Integrate Apono with your AWS Organization for complete cloud discovery and JIT access management to AWS resources
Apono connects with the AWS Organization to discover all accounts and their respective cloud resources and services and manage just-in-time, just-enough access to them.
This guide lets you integrate to the AWS Organization with Terraform.
Terraform
AWS Profile mgmt-account
with Admin privileges in the Organization's Management Account
AWS Profile member-account
with Admin privileges in one of the Organization's Member Accounts
Activate the CloudFormation StackSet service in your management account https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html
Go to Integrations catalog, and select AWS integration
Choose Amazon Organization, and in the "Select an Apono Connector", choose "Add new connector"
Copy the token shown in the UI
Run the following Terraform Template:.
The Terraform template does the following:
Installs Apono Connector in a Member Account of the organization
Installs CloudFormation Stack in the Management Account of the organization that: > - Creates IAM Role with policies that allow manage access in IAM Identity Center
Installs CloudFormation StackSet that creates IAM Role in all member accounts of an Organizational Unit, with policies that allow to list AWS resources
After the installation finishes, copy and save the Management Account Role ARN from the output
Go back to the Amazon Organization integration
Choose the connector from the dropdown list
Choose the resource types you want to connect, and click Next
Under name, enter a name for the integration (i.e. AWS Organization)
Under Region, select a single region of the AWS resources you want to integrate.
Under AWS SSO Region, enter the region where the IAM Identity Center is configured
Under SSO Portal, enter your SSO Start URL (i.e. https://mycompany.awsapps.com/start/#/)
In Management Account Role ARN, enter the ARN you copied in step 5
Click Connect
The initial connection should now be in progress! After a few minutes, you should see the AWS Org integration as Active on the Integrations page.
Now, start creating Access Flows for the discovered resources.