AWS Organization - System Data Connector Guide

2. Create an IAM user and assign permissions

1. From the AWS Management Console log in to the AWS Management Account with a user that has administrative privileges.

2. Navigate to the Identity and Access Management (IAM) service by searching for IAM in the search bar.
3. Select IAM Users, and then Create user.
4. For Step 1: Specify user details, provide a User name (e.g. "gathid-access") and click Next. (This user does not need access to the AWS Management Console.)
5. For Step 2: Set permissions, leave the Permissions options as the default (Add user to group) and click Next. (
6. For Step 3: Review and create, click on Create user.
7. Return to IAM Users and click on the user that has just been created.
8. On the Permissions tab, in the Permissions policies section, click on the Add permissions drop down and select Create inline policy. (If you prefer, create a customer managed policy and attach it to this user.)
9. For Step 1: Specify permissions, on the right-hand side of Policy editor, select the JSON tab. Delete the existing JSON and paste the following:
   

   {
   "Version": "2012-10-17",
   "Statement": [
   {
   "Effect": "Allow",
   "Action": [
   "organizations:DescribeOrganization",
   "organizations:ListRoots",
   "organizations:ListOrganizationalUnitsForParent",
   "organizations:ListAccountsForParent"
   ],
   "Resource": "*"
   }]}

10. Click Next.
11. For Step 2: Review and create, under Policy details enter a Policy name (e.g. gathhid-access-policy).
    Click on Create policy. This policy gets added to the user as a "Customer inline" policy. 

3. Obtain credentials from your AWS Account instance for the Gathid configuration

1. After a user has been created and the permissions have been assigned, return to the IAM Users section and click on the user that has just been created.

2. In the Summary section on the right-hand-side, click Create access key.

3. For Step 1: Access key best practices & alternatives, select Other and click Next.

4. For Step 2: Set description tag, this is optional so it can be left empty. Click Create access key.
   A confirmation message appears at the top of the screen. Do not leave this screen without downloading the credentials as they cannot be recovered.
5. Either copy the Access key and the Secret Access key or click Download.csv file.
   Keep these credentials as they will be required in the step to configure the Gathid loader.
6. Click Done.

4. Configure the Prep Script tab in the AWS Organization system loader

1. As an Administrator, log into Gathid and navigate to Admin → Systems.
2. Select the AWS Organization loader and in 1. System Information toggle the System Enabled option to On.
   Ensure the correct start time for the loader is set in the Time. This should be close to your instance's stack start time.
3. Then go to 2. Prep-Scripts (Optional) and edit the AWS Organization Prep Script.
   Under Customer Configuration, enter the Access Key and Secret obtained in the previous step.
   (If you want to enable "Identity Center data" collection, go to Step 5 below.)
4. Click on Save Parameters to save the prep-script changes.
   Click Save again to save the system loader configuration.

5. Optional: Retrieve Identity Center information

1. Log into your AWS Management Account via the AWS Management Console as a user with sufficient privileges.
2. In the IAM service, locate the user that has been setup for Gathid access (step 2 above).
3. In the Permissions tab find the policy that grants the Gathid access permission and click on it.
4. In the Policy editor, add the following permissions to the Action array:
   

   "identitystore:ListUsers",
   "identitystore:ListGroups",
   "identitystore:ListGroupMemberships",
   "sso:ListInstances",
   "sso:ListPermissionSets",
   "sso:DescribePermissionSet",
   "sso:ListAccountAssignmentsForPrincipal"

5. Click Next and then Save changes.
   NOTE: If you are experiencing difficulties saving due to syntax errors, ensure that each item in the Action has a comma after it, except for the very last one before the square bracket.
6. Because the IDC data store is region specific, we need to obtain both a region and a store ID as follows:
   
   1. Navigate to the IAM Identity Center service by searching for IAM Identity Center in the search bar.
   2. Click on Settings from the left-hand-side menu.
   3. On the Settings page, in the Details section, locate the Primary Region, (e.g., ‘us-east-1’).
      Save this information as it will be required in the step to configure the Gathid loader.
   4. Below, in the Identity Source section, locate the Identity Store ID.
      Save this information as it will be required in the step to configure the Gathid loader.
      
      
7. Return to Gathid and locate the AWS Organization system loader under the Admin, Systems menu item.
   Click on 2. Prep-Scripts (Optional) and edit the AWS Organization Prep Script.
8. Under Optional Data to Collect change the Identity Center data toggle from No to Yes.
   Enter the Identity Center Region and the Identity Center Store Id obtained in item 6 of this step.
9. Click on Save Parameters.
   Click Save again.

Next Steps: 

Add External Relationships

System Properties