> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamkap.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS BYOC

Please read through [Bring Your Own Cloud (BYOC)](/bring-your-own-cloud-byoc) to understand BYOC in more detail.

# Deployment Options

* Turnkey / default - creates a VPN and cluster for a fully managed install
* BYO-VPN - requires the customer to provide a VPN

# Overview

This document guides you through giving Streamkap access to provision software to your AWS account by creating an IAM role that trusted Streamkap IAM principal. Access is limited to the permissions defined in the following IAM policies:

<CodeGroup>
  ```json StreamkapProvisionAccess.json theme={null}
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "",
              "Effect": "Allow",
              "Resource": "*",
              "Action": [
                  "ec2:DescribeAddressesAttribute",
                  "ec2:CreateNetworkAclEntry",
                  "ecr:UntagResource",
                  "eks:ListAccessEntries",
                  "eks:CreateAccessEntry",
                  "eks:DescribeAccessEntry",
                  "eks:UpdateAccessEntry",
                  "eks:AssociateAccessPolicy",
                  "eks:DisassociateAccessPolicy",
                  "eks:CreateAddon",
                  "eks:DescribeAddon",
                  "eks:UpdateAddon",
                  "eks:DescribeAddonConfiguration",
                  "eks:DescribeAddonVersions",
                  "eks:ListAddons",
                  "eks:ListAssociatedAccessPolicies",
                  "eks:CreateCluster",
                  "eks:DescribeCluster",
                  "eks:CreateNodegroup",
                  "eks:DescribeNodegroup",
                  "eks:UpdateNodegroupVersion",
                  "eks:TagResource",
                  "eks:UntagResource",
                  "eks:ListTagsForResource",
                  "eks:DescribeUpdate",
                  "eks:UpdateNodegroupConfig",
                  "eks:CreatePodIdentityAssociation",
                  "eks:Describe*",
                  "ec2:CreateNetworkInterface",
                  "ec2:Describe*",
                  "iam:UntagPolicy",
                  "iam:UntagRole",
                  "kms:UntagResource",
                  "logs:UntagResource",
                  "logs:ListTagsForResource",
                  "ec2:AllocateAddress",
                  "ec2:AssociateRouteTable",
                  "ec2:AttachInternetGateway",
                  "ec2:AuthorizeSecurityGroupEgress",
                  "ec2:AuthorizeSecurityGroupIngress",
                  "ec2:CreateInternetGateway",
                  "ec2:CreateLaunchTemplate",
                  "ec2:CreateLaunchTemplateVersion",
                  "ec2:CreateNatGateway",
                  "ec2:CreateRoute",
                  "ec2:CreateRouteTable",
                  "ec2:CreateSecurityGroup",
                  "ec2:CreateSubnet",
                  "ec2:CreateTags",
                  "ec2:CreateVpc",
                  "ec2:DescribeAddresses",
                  "ec2:DescribeAvailabilityZones",
                  "ec2:DescribeInternetGateways",
                  "ec2:DescribeLaunchTemplateVersions",
                  "ec2:DescribeLaunchTemplates",
                  "ec2:DescribeNatGateways",
                  "ec2:DescribeNetworkAcls",
                  "ec2:DescribeRouteTables",
                  "ec2:DescribeSecurityGroupReferences",
                  "ec2:DescribeSecurityGroupRules",
                  "ec2:DescribeSecurityGroups",
                  "ec2:DescribeSubnets",
                  "ec2:DescribeTags",
                  "ec2:DescribeVpcAttribute",
                  "ec2:DescribeVpcClassicLink",
                  "ec2:DescribeVpcClassicLinkDnsSupport",
                  "ec2:DescribeVpcs",
                  "ec2:ModifyLaunchTemplate",
                  "ec2:ModifySubnetAttribute",
                  "ec2:ModifyVpcAttribute",
                  "ec2:RevokeSecurityGroupEgress",
                  "ec2:RunInstances",
                  "ec2:ModifyNetworkInterfaceAttribute",
                  "ec2:ModifyInstanceAttribute",
                  "ec2:TerminateInstances",
                  "ec2:GetConsoleOutput",
                  "ec2:DescribeInstances",
                  "ec2:AttachNetworkInterface",
                  "ec2:AssociateAddress",
                  "ecr:CreateRepository",
                  "ecr:DescribeRepositories",
                  "ecr:ListTagsForResource",
                  "ecr:TagResource",
                  "iam:AttachRolePolicy",
                  "iam:CreateOpenIDConnectProvider",
                  "iam:CreatePolicy",
                  "iam:CreatePolicyVersion",
                  "iam:CreateRole",
                  "iam:CreateServiceLinkedRole",
                  "iam:GetOpenIDConnectProvider",
                  "iam:GetPolicy",
                  "iam:GetPolicyVersion",
                  "iam:GetRole",
                  "iam:GetRolePolicy",
                  "iam:ListAttachedRolePolicies",
                  "iam:ListRolePolicies",
                  "iam:ListPolicyVersions",
                  "iam:PassRole",
                  "iam:PutRolePolicy",
                  "iam:TagOpenIDConnectProvider",
                  "iam:TagPolicy",
                  "iam:TagRole",
                  "iam:UpdateAssumeRolePolicy",
                  "iam:RemoveRoleFromInstanceProfile",
                  "iam:CreateInstanceProfile",
                  "iam:AddRoleToInstanceProfile",
                  "iam:UpdateRole",
                  "iam:DetachRolePolicy",
                  "iam:ListInstanceProfilesForRole",
                  "kms:CreateAlias",
                  "kms:CreateGrant",
                  "kms:CreateKey",
                  "kms:DescribeKey",
                  "kms:GetKeyPolicy",
                  "kms:GetKeyRotationStatus",
                  "kms:ListAliases",
                  "kms:ListResourceTags",
                  "kms:PutKeyPolicy",
                  "kms:TagResource",
                  "kms:UpdateAlias",
                  "kms:EnableKeyRotation",
                  "logs:CreateLogGroup",
                  "logs:DescribeLogGroups",
                  "logs:ListTagsLogGroup",
                  "logs:PutRetentionPolicy",
                  "logs:TagLogGroup",
                  "logs:TagResource",
                  "logs:UntagResource",
                  "acm:*",
                  "elasticloadbalancing:*",
                  "cloudformation:Describe*",
                  "cloudformation:EstimateTemplateCost",
                  "cloudformation:Get*",
                  "cloudformation:List*",
                  "cloudformation:ValidateTemplate",
                  "cloudformation:Detect*",
                  "route53:ChangeResourceRecordSets",
                  "route53:ChangeTagsForResource",
                  "route53:CreateHostedZone",
                  "route53:GetChange",
                  "route53:GetHostedZone",
                  "route53:ListResourceRecordSets",
                  "route53:ListTagsForResource",
                  "s3:GetObject",
                  "s3:ListBucket",
                  "s3:PutObject",
                  "s3:DeleteObject",
                  "s3:CreateBucket",
                  "s3:PutBucketPolicy",
                  "s3:GetBucketPolicy",
                  "s3:PutBucketTagging",
                  "s3:GetBucketTagging",
                  "s3:GetBucketAcl",
                  "s3:PutBucketAcl",
                  "s3:PutBucketOwnershipControls",
                  "s3:GetBucketOwnershipControls",
                  "s3:PutBucketVersioning",
                  "s3:GetBucketVersioning",
                  "s3:AbortMultipartUpload",
                  "s3:GetBucketLocation",
                  "s3:GetBucketCors",
                  "s3:GetBucketWebsite",
                  "s3:GetAccelerateConfiguration",
                  "s3:GetBucketLogging",
                  "s3:GetBucketObjectLockConfiguration",
                  "s3:GetBucketRequestPayment",
                  "s3:GetEncryptionConfiguration",
                  "s3:GetLifecycleConfiguration",
                  "s3:GetReplicationConfiguration",
                  "s3:PutLifecycleConfiguration",
                  "s3:PutBucketPublicAccessBlock",
                  "s3:GetBucketPublicAccessBlock",
                  "s3:PutEncryptionConfiguration",
                  "eks:ListNodegroups",
                  "eks:ListPodIdentityAssociations",
                  "ec2:ModifyVolume",
                  "sqs:CreateQueue",
                  "sqs:SetQueueAttributes",
                  "sqs:GetQueueAttributes",
                  "sqs:GetQueueUrl",
                  "sqs:TagQueue",
                  "sqs:ListQueueTags",
                  "events:PutRule",
                  "events:PutTargets",
                  "events:RemoveTargets",
                  "events:DescribeRule",
                  "events:ListTargetsByRule",
                  "events:ListTagsForResource",
                  "events:TagResource",
                  "iam:GetInstanceProfile",
                  "iam:TagInstanceProfile",
                  "iam:ListInstanceProfiles"
              ]
          }
      ]
  }
  ```

  ```json StreamkapDeprovisionAccess.json theme={null}
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "",
        "Effect": "Allow",
        "Resource": "*",
        "Action": [
          "ec2:DeleteNetworkAclEntry",
          "eks:DeleteAddon",
          "eks:DeleteCluster",
          "eks:DescribeCluster",
          "eks:DeleteNodegroup",
          "eks:DescribeNodegroup",
          "ec2:DeleteInternetGateway",
          "ec2:DeleteLaunchTemplate",
          "ec2:DeleteLaunchTemplateVersions",
          "ec2:DeleteNatGateway",
          "ec2:DeleteNetworkInterface",
          "ec2:DeleteRoute",
          "ec2:DeleteRouteTable",
          "ec2:DeleteSecurityGroup",
          "ec2:DeleteSubnet",
          "ec2:DeleteTags",
          "ec2:DeleteVpc",
          "ec2:DescribeAddresses",
          "ec2:DescribeInternetGateways",
          "ec2:DescribeLaunchTemplateVersions",
          "ec2:DescribeLaunchTemplates",
          "ec2:DescribeNatGateways",
          "ec2:DescribeNetworkAcls",
          "ec2:DescribeNetworkInterfaces",
          "ec2:DescribeRouteTables",
          "ec2:DescribeSecurityGroupRules",
          "ec2:DescribeSecurityGroups",
          "ec2:DescribeSubnets",
          "ec2:DescribeTags",
          "ec2:DescribeVpcAttribute",
          "ec2:DescribeVpcClassicLink",
          "ec2:DescribeVpcClassicLinkDnsSupport",
          "ec2:DescribeVpcs",
          "ec2:DetachInternetGateway",
          "ec2:DetachNetworkInterface",
          "ec2:DisassociateAddress",
          "ec2:DisassociateRouteTable",
          "ec2:ReleaseAddress",
          "ec2:RevokeSecurityGroupIngress",
          "ec2:ModifyNetworkInterfaceAttribute",
          "ec2:ModifyInstanceAttribute",
          "ec2:TerminateInstances",
          "ec2:GetConsoleOutput",
          "ec2:DescribeInstances",
          "ec2:AttachNetworkInterface",
          "ec2:AssociateAddress",
          "ecr:DeleteRepository",
          "ecr:DescribeRepositories",
          "ecr:ListTagsForResource",
          "iam:DeleteOpenIDConnectProvider",
          "iam:DeletePolicy",
          "iam:DeletePolicyVersion",
          "iam:DeleteRole",
          "iam:DeleteRolePolicy",
          "iam:DetachRolePolicy",
          "iam:GetOpenIDConnectProvider",
          "iam:GetPolicy",
          "iam:GetPolicyVersion",
          "iam:GetRole",
          "iam:GetRolePolicy",
          "iam:ListAttachedRolePolicies",
          "iam:ListInstanceProfilesForRole",
          "iam:ListPolicyVersions",
          "iam:ListRolePolicies",
          "kms:DeleteAlias",
          "kms:DescribeKey",
          "kms:GetKeyPolicy",
          "kms:GetKeyRotationStatus",
          "kms:ListAliases",
          "kms:ListResourceTags",
          "kms:RetireGrant",
          "kms:ScheduleKeyDeletion",
          "logs:DeleteLogGroup",
          "logs:DescribeLogGroups",
          "logs:ListTagsLogGroup",
          "route53:ChangeTagsForResource",
          "route53:DeleteHostedZone",
          "route53:GetDNSSEC",
          "route53:GetHostedZone",
          "route53:ListResourceRecordSets",
          "route53:ListTagsForResource",
          "s3:GetObject",
          "s3:ListBucket",
          "s3:DeleteBucket",
          "eks:DeletePodIdentityAssociation",
          "eks:DeleteAccessEntry",
          "iam:DeleteInstanceProfile",
          "sqs:DeleteQueue",
          "events:DeleteRule",
          "events:RemoveTargets"
        ]
      }
    ]
  }
  ```
</CodeGroup>

<Info>
  Please note that this will happen in a sub-account/subnet that is connected to your main hub.
</Info>

Here are the steps:

1. Create an IAM policy granting permission to provision an install.
2. Create an IAM policy granting permision to deprovision an install.
3. Create an IAM role that uses those policies, and grants access to the vendor via a trust policy.
4. Share the IAM role’s ARN with Streamkap.

Once the role is created and acknowledged by Streamkap team, we will handle the deployment. In the final result, you should see the BYOC deployment is added as a new [project](/projects) in your Streamkap account.

# Using AWS Console

## 1. Create the Provision Policy

* In the AWS console, navigate to the **IAM** control panel.

<Frame>
  <img src="https://mintcdn.com/streamkap/mbypW1shgSNkxGX6/images/docs/d5f7930d9ad36c01139714f49b6b64167ae7d1a2bd7ed9c47b0b79df94a938be-Screenshot_2024-07-22_at_8.26.59_AM.png?fit=max&auto=format&n=mbypW1shgSNkxGX6&q=85&s=3c03e12beb1b6d5f494a77bbe40863ce" alt="" width="3024" height="1964" data-path="images/docs/d5f7930d9ad36c01139714f49b6b64167ae7d1a2bd7ed9c47b0b79df94a938be-Screenshot_2024-07-22_at_8.26.59_AM.png" />
</Frame>

* Navigate to “**Policies**”.

<Frame>
  <img src="https://mintcdn.com/streamkap/3Pxl2KMoNOFpQbcD/images/docs/54a39c0903e40856a4c89b15ce0f0566a3e6aa88dd2de89cf0b134a3920ab99c-Screenshot_2024-07-22_at_8.28.49_AM.png?fit=max&auto=format&n=3Pxl2KMoNOFpQbcD&q=85&s=137bcaa9cbcf7637c2b9ae9829dfb27b" alt="" width="3024" height="1964" data-path="images/docs/54a39c0903e40856a4c89b15ce0f0566a3e6aa88dd2de89cf0b134a3920ab99c-Screenshot_2024-07-22_at_8.28.49_AM.png" />
</Frame>

* Click the orange “**Create Policy**” policy button

<Frame>
  <img src="https://mintcdn.com/streamkap/mbypW1shgSNkxGX6/images/docs/b65389ad2d8e7b03e41ac825e4cbb505ae63d19d62206229350b1ee2b9ceafdb-Screenshot_2024-07-22_at_8.29.16_AM.png?fit=max&auto=format&n=mbypW1shgSNkxGX6&q=85&s=0e9399a758a0141ee672a3b8a788b9f1" alt="" width="3024" height="1964" data-path="images/docs/b65389ad2d8e7b03e41ac825e4cbb505ae63d19d62206229350b1ee2b9ceafdb-Screenshot_2024-07-22_at_8.29.16_AM.png" />
</Frame>

* Look for the “Policy editor”, where “visual” will be selected. Select “JSON”.

<Frame>
  <img src="https://mintcdn.com/streamkap/3Pxl2KMoNOFpQbcD/images/docs/1eb0133c8bbcb71a1cb252eb6cd3f754bdb97d0f01e37e0125f6d07f9cce2e90-Screenshot_2024-07-22_at_8.29.43_AM.png?fit=max&auto=format&n=3Pxl2KMoNOFpQbcD&q=85&s=f502b9b3b914df1e90619c0698a26622" alt="" width="3024" height="1964" data-path="images/docs/1eb0133c8bbcb71a1cb252eb6cd3f754bdb97d0f01e37e0125f6d07f9cce2e90-Screenshot_2024-07-22_at_8.29.43_AM.png" />
</Frame>

* Replace the **entire policy contents** JSON with the contents of the `StreamkapProvisionAccess.json` mentioned above
* Below the editor, click the orange “**Next**” button.
* Name the policy `StreamkapProvisionAccess`, and click “Create policy” at the bottom.

## 2. Create the Deprovision Policy

* In the AWS console, navigate to the **IAM** control panel.

<Frame>
  <img src="https://mintcdn.com/streamkap/mbypW1shgSNkxGX6/images/docs/9fe848305694281d784d4ee877be51e5110e693349df21da3cb0fcf90e01a2f5-Screenshot_2024-07-22_at_8.17.32_AM.png?fit=max&auto=format&n=mbypW1shgSNkxGX6&q=85&s=95868a0c91f0d016d9604a7f6be57851" alt="" width="3024" height="1964" data-path="images/docs/9fe848305694281d784d4ee877be51e5110e693349df21da3cb0fcf90e01a2f5-Screenshot_2024-07-22_at_8.17.32_AM.png" />
</Frame>

Navigate to “**Policies**”.

<Frame>
  <img src="https://mintcdn.com/streamkap/mbypW1shgSNkxGX6/images/docs/97e7772753ff5939012b8e0ac74a2b5680013c2d6aaedae64c721c0fbdfe582b-Screenshot_2024-07-22_at_8.28.49_AM_1.png?fit=max&auto=format&n=mbypW1shgSNkxGX6&q=85&s=c0b349adce65cd1a8b3763d32ba56d6c" alt="" width="3024" height="1964" data-path="images/docs/97e7772753ff5939012b8e0ac74a2b5680013c2d6aaedae64c721c0fbdfe582b-Screenshot_2024-07-22_at_8.28.49_AM_1.png" />
</Frame>

Click the orange “**Create Policy**” policy button

<Frame>
  <img src="https://mintcdn.com/streamkap/3Pxl2KMoNOFpQbcD/images/docs/6407058239ba378afda70eff85e304934775e2ba63d6e58d8fe0b74a92672859-Screenshot_2024-07-22_at_8.29.16_AM_1.png?fit=max&auto=format&n=3Pxl2KMoNOFpQbcD&q=85&s=8b581df66fcbb47da33c814033a8fb0e" alt="" width="3024" height="1964" data-path="images/docs/6407058239ba378afda70eff85e304934775e2ba63d6e58d8fe0b74a92672859-Screenshot_2024-07-22_at_8.29.16_AM_1.png" />
</Frame>

Look for the “Policy editor” component group, where “visual” will be selected. Select “JSON”.

<Frame>
  <img src="https://mintcdn.com/streamkap/3Pxl2KMoNOFpQbcD/images/docs/5d674541c032a6056e6d4514b6be893f8388ae7608f389f2ef7c0ec356f7b665-Screenshot_2024-07-22_at_8.29.43_AM_1.png?fit=max&auto=format&n=3Pxl2KMoNOFpQbcD&q=85&s=c42e80907e00307dc46c0f185dc13272" alt="" width="3024" height="1964" data-path="images/docs/5d674541c032a6056e6d4514b6be893f8388ae7608f389f2ef7c0ec356f7b665-Screenshot_2024-07-22_at_8.29.43_AM_1.png" />
</Frame>

Replace the **entire policy contents** JSON with the IAM policy `StreamkapDeprovisionAccess.json`as mentioned above

* Below the editor, click the orange “**Next**” button.
* Name the policy `StreamkapDeprovisionAccess`, and click “Create policy” at the bottom.

## 3. Create the Access Role

* Return to the IAM dashboard and navigate to “**Roles**”

<Frame>
  <img src="https://mintcdn.com/streamkap/mbypW1shgSNkxGX6/images/docs/ca0cff82421fd19f8a03957becd42af24ebf6830d7e7f52b522b67189ac74cb7-Screenshot_2024-07-22_at_8.27.46_AM.png?fit=max&auto=format&n=mbypW1shgSNkxGX6&q=85&s=afbe8e250042986d446fe8bb3522c43b" alt="" width="3024" height="1964" data-path="images/docs/ca0cff82421fd19f8a03957becd42af24ebf6830d7e7f52b522b67189ac74cb7-Screenshot_2024-07-22_at_8.27.46_AM.png" />
</Frame>

* Click the orange “**Create role**” button.

<Frame>
  <img src="https://mintcdn.com/streamkap/mbypW1shgSNkxGX6/images/docs/c7653b53f78bca04401bded338e6776568659fbcb371fd16e42c93eb9885ec46-Screenshot_2024-07-22_at_8.38.09_AM.png?fit=max&auto=format&n=mbypW1shgSNkxGX6&q=85&s=73ecac110a4ec0f198734babbfbbf922" alt="" width="3024" height="1964" data-path="images/docs/c7653b53f78bca04401bded338e6776568659fbcb371fd16e42c93eb9885ec46-Screenshot_2024-07-22_at_8.38.09_AM.png" />
</Frame>

* Under “trusted entity type”, select “**Custom trust policy**”

<Frame>
  <img src="https://mintcdn.com/streamkap/3Pxl2KMoNOFpQbcD/images/docs/1aa53f6e848cd7de5a93ac7fd5b986bf006bb375ed743d1253c77aa73a8120dd-Screenshot_2024-07-22_at_8.38.52_AM.png?fit=max&auto=format&n=3Pxl2KMoNOFpQbcD&q=85&s=ef1fed46d1a2889b72c80c2a0678407f" alt="" width="3024" height="1964" data-path="images/docs/1aa53f6e848cd7de5a93ac7fd5b986bf006bb375ed743d1253c77aa73a8120dd-Screenshot_2024-07-22_at_8.38.52_AM.png" />
</Frame>

* This will reveal a JSON editor field with the heading “**Custom trust policy”**.
* Replace the **entire trust policy** contents with the following.

<CodeGroup>
  ```JSON JSON theme={null}
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::300973880807:root"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  ```
</CodeGroup>

* Click “Next” at the bottom of the page.
* Search for the `StreamkapProvisionAccess` and `StreamkapDeprovisionAccess` policies and check the boxes.

<Frame>
  <img src="https://mintcdn.com/streamkap/3Pxl2KMoNOFpQbcD/images/docs/47c7ae2fc679d76438dad32982822ff7db2f4cd6c8bc1b96a3ce80c85d1902a5-Screenshot_2024-07-22_at_9.04.36_AM.png?fit=max&auto=format&n=3Pxl2KMoNOFpQbcD&q=85&s=900aadb7b758d88b148d66a7ecbfe9bd" alt="" width="3024" height="1964" data-path="images/docs/47c7ae2fc679d76438dad32982822ff7db2f4cd6c8bc1b96a3ce80c85d1902a5-Screenshot_2024-07-22_at_9.04.36_AM.png" />
</Frame>

* Click “**Next**”
* Name the role `StreamkapInstallAccess` (or another name of your choice). The page should look like this:

<Frame>
  <img src="https://mintcdn.com/streamkap/3Pxl2KMoNOFpQbcD/images/docs/5d50b7f71b453baf6fcc530f82aabda41fad995a9fd1aba1b4799c65692c29d2-Screenshot_2024-07-22_at_9.05.25_AM.png?fit=max&auto=format&n=3Pxl2KMoNOFpQbcD&q=85&s=4f444cf441bb8e4b68289762b9c4ed3d" alt="" width="3024" height="1964" data-path="images/docs/5d50b7f71b453baf6fcc530f82aabda41fad995a9fd1aba1b4799c65692c29d2-Screenshot_2024-07-22_at_9.05.25_AM.png" />
</Frame>

* Click “**Create role**”
* On the role page, locate the **ARN** field and make note of the value. It should take the form `arn:aws:iam::{some number}:role/StreamkapInstallAccess` .

<Frame>
  <img src="https://mintcdn.com/streamkap/3Pxl2KMoNOFpQbcD/images/docs/1479816936dec51dcab87a484f0f3c9f5206651e2dea4ba2a02f3a29aeb0dc5b-Screenshot_2024-07-22_at_9.10.56_AM.png?fit=max&auto=format&n=3Pxl2KMoNOFpQbcD&q=85&s=7d282d303cf68b49fe5a38ee292c1c54" alt="" width="3024" height="1964" data-path="images/docs/1479816936dec51dcab87a484f0f3c9f5206651e2dea4ba2a02f3a29aeb0dc5b-Screenshot_2024-07-22_at_9.10.56_AM.png" />
</Frame>

* Copy the **role ARN** from earlier and sent it back to us.

# Using Cloudformation

<CodeGroup>
  ```yaml CreateStreamkapRole.yaml theme={null}
  AWSTemplateFormatVersion: "2010-09-09"
  Resources:
    StreamkapProvisionAccessPolicy:
      Type: "AWS::IAM::ManagedPolicy"
      Properties:
        ManagedPolicyName: "StreamkapProvisionAccess"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Sid: ""
              Effect: "Allow"
              Action:
                - "ec2:DescribeAddressesAttribute"
                - "ec2:CreateNetworkAclEntry"
                - "ecr:UntagResource"
                - "eks:ListAccessEntries"
                - "eks:CreateAccessEntry"
                - "eks:DescribeAccessEntry"
                - "eks:UpdateAccessEntry"
                - "eks:AssociateAccessPolicy"
                - "eks:DisassociateAccessPolicy"
                - "eks:CreateAddon"
                - "eks:DescribeAddon"
                - "eks:UpdateAddon"
                - "eks:DescribeAddonConfiguration"
                - "eks:DescribeAddonVersions"
                - "eks:ListAddons"
                - "eks:ListAssociatedAccessPolicies"
                - "eks:CreateCluster"
                - "eks:DescribeCluster"
                - "eks:CreateNodegroup"
                - "eks:DescribeNodegroup"
                - "eks:UpdateNodegroupVersion"
                - "eks:TagResource"
                - "eks:UntagResource"
                - "eks:ListTagsForResource"
                - "eks:DescribeUpdate"
                - "eks:UpdateNodegroupConfig"
                - "eks:CreatePodIdentityAssociation"
                - "eks:Describe*"
                - "ec2:CreateNetworkInterface"
                - "ec2:Describe*"
                - "iam:UntagPolicy"
                - "iam:UntagRole"
                - "kms:UntagResource"
                - "logs:UntagResource"
                - "logs:ListTagsForResource"
                - "ec2:AllocateAddress"
                - "ec2:AssociateRouteTable"
                - "ec2:AttachInternetGateway"
                - "ec2:AuthorizeSecurityGroupEgress"
                - "ec2:AuthorizeSecurityGroupIngress"
                - "ec2:CreateInternetGateway"
                - "ec2:CreateLaunchTemplate"
                - "ec2:CreateLaunchTemplateVersion"
                - "ec2:CreateNatGateway"
                - "ec2:CreateRoute"
                - "ec2:CreateRouteTable"
                - "ec2:CreateSecurityGroup"
                - "ec2:CreateSubnet"
                - "ec2:CreateTags"
                - "ec2:CreateVpc"
                - "ec2:DescribeAddresses"
                - "ec2:DescribeAvailabilityZones"
                - "ec2:DescribeInternetGateways"
                - "ec2:DescribeLaunchTemplateVersions"
                - "ec2:DescribeLaunchTemplates"
                - "ec2:DescribeNatGateways"
                - "ec2:DescribeNetworkAcls"
                - "ec2:DescribeRouteTables"
                - "ec2:DescribeSecurityGroupReferences"
                - "ec2:DescribeSecurityGroupRules"
                - "ec2:DescribeSecurityGroups"
                - "ec2:DescribeSubnets"
                - "ec2:DescribeTags"
                - "ec2:DescribeVpcAttribute"
                - "ec2:DescribeVpcClassicLink"
                - "ec2:DescribeVpcClassicLinkDnsSupport"
                - "ec2:DescribeVpcs"
                - "ec2:ModifyLaunchTemplate"
                - "ec2:ModifySubnetAttribute"
                - "ec2:ModifyVpcAttribute"
                - "ec2:RevokeSecurityGroupEgress"
                - "ec2:RunInstances"
                - "ec2:ModifyNetworkInterfaceAttribute"
                - "ec2:ModifyInstanceAttribute"
                - "ec2:TerminateInstances"
                - "ec2:GetConsoleOutput"
                - "ec2:DescribeInstances"
                - "ec2:AttachNetworkInterface"
                - "ec2:AssociateAddress"
                - "ecr:CreateRepository"
                - "ecr:DescribeRepositories"
                - "ecr:ListTagsForResource"
                - "ecr:TagResource"
                - "iam:AttachRolePolicy"
                - "iam:CreateOpenIDConnectProvider"
                - "iam:CreatePolicy"
                - "iam:CreatePolicyVersion"
                - "iam:CreateRole"
                - "iam:CreateServiceLinkedRole"
                - "iam:GetOpenIDConnectProvider"
                - "iam:GetPolicy"
                - "iam:GetPolicyVersion"
                - "iam:GetRole"
                - "iam:GetRolePolicy"
                - "iam:ListAttachedRolePolicies"
                - "iam:ListRolePolicies"
                - "iam:ListPolicyVersions"
                - "iam:PassRole"
                - "iam:PutRolePolicy"
                - "iam:TagOpenIDConnectProvider"
                - "iam:TagPolicy"
                - "iam:TagRole"
                - "iam:UpdateAssumeRolePolicy"
                - "iam:RemoveRoleFromInstanceProfile"
                - "iam:CreateInstanceProfile"
                - "iam:AddRoleToInstanceProfile"
                - "iam:UpdateRole"
                - "iam:DetachRolePolicy"
                - "iam:ListInstanceProfilesForRole"
                - "kms:CreateAlias"
                - "kms:CreateGrant"
                - "kms:CreateKey"
                - "kms:DescribeKey"
                - "kms:GetKeyPolicy"
                - "kms:GetKeyRotationStatus"
                - "kms:ListAliases"
                - "kms:ListResourceTags"
                - "kms:PutKeyPolicy"
                - "kms:TagResource"
                - "kms:UpdateAlias"
                - "kms:EnableKeyRotation"
                - "logs:CreateLogGroup"
                - "logs:DescribeLogGroups"
                - "logs:ListTagsLogGroup"
                - "logs:PutRetentionPolicy"
                - "logs:TagLogGroup"
                - "logs:TagResource"
                - "logs:UntagResource"
                - "acm:*"
                - "elasticloadbalancing:*"
                - "cloudformation:Describe*"
                - "cloudformation:EstimateTemplateCost"
                - "cloudformation:Get*"
                - "cloudformation:List*"
                - "cloudformation:ValidateTemplate"
                - "cloudformation:Detect*"
                - "route53:ChangeResourceRecordSets"
                - "route53:ChangeTagsForResource"
                - "route53:CreateHostedZone"
                - "route53:GetChange"
                - "route53:GetHostedZone"
                - "route53:ListResourceRecordSets"
                - "route53:ListTagsForResource"
                - "s3:GetObject"
                - "s3:ListBucket"
                - "s3:PutObject"
                - "s3:DeleteObject"
                - "s3:CreateBucket"
                - "s3:PutBucketPolicy"
                - "s3:GetBucketPolicy"
                - "s3:PutBucketTagging"
                - "s3:GetBucketTagging"
                - "s3:GetBucketAcl"
                - "s3:PutBucketAcl"
                - "s3:PutBucketOwnershipControls"
                - "s3:GetBucketOwnershipControls"
                - "s3:PutBucketVersioning"
                - "s3:GetBucketVersioning"
                - "s3:AbortMultipartUpload"
                - "s3:GetBucketLocation"
                - "s3:GetBucketCors"
                - "s3:GetBucketWebsite"
                - "s3:GetAccelerateConfiguration"
                - "s3:GetBucketLogging"
                - "s3:GetBucketObjectLockConfiguration"
                - "s3:GetBucketRequestPayment"
                - "s3:GetEncryptionConfiguration"
                - "s3:GetLifecycleConfiguration"
                - "s3:GetReplicationConfiguration"
                - "s3:PutLifecycleConfiguration"
                - "s3:PutBucketPublicAccessBlock"
                - "s3:GetBucketPublicAccessBlock"
                - "s3:PutEncryptionConfiguration"
                - "eks:ListNodegroups"
                - "eks:ListPodIdentityAssociations"
                - "ec2:ModifyVolume"
                - "sqs:CreateQueue"
                - "sqs:SetQueueAttributes"
                - "sqs:GetQueueAttributes"
                - "sqs:GetQueueUrl"
                - "sqs:TagQueue"
                - "sqs:ListQueueTags"
                - "events:PutRule"
                - "events:PutTargets"
                - "events:RemoveTargets"
                - "events:DescribeRule"
                - "events:ListTargetsByRule"
                - "events:ListTagsForResource"
                - "events:TagResource"
                - "iam:GetInstanceProfile"
                - "iam:TagInstanceProfile"
                - "iam:ListInstanceProfiles"
              Resource: "*"
    StreamkapDeprovisionAccessPolicy:
      Type: "AWS::IAM::ManagedPolicy"
      Properties:
        ManagedPolicyName: "StreamkapDeprovisionAccess"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Sid: ""
              Effect: "Allow"
              Action:
                - "ec2:DeleteNetworkAclEntry"
                - "eks:DeleteAddon"
                - "eks:DeleteCluster"
                - "eks:DescribeCluster"
                - "eks:DeleteNodegroup"
                - "eks:DescribeNodegroup"
                - "ec2:DeleteInternetGateway"
                - "ec2:DeleteLaunchTemplate"
                - "ec2:DeleteLaunchTemplateVersions"
                - "ec2:DeleteNatGateway"
                - "ec2:DeleteNetworkInterface"
                - "ec2:DeleteRoute"
                - "ec2:DeleteRouteTable"
                - "ec2:DeleteSecurityGroup"
                - "ec2:DeleteSubnet"
                - "ec2:DeleteTags"
                - "ec2:DeleteVpc"
                - "ec2:DescribeAddresses"
                - "ec2:DescribeInternetGateways"
                - "ec2:DescribeLaunchTemplateVersions"
                - "ec2:DescribeLaunchTemplates"
                - "ec2:DescribeNatGateways"
                - "ec2:DescribeNetworkAcls"
                - "ec2:DescribeNetworkInterfaces"
                - "ec2:DescribeRouteTables"
                - "ec2:DescribeSecurityGroupRules"
                - "ec2:DescribeSecurityGroups"
                - "ec2:DescribeSubnets"
                - "ec2:DescribeTags"
                - "ec2:DescribeVpcAttribute"
                - "ec2:DescribeVpcClassicLink"
                - "ec2:DescribeVpcClassicLinkDnsSupport"
                - "ec2:DescribeVpcs"
                - "ec2:DetachInternetGateway"
                - "ec2:DetachNetworkInterface"
                - "ec2:DisassociateAddress"
                - "ec2:DisassociateRouteTable"
                - "ec2:ReleaseAddress"
                - "ec2:RevokeSecurityGroupIngress"
                - "ec2:ModifyNetworkInterfaceAttribute"
                - "ec2:ModifyInstanceAttribute"
                - "ec2:TerminateInstances"
                - "ec2:GetConsoleOutput"
                - "ec2:DescribeInstances"
                - "ec2:AttachNetworkInterface"
                - "ec2:AssociateAddress"
                - "ecr:DeleteRepository"
                - "ecr:DescribeRepositories"
                - "ecr:ListTagsForResource"
                - "iam:DeleteOpenIDConnectProvider"
                - "iam:DeletePolicy"
                - "iam:DeletePolicyVersion"
                - "iam:DeleteRole"
                - "iam:DeleteRolePolicy"
                - "iam:DetachRolePolicy"
                - "iam:GetOpenIDConnectProvider"
                - "iam:GetPolicy"
                - "iam:GetPolicyVersion"
                - "iam:GetRole"
                - "iam:GetRolePolicy"
                - "iam:ListAttachedRolePolicies"
                - "iam:ListInstanceProfilesForRole"
                - "iam:ListPolicyVersions"
                - "iam:ListRolePolicies"
                - "kms:DeleteAlias"
                - "kms:DescribeKey"
                - "kms:GetKeyPolicy"
                - "kms:GetKeyRotationStatus"
                - "kms:ListAliases"
                - "kms:ListResourceTags"
                - "kms:RetireGrant"
                - "kms:ScheduleKeyDeletion"
                - "logs:DeleteLogGroup"
                - "logs:DescribeLogGroups"
                - "logs:ListTagsLogGroup"
                - "route53:ChangeTagsForResource"
                - "route53:DeleteHostedZone"
                - "route53:GetDNSSEC"
                - "route53:GetHostedZone"
                - "route53:ListResourceRecordSets"
                - "route53:ListTagsForResource"
                - "s3:GetObject"
                - "s3:ListBucket"
                - "s3:DeleteBucket"
                - "eks:DeletePodIdentityAssociation"
                - "eks:DeleteAccessEntry"
                - "iam:DeleteInstanceProfile"
                - "sqs:DeleteQueue"
                - "events:DeleteRule"
                - "events:RemoveTargets"
              Resource: "*"
    StreamkapInstallAccessRole:
      Type: "AWS::IAM::Role"
      Properties:
        RoleName: "StreamkapInstallAccess"
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Sid: ""
              Effect: "Allow"
              Principal:
                AWS: "arn:aws:iam::300973880807:root"
              Action: "sts:AssumeRole"
        ManagedPolicyArns:
          - !Ref StreamkapProvisionAccessPolicy
          - !Ref StreamkapDeprovisionAccessPolicy
  ```
</CodeGroup>