Connect AWS

Setup steps

1
Create the EC2 instance role

Sign in to the AWS account you want to use as an administrator. In IAM, create a role for EC2 and name it exactly as the CloudPloy connect screen shows. The name looks like CloudPloyProductionEc2SsmRole-4. Paste this trust policy if you use a custom trust policy, then attach AmazonSSMManagedInstanceCore. The console creates the instance profile with the same name.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```
2

Create the CloudPloyAccess policy

In IAM, choose Policies, then Create policy, and switch to the JSON tab. Paste the document below and name the policy CloudPloyAccess. The policy lets the key manage only servers CloudPloy created. Connecting another CloudPloy team to the same AWS account? Create only the new team role, open the existing CloudPloyAccess policy, choose Edit and paste the latest version, then create a new access key for the existing cloudploy user.
Jump to the policy
3

Create the IAM user

Create a user named cloudploy without console access. Under permissions choose Attach policies directly and select CloudPloyAccess.
4

Create the access key and paste it

Open the cloudploy user, choose Security credentials, then Create access key. Choose Application running outside AWS. Copy the access key ID and the secret access key, then paste both into CloudPloy. CloudPloy connects as soon as you save.
Open CloudPloy and paste the key

Policy to paste

CloudPloyAccess permissions

Name the policy CloudPloyAccess. Anything that changes or deletes an existing resource is limited to resources tagged CreatedBy=CloudPloy, so the key cannot touch the rest of the account. When CloudPloy needs more permissions, the connect screen shows a new version: open the policy, choose Edit, paste it and save.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadInventory",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "ssm:DescribeInstanceInformation",
        "ssm:GetCommandInvocation",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadPublicImageParameters",
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters"
      ],
      "Resource": "arn:aws:ssm:*::parameter/aws/service/*"
    },
    {
      "Sid": "CreateTaggedServerResources",
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstances",
        "ec2:CreateVolume"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*",
        "arn:aws:ec2:*:*:network-interface/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CreatedBy": "CloudPloy"
        }
      }
    },
    {
      "Sid": "LaunchIntoOwnGroupsAndKeys",
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:key-pair/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/CreatedBy": "CloudPloy"
        }
      }
    },
    {
      "Sid": "LaunchIntoSubnets",
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:subnet/*"
    },
    {
      "Sid": "LaunchPublicImages",
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*::image/*",
      "Condition": {
        "Bool": {
          "ec2:Public": "true"
        }
      }
    },
    {
      "Sid": "CreateGroupsKeysAndAddresses",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup",
        "ec2:CreateKeyPair",
        "ec2:AllocateAddress"
      ],
      "Resource": "*"
    },
    {
      "Sid": "TagWhatItCreates",
      "Effect": "Allow",
      "Action": "ec2:CreateTags",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:CreateAction": [
            "RunInstances",
            "CreateSecurityGroup",
            "CreateKeyPair",
            "AllocateAddress",
            "CreateVolume"
          ]
        }
      }
    },
    {
      "Sid": "ManageOwnedResources",
      "Effect": "Allow",
      "Action": [
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances",
        "ec2:TerminateInstances",
        "ec2:ModifyInstanceAttribute",
        "ec2:AssociateAddress",
        "ec2:DisassociateAddress",
        "ec2:ReleaseAddress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:RevokeSecurityGroupIngress",
        "ec2:DeleteSecurityGroup",
        "ec2:DeleteKeyPair",
        "ec2:AttachVolume",
        "ec2:DetachVolume",
        "ec2:ModifyVolume",
        "ec2:DeleteVolume"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/CreatedBy": "CloudPloy"
        }
      }
    },
    {
      "Sid": "UseOwnedServers",
      "Effect": "Allow",
      "Action": [
        "ssm:SendCommand",
        "ec2:GetConsoleOutput"
      ],
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/CreatedBy": "CloudPloy"
        }
      }
    },
    {
      "Sid": "RunShellScriptDocument",
      "Effect": "Allow",
      "Action": "ssm:SendCommand",
      "Resource": "arn:aws:ssm:*::document/AWS-RunShellScript"
    },
    {
      "Sid": "UseTheInstanceRole",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:GetInstanceProfile",
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/CloudPloyProductionEc2SsmRole-*",
        "arn:aws:iam::*:instance-profile/CloudPloyProductionEc2SsmRole-*"
      ],
      "Condition": {
        "StringEqualsIfExists": {
          "iam:PassedToService": "ec2.amazonaws.com"
        }
      }
    }
  ]
}