Infrastructure

AWS

Setting up the AWS integration in Ploy in order to manage users and access to critical services provided by Amazon Web Services (AWS).

The intended purpose of this document is to set up an AWS integration in Ploy. This guide will require you to be able to create IAM roles for your AWS account, so before you continue make sure you have proper access to the AWS console.

We have provided a set of permissions that are a sensible start for Ploy to have, but make sure to check the implications before you apply them. Ploy does not modify the IAM role itself, so any future changes to the role or its policy will have to be made by you.

Getting started

Navigate to your organisation's integrations page and click "Setup" under the Amazon Web Services integration to get started.

This will open a multi-step integration wizard asking you for crucial details about your AWS account:

  • Your AWS Account ID (the 12-digit ID, which you can locate in the AWS console)

  • Your AWS Region (for example us-west-2; if you have multiple regions please set up multiple integrations)

  • An External ID — Ploy pre-generates a random value for you. You can change it if needed, but please note it down as this is the secret we will use when communicating with your AWS account.

  • Do you want to grant Ploy write access? — a toggle (on by default). Leave it on if you want Ploy to be able to add and remove group members on your behalf (for example from access reviews, flows or provisioning). If you only want Ploy to read your AWS account, switch it off and do not grant the optional write permissions listed below.

Setting up an IAM role

The next step of the configuration is creating a role that Ploy is going to use when interacting with your AWS account.

Click the "Open AWS Console" button in the wizard. In the AWS console make sure that the Trusted entity type selected is AWS account, and choose Another AWS account.

In the next part of the AWS wizard enter Ploy's AWS account ID: 010526237970.

Select the Require external ID option and enter the External ID from the previous step.

Selecting permissions

Ploy needs two sets of permissions on the role: a read-only baseline that every AWS integration needs for scanning, and an optional set of write permissions that Ploy only uses when it makes changes in your account.

Read-only permissions (always required)

These permissions are used to discover your Identity Center users, groups and permission sets, your IAM users, groups, roles and policies, and your S3, DynamoDB, SQS, Lambda, RDS, EC2 and ECS resources. They never change anything in your account.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListAllMyBuckets",
        "dynamodb:ListTables",
        "sqs:ListQueues",
        "lambda:ListFunctions"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:GetAccountAuthorizationDetails",
        "iam:ListRoles",
        "iam:ListUsers",
        "iam:ListPolicies",
        "iam:ListGroups"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "sso:ListInstances",
        "sso:ListAccountAssignmentsForPrincipal",
        "sso:ListPermissionSets",
        "sso:DescribePermissionSet",
        "sso:ListCustomerManagedPolicyReferencesInPermissionSet",
        "sso:ListManagedPoliciesInPermissionSet"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "identitystore:ListUsers",
        "identitystore:ListGroups",
        "identitystore:ListGroupMemberships",
        "identitystore:DescribeUser"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:ListTagsForResource",
        "ec2:DescribeInstances",
        "ec2:DescribeTags",
        "ecs:DescribeClusters",
        "ecs:ListTagsForResource",
        "ecs:ListClusters"
      ],
      "Resource": "*"
    }
  ]
}

Write permissions (only if you grant Ploy write access)

If you switched on "Do you want to grant Ploy write access?" in the wizard, also add the following statement. Ploy uses these permissions to:

  • add a user to, or remove a user from, an Identity Center group (identitystore:CreateGroupMembership, identitystore:GetGroupMembershipId, identitystore:DeleteGroupMembership)

  • add a user to, or remove a user from, a classic IAM group (iam:AddUserToGroup, iam:RemoveUserFromGroup — Ploy looks the group and user names up with the iam:ListGroups / iam:ListUsers permissions from the read-only set)

  • create a new Identity Center user when a flow or provisioning action asks Ploy to (identitystore:CreateUser)

{
  "Effect": "Allow",
  "Action": [
    "identitystore:CreateGroupMembership",
    "identitystore:GetGroupMembershipId",
    "identitystore:DeleteGroupMembership",
    "identitystore:CreateUser",
    "iam:AddUserToGroup",
    "iam:RemoveUserFromGroup"
  ],
  "Resource": "*"
}

If you do not want Ploy to make any changes in your AWS account, leave this statement out and switch the write access toggle off. Without these permissions any write Ploy attempts will be rejected by AWS with an AccessDenied error, and the write access toggle in Ploy also blocks Ploy from adding or removing group members through resource actions.

Once you are done with selecting permissions, continue to the next step and name the role however you want, for example "PloyIntegrationRole".

After the role is created, open it and copy its IAM Role ARN, e.g. arn:aws:iam::123456789012:role/PloyIntegrationRole, then paste it into the "IAM Role ARN" field in the Ploy wizard. Ploy will test the connection by listing the IAM roles in your account.

That's it

Once the initial scan is completed you will see your Identity Center users, groups and permission sets, along with the IAM users, groups, roles and policies and the S3, DynamoDB, SQS, Lambda, RDS and EC2 resources available in the region you configured the integration for.

Was this helpful?
Was this helpful?