Cross-Account Access via Console | Dropzone AI Documentation

For the complete documentation index, see llms.txt. This page is also available as Markdown.

There are multiple ways to deploy AWS roles to provide Dropzone visibility into your environment. See the AWS documentation for more info.

The following steps walk you through creating a role and granting it to the Dropzone-provided role in the AWS console. This also has the information you'd need to create your own Infrastructure-as-Code configuration if you choose.

Find the Dropzone IAM Role Information

• Navigate to your Dropzone AI tenant home page e.g. https:// mycompany.dropzone.app
• In the bottom left hand corner, navigate to Settings > Integrations

Integrations Dropdown

• Click "Available"

Click Available

• In the Search bar, search AWS, then click "Configure"

The AWS Tile

• Under the "Connection" section, record the ARN and EXTERNAL ID values, for use later in the AWS CloudFormation UI

The AWS Connection Information

Create the Role

Next you'll create a role in the AWS account you want monitored and available.

You'll need the following information:

• Log in to the AWS Management Console for the account where you want to create the role
• Open the Identity Access and Management (IAM) dashboard

IAM

• From the left navigation, select "Access Management" > Roles
• Click "Create Role"

Create Role

• Click "Custom Trust Policy"

Custom Trust Policy Selection

• In the text field below, paste the following policy, replacing the <Dropzone-provided User ARN> and <Dropzone-provided External ID> strings with the values from the Dropzone UI you recorded earlier:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<Dropzone-provided User ARN>"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<Dropzone-provided External ID>"
                }
            }
        }
    ]
}

• In the bottom right, click "Next"
• You'll now be on the "Add Permissions" page where you can add AWS pre-built policies

Add Permissions page

• You may add policies in one of two ways. You may add the ReadOnlyAccess policy, which will allow Dropzone to have all policies needed even in the future, or add the following policies one-by-one

• Click "Next" when done adding policies
• Give the new role the name "Dropzone_AI"

Role Name

• In the bottom right, click "Create Role"

Create Role

• Navigate to "Identity and Access Management (IAM)" > "Access Management" > "Roles"
• Search for the new role and click on it

Find the Role

• In the middle of the page, you'll see "Permissions Policies"

Permissions Policies

• Click "Add Permission"
• Select "Create Inline Policy"

Create Inline Policy Option

• In the text field, paste the following policy, replacing the <your_accountnumber> strings with this AWS account ID:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloudTrailStartQuery",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey",
                "cloudtrail:StartQuery"
            ],
            "Resource": [
                "arn:aws:kms:*:<your_accountnumber>:key/*",
                "arn:aws:cloudtrail:*:<your_accountnumber>:eventdatastore/*"
            ]
        },
        {
         "Sid": "EKSReadOnly",
         "Effect": "Allow",
         "Action": [
             "eks:Describe*",
             "eks:List*"
         ],
         "Resource": "*"
      }
    ]
}

Custom Permissions JSON

• Click "Next"
• Give the new permission the name "Dropzone_AI_Additional"
• Click "Create Policy"

You should be returned to the Dropzone_AI role page and see the policies you've added, including the custom policy.

• Record the ARN for this role for use later in the Dropzone UI when configuring the Dropzone Data and Alert Sources, where it will be referred to as the "Role ARN"

AWS Role Page

Repeat For Additional AWS Accounts

Repeat the steps taken in the "Create the Role" section for all other AWS accounts you want visible to Dropzone.

Make sure you're keeping a list of all the role ARNs you create along the way - you'll need them later.

Once done, you may move onto configuring the Dropzone Data and Alert Sources described in the AWS documentation.