Creating IAM Roles

📘
Prerequisites

Permission to create IAM roles and policies in AWS

The desired AWS permission policy (in JSON format)

To allow Monte Carlo to securely access AWS resources on your account, you will create one or more IAM roles. These IAM roles will:

Allow narrow access to the precise resources and API calls you wish to grant to Monte Carlo.
Allow Monte Carlo's data collector to assume them while making API calls to access your resources.

You may create IAM roles for Monte Carlo by either using the CLI, or by manually going through the wizards in the AWS console.

Generating a CloudFormation template using the MC CLI (Recommended)

You can use the CLI to generate a CloudFormation template with one or more IAM policies to create an IAM role.

To generate and deploy a template follow these steps -

1. Follow this guide to install and configure the CLI (requires >= `0.17.0`).

2. Run the `cf-role-gen` command. For reference, see help below:

$ montecarlo discovery cf-role-gen --help
Usage: montecarlo discovery cf-role-gen [OPTIONS]

  Generate a CloudFormation template to create a resource access IAM role.
  After review, this template can be deployed using CloudFormation. The Role
  ARN and External ID for onboarding can be found in the stack outputs.

Options:
  --policy-file FILENAME  File containing an IAM policy to generate an IAM
                          role from. This option can be passed multiple times
                          for more than one policy.  [required]

  --collector-id UUID     ID for the data collector. To disambiguate accounts
                          with multiple collectors.

  --help                  Show this message and exit.

3. Carefully review and then deploy the generated template either using the AWS console, AWS CLI or AWS SDK.

For instance using the MC and AWS CLIs,

$ montecarlo discovery cf-role-gen --policy-file samples/mcd_athena_policy.json --policy-file samples/mcd_glue_policy.json > samples/mcd_cf_template.json
Generating CloudFormation template for creating a role resource.
$ cat samples/mcd_cf_template.json  # Review template
...
$ aws cloudformation create-stack --stack-name mcd-resource-access --template-body file://samples/mcd_cf_template.json --capabilities CAPABILITY_IAM

After the stack deploy completes the role ARN and external ID can be retrieved from the Stack outputs. For instance,

$ aws cloudformation describe-stacks --stack-name mcd-resource-access --query 'Stacks[0].Outputs'
[
    {
        "OutputKey": "RoleExternalId",
        "OutputValue": "1234",
        "Description": "External ID for the generated role."
    },
    {
        "OutputKey": "RoleArn",
        "OutputValue": "arn:aws:iam::12345:role/mcd-athena-access-role-12345",
        "Description": "ARN for the generated role."
    }
]

Creating an IAM roles using the MC CLI

🚧
This command does not support accounts with more than one Data Collector

You can use the CLI to quickly create an IAM role with the desired policy.

To create the role using the CLI follow these steps -

1. Please follow this guide to install and configure the CLI.

2. Run the `create-role` command to directly create the role. For reference, see help below:

$ montecarlo integrations create-role --help
Usage: montecarlo integrations create-role [OPTIONS] FILE

  Create an IAM role from a policy FILE. The returned role ARN and external
  id should be used for adding lake assets.

Options:
  --aws-profile TEXT  Override the AWS profile used by the CLI, which
                      determines where the role is created. This can be
                      helpful when the account that manages the asset is not
                      the same as the collector.

  --help              Show this message and exit.