroups` - `ec2:DescribeSecurityGroups` - `ec2:DescribeSpotInstanceRequests` - `ec2:DescribeSubnets` - `ec2:DescribeVpcClassicLink` - `ec2:RunInstances` - `ec2:CreateTags` - `ec2:CreateLaunchTemplate` - `ec2:CreateLaunchTemplateVersion` - `ec2:DeleteLaunchTemplate` - `ec2:DeleteLaunchTemplateVersions` - `ec2:DeleteTags` - Route53 - `route53:CreateHostedZone` - `route53:ChangeResourceRecordSets` - `route53:ListResourceRecordSets` - `route53domains:*` - ECR - `ecr:DescribeImages` - `ecr:DescribeRegistry` - `ecr:DescribeRepositories` - `ecr:GetDownloadUrlForLayer` - `ecr:ListImages` - `ecr:GetAuthorizationToken` - `ecr:BatchGetImage` - S3 (for parameters) - `s3:PutObject` - `s3:PutObjectAcl` - `s3:PutObjectVersionAcl` - `s3:PutObject` - `s3:PutObjectAcl` - `s3:PutObjectVersionAcl` - `s3:GetObject` - Secrets (for parameters) - `secretsmanager:GetSecretValue`