Deployment Steps for Grant AWS command

[vikhyat187]

This ticket, has the steps to set the ENV for /grant-aws-access discord command, this command grants AWS access of mentioned groupId to the user, so for granting this access programatically we needed the access keys, secret keys with permission to add user to the AWS account and add them to the mentioned group.

They are basically 4 ENVs

• AWS_REGION
• AWS_ACCESS_KEY
• AWS_SECRET_KEY
• IDENTITY_STORE_ID

Steps to fetch the first 3 variables

1. In order to create a access and secret key with required permissions

• We can either check this document https://k21academy.com/amazon-web-services/create-access-and-secret-keys-in-aws/

  a. On top right corner select security credentials
  

  
  
  
  
  b. select create access keys
  
  
  

  c. Setting these access and secret keys in the ENV variables in github
  

  
  

2. List of permissions for AWS access and secret keys

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "identitystore:ListUsers",
            "Resource": [
                "arn:aws:identitystore:::user/*",
                "arn:aws:identitystore::<account-no>:identitystore/*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "identitystore:CreateUser",
            "Resource": "arn:aws:identitystore::<account-no>:identitystore/*"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": "identitystore:CreateGroupMembership",
            "Resource": [
                "arn:aws:identitystore:::group/*",
                "arn:aws:identitystore:::user/*",
                "arn:aws:identitystore::<account-no>:identitystore/*"
            ]
        }
    ]
}

3. To set the identity store Id
   a. click on the IAM Identity center and click on settings
   
   
   b. Scroll down and we can find the identity store Id
   
4. Note : Important step

• We need to check the AWS group is linked to an AWS account if not the users, will see a blank screen like this

- To assign an AWS account to the group, we can go to **IAM Identity center** > Groups

- Selecting the group whose Group Id we have set in the discord slash commands, click on the **AWS Accounts** tab and assign to an AWS account, the user will see this like screen post assigning group to the AWS account.

cc : @prakashchoudhary07

[prakashchoudhary07]

hey quick question are we going to allow this for all resources?
Where and how can we restrict this?

[vikhyat187]

Hi @prakashchoudhary07 point 4 in the description, can we check this please.