# Create a AWS STS Role

> This tutorial walks through setting up a AWS STS (Secure Token Service) role for discovering resources via cloudwatch

Source: https://last9.io/docs/how-to-create-aws-sts-role/

## Creating trusted role without external id

1. Visit [AWS Console/Roles](https://console.aws.amazon.com/iam/home#/roles)
2. Click [Create Role](https://console.aws.amazon.com/iam/home#/roles$new?step=type)
   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.22.54_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.22.54_PM.png)
3. Select **[Another AWS Account](https://console.aws.amazon.com/iam/home#/roles$new?step=type&roleType=crossAccount)**
   tab
   - **Account ID**: `652845092827`
   - **Next Permissions**
     ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.24.53_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.24.53_PM.png)
4. Attach policies

   :::tip
   Last9 requires Cloudwatch Read Only Access to fetch metrics for components that are being used. Last9 also requests
   Security Audit Access as it enables us to identify components by name and tags.

   The AWS-managed SecurityAudit policy grants read-only access to logs, events and configuration detail for current and
   future AWS services. This policy allows Last9 to perform list and describe api calls to AWS to fetch component
   details such as name, ARNs and tags etc. And as Last9 provides auto detection of infrastructure components, this
   policy helps to minimize the access request burden on customers as they introduce new services to their
   infrastructure and as Last9 introduces new services to our platform.
   :::

   a. **SecurityAudit** Policy

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.33.46_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.33.46_PM.png)

   b. **CloudWatchReadOnlyAccess** Policy

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_2.42.11_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_2.42.11_PM.png)

   c. Proceed to Next Steps

5. Add tags if needed

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.37.36_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.37.36_PM.png)

6. Review

   1. **Role name:** `${business_name}_last9_role`
   2. **Role description**: Security Audit Access to Last9
   3. **Verify Last9 AWS Account Number**
   4. **Verify Granted Policy**
   5. **Create Role**

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.44.40_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.44.40_PM.png)

7. After the role is created, Go to Role → Trust Relationships → Edit Trust Relationship

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/2021-06-08_22-08.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/2021-06-08_22-08.png)

8. Update the JSON to the following and click "**Update Trust Policy**"

   ```json
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::652845092827:root"
         },
         "Action": "sts:AssumeRole",
         "Condition": {}
       }
     ]
   }
   ```

9. Edit the role and update "**Maximum session duration**" to 3 hours if your security policy permits it. Else leave it
   as 1 hour.

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/2021-02-25_14-14.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/2021-02-25_14-14.png)

10. Share the created role ARN with your Last9 point of contact

---

## Creating trusted role with external id

1. Visit [AWS Console/Roles](https://console.aws.amazon.com/iam/home#/roles)
2. Click [Create Role](https://console.aws.amazon.com/iam/home#/roles$new?step=type)

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.22.54_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.22.54_PM.png)

3. Select "**[Another AWS Account](https://console.aws.amazon.com/iam/home#/roles$new?step=type&roleType=crossAccount)**" tab with external ID as a random string. It has to be something other than "somerandomstring" and share it with Last9

   - **Account ID**: `652845092827`

   ![2021-09-08_17-24.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/2021-09-08_17-24.png)

4. Attach policies

   :::tip
   Last9 requires Cloudwatch Read Only Access to fetch metrics for components that are being used. Last9 also requests
   Security Audit Access as it enables us to identify components by name and tags.

   The AWS-managed SecurityAudit policy grants read-only access to logs, events and configuration detail for current and
   future AWS services. This policy allows Last9 to perform list and describe api calls to AWS to fetch component
   details such as name, ARNs and tags etc. And as Last9 provides auto detection of infrastructure components, this
   policy helps to minimize the access request burden on customers as they introduce new services to their
   infrastructure and as Last9 introduces new services to our platform.
   :::

   a. **SecurityAudit** Policy

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.33.46_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.33.46_PM.png)

   b. **CloudWatchReadOnlyAccess** Policy

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_2.42.11_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_2.42.11_PM.png)

   c. Proceed to Next Steps

5. Add tags if needed

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.37.36_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.37.36_PM.png)

6. Review

   1. **Role name:** `${business_name}_last9_role`
   2. **Role description**: Security Audit Access to Last9
   3. **Verify Last9 AWS Account Number**
   4. **Verify Granted Policy**
   5. **Create Role**

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.44.40_PM.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/Screenshot_2021-02-25_at_1.44.40_PM.png)

7. After the role is created, Go to Role → Trust Relationships → Edit Trust Relationship

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/2021-06-08_22-08.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/2021-06-08_22-08.png)

8. Update the JSON to the following and click "**Update Trust Policy**". Ensure that the value for `sts:ExternalId` matches the value set earlier for External-ID

   ```json
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::652845092827:root"
         },
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": {
             "sts:ExternalId": "somerandomstring"
           }
         }
       }
     ]
   }
   ```

9. Edit the role and update "**Maximum session duration**" to 3 hours if your security policy permits it. Else leave it as 1 hour

   ![../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/2021-02-25_14-14.png](../../../../assets/content/docs/tutorials/how-to-create-aws-sts-role/2021-02-25_14-14.png)

10. Share the created role ARN and external ID string with your Last9 point of contact