--- title: "IAM Configuration for vDiscovery" canonical: "https://docs.infoblox.com/space/DeploymentGuidevNIOSforAWS/736395695/IAM%20Configuration%20for%20vDiscovery" format: markdown --- In order to use the Infoblox vDiscovery for AWS feature described in the Configuration section of this guide, you will need an IAM user or role with some minimum permissions to view resources in AWS. Minimum permissions required in AWS to conduct vDiscovery are: - iam:GetUser - ec2:DescribeVpcs - ec2:DescribeSubnets - ec2:DescribeRouteTables - ec2:DescribeAddresses - ec2:DescribeNetworkInterfaces - ec2:DescribeInstances The following topics are covered in this section: > Macro (toc) ### **IAM Policy** First, we will create a custom policy with the permissions listed above to assign to users or roles. 1. In the AWS Management Console, Use the Services menu to navigate to **IAM **under Security, Identity, & Compliance. 2. Select **Policies** from the IAM menu. 3. Click on **Create policy**. ![Graphical user interface, application Description automatically generated](media://a6e69529-3fa3-4593-b827-7f824375587e) 4. Policies can be selected through the visual editor or defined using JSON. For this guide, we will use JSON. Click the **JSON** tab. ![Graphical user interface, application Description automatically generated](media://e8c99815-d797-4472-8bc1-34952fa521c8) 5. In the JSON editor view, you will see the base outline for a policy definition: ![image](media://5a653727-0648-47e9-9aae-dbca21f5914d) 6. Between the square brackets next to Statement, paste the following to define your policy: **        {** **            "Effect": "Allow",** **            "Action": [** **                "ec2:DescribeAddresses",** **                "ec2:DescribeInstances",** **                "ec2:DescribeNetworkInterfaces",** **                "ec2:DescribeVpcs",** **                "ec2:DescribeSubnets",** **                "ec2:DescribeRouteTables"** **            ],** **            "Resource": "*"** **        },** **        {** **            "Effect": "Allow",** **            "Action": "iam:GetUser",** **            "Resource": "arn:aws:iam::*:user/*"** **        }** 7. Your JSON policy definition should look like this: ![Text Description automatically generated](media://e57b7282-6331-444b-89d4-f9a4cb8a4cf0) 8. Click **Next: Tags**. Add tags if desired. 9. Click **Next: Review**. 10. Name your policy. 11. Optionally, add a description. 12. Review the Summary. 13. Click **Create Policy**. ![Graphical user interface, text, application, email Description automatically generated](media://24cfd500-424d-452c-8131-103b6615c635) ### **IAM User** Next, we will create a user with an access key that can be used to authenticate for vDiscovery jobs. 1. Select **Users** from the IAM menu. 2. Click **Add users**. ![Graphical user interface, application Description automatically generated](media://f5fb4159-b8b5-43b5-9274-c716b1e7de46) 3. Name the user. 4. Click **Next**. ![Graphical user interface, text, application, email Description automatically generated](media://195e1b6b-6e29-44cd-baba-81e06871f6e9) 5. Under Permissions options, select **Attach policies directly**. 6. Use the Permissions policies search to locate and select your vDiscovery policy. 7. Click **Next**. ![Graphical user interface, application, table Description automatically generated](media://9f074c59-815b-4470-ae57-0001766a2548) 8. On the Review and create step, review details and click **Create user**. 9. After the user is created, search for and click on the new user. ![Graphical user interface, application Description automatically generated](media://3901918a-885e-4c2b-a60a-e81e5a20012f) 10. Select the **Security credentials** tab. ![Graphical user interface, application, table Description automatically generated](media://4608effc-6a25-4202-b7b5-ee6e83a3c62c) 11. Scroll down to the Access Keys section and click **Create access key**. ![Graphical user interface, text, application, email Description automatically generated](media://a0461401-1177-4f8a-9b1d-2107cb7f582f) 12. Select **Other** and click **Next**. ![Graphical user interface, text, application, email Description automatically generated](media://1a5abd29-cf33-4f96-b1ef-f787f4091848) 13. Add a description for the key and click **Create access key**. ![Graphical user interface, text, application Description automatically generated](media://d164156e-8704-4b06-8ad8-031599832211) 14. Click **Download .csv file** to retrieve the new keys. ![Graphical user interface, text, application, email Description automatically generated](media://740d234b-b442-4156-9b43-9f83fa65fc51) *Warning: This is the only opportunity to download or view these credentials. If you do not save them, or lose them later, you will have to create new access keys for this user.* 15. Click **Done**. ### **Rotating Credentials** When using user access keys as described in the previous section, keys should be rotated on a regular basis, at a minimum every 90 days. To rotate access keys for an IAM user, follow the guidance in AWS documentation: [https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) , specifically the section titled **Rotating access keys**. ### **IAM Role** Creating a role to use for vDiscovery is optional and if desired should be completed prior to deploying your vNIOS for AWS instance. The role can be assigned to your instance during deployment, as described in the Deploy vNIOS Instance in AWS →** **Configure Instance Details section of this guide. It is also possible to add roles to a running instance using the AWS CLI command: **aws ec2 associate-iam-instance-profile**. See AWS CLI documentation for details on working with this and other commands related to IAM roles: [https://docs.aws.amazon.com](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html). 1. In the AWS Management Console, Use the Services menu to navigate to **IAM **under Security, Identity, & Compliance. 2. Select **Roles** from the IAM menu. 3. Click on **Create role**. ![Graphical user interface, application Description automatically generated](media://27251f9a-5b82-4b94-97f2-6548ad3965a3) 4. For Trusted entity type, select **AWS service**. 5. For Use case, select **EC2**. 6. Click **Next.** ![Table Description automatically generated with low confidence](media://29728a42-16f5-43d3-b6e6-9e2aa0ae44f5) 7. Enter the name of your policy in the search bar or scroll down to locate your policy. 8. Check the box next to your vDiscovery policy. 9. Click **Next**. ![Graphical user interface, text, application, email Description automatically generated](media://4588d3c5-5535-4516-99ca-3ecc16f73aad) 10. Enter a name under Role name. 11. Optionally, add a description. 12. Review the role properties. 13. Scroll down and click **Create role**. ![Graphical user interface, text, application, email Description automatically generated](media://45ee448b-dd64-4dfc-a3ea-97c1356fea2a)