Deployment Options
- Turnkey / default - creates a VPN and cluster for a fully managed install
- BYO-VPN - requires the customer to provide a VPN
Overview
This document guides you through giving Streamkap access to provision software to your AWS account by creating an IAM role that trusted Streamkap IAM principal. Access is limited to the permissions defined in the following IAM policies:Please note that this will happen in a sub-account/subnet that is connected to your main hub.
- Create an IAM policy granting permission to provision an install.
- Create an IAM policy granting permision to deprovision an install.
- Create an IAM role that uses those policies, and grants access to the vendor via a trust policy.
- Share the IAM role’s ARN with Streamkap.
Using AWS Console
1. Create the Provision Policy
- In the AWS console, navigate to the IAM control panel.
- Navigate to “Policies”.
- Click the orange “Create Policy” policy button
- Look for the “Policy editor”, where “visual” will be selected. Select “JSON”.
- Replace the entire policy contents JSON with the contents of the
StreamkapProvisionAccess.jsonmentioned above - Below the editor, click the orange “Next” button.
- Name the policy
StreamkapProvisionAccess, and click “Create policy” at the bottom.
2. Create the Deprovision Policy
- In the AWS console, navigate to the IAM control panel.
StreamkapDeprovisionAccess.jsonas mentioned above
- Below the editor, click the orange “Next” button.
- Name the policy
StreamkapDeprovisionAccess, and click “Create policy” at the bottom.
3. Create the Access Role
- Return to the IAM dashboard and navigate to “Roles”
- Click the orange “Create role” button.
- Under “trusted entity type”, select “Custom trust policy”
- This will reveal a JSON editor field with the heading “Custom trust policy”.
- Replace the entire trust policy contents with the following.
- Click “Next” at the bottom of the page.
- Search for the
StreamkapProvisionAccessandStreamkapDeprovisionAccesspolicies and check the boxes.
- Click “Next”
- Name the role
StreamkapInstallAccess(or another name of your choice). The page should look like this:
- Click “Create role”
- On the role page, locate the ARN field and make note of the value. It should take the form
arn:aws:iam::{some number}:role/StreamkapInstallAccess.
- Copy the role ARN from earlier and sent it back to us.