In your AWS Account for Horizon Cloud, several resource providers must have a registered status.
Ensure that the listed IAM permissions are provided before deploying a Horizon Edge. The final step of the Horizon Edge deployment validates that these resource providers have a registered status and prevents the start of the Horizon Edge deployment if one is unregistered.
Two methods are available for you to provide the necessary IAM permissions.
- By using the AWS IAM console to create permissions.
- By using the AWS IAM console to run the JSON script included below.
Create IAM Permissions
If you choose to create the permissions manually, the following required IAM permissions must be provided in the AWS IAM Console:
-
ec2:- all permissions -
workspaces:- all permissions -
fsx:- all permissions -
ds:DescribeDirectories, AuthorizeApplication, UnauthorizeApplication, UpdateAuthorizedApplication -
cloudformation:CreateStack, UpdateStack, DeleteStack, DescribeStacks, TagResource, UntagResource, DescribeStackEvents, ListStackResources, GetTemplate -
resource-groups:GetGroup, CreateGroup, DeleteGroup, UpdateGroup Tag, GetTags, ListGroups, ListGroupResources, ListResourceTypes, AssociateResource, DisassociateResource -
elasticloadbalancing:AddTags, RemoveTags, RegisterTargets, DeregisterTargets, DescribeTargetHealth, CreateListener, DeleteListener, DescribeListeners, CreateTargetGroup, DeleteTargetGroup, ModifyTargetGroup, DescribeTargetGroups, CreateLoadBalancer, DeleteLoadBalancer, DescribeLoadBalancers, ModifyLoadBalancerAttributes, ModifyTargetGroupAttributes, SetSubnets -
s3:GetObject, PutObject, ListBucket, ListAllMyBuckets, CreateBucket, DeleteObject, DeleteBucket, PutBucketPolicy, GetBucketPolicy, DeleteBucketPolicy, PutBucketTagging, GetBucketLocation, PutLifecycleConfiguration, PutBucketPublicAccessBlock, PutEncryptionConfiguration -
iam:GetRole, PassRole, CreateRole, GetPolicy, PutRolePolicy, GetPolicyVersion, ListAttachedUserPolicies, GetInstanceProfile, CreateInstanceProfile, DeleteInstanceProfile, CreateServiceLinkedRole, AddRoleToInstanceProfile, RemoveRoleFromInstanceProfile, SimulatePrincipalPolicy, DeleteRole, AttachRolePolicy, DetachRolePolicy, TagRole, UntagRole -
tag:GetResources, TagResources, UntagResources -
kms:Encrypt, Decrypt, ReEncrypt, GenerateDataKey, DescribeKey, ListKeys, ListAliases -
ssm:SendCommand, StartSession, CreateAssociation, DescribeAssociation, GetCommandInvocation, ListCommandInvocations, DescribeInstanceInformation
Note: Horizon Cloud does not perform mandatory tag validation of any tags made mandatory by using AWS Service Control Policy (SCP) or other tag policy. If your organization enforces AWS service control policies (SCP) or tag policies, ensure all required tags are applied to the provider before Edge deployment. Horizon Edge, Edge Gateway, and UAG deployments may fail if policy-mandated tags are missing. For more information, see Using Amazon Resource Tags.
Copy and Use the Following JSON File
If you choose to use the JSON file method, copy the JSON script below into the Policy editor in the AWS IAM Console:
JSON Script
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "workspaces:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "fsx:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ds:DescribeDirectories",
"ds:AuthorizeApplication",
"ds:UnauthorizeApplication",
"ds:UpdateAuthorizedApplication"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks",
"cloudformation:TagResource",
"cloudformation:UntagResource",
"cloudformation:DescribeStackEvents",
"cloudformation:ListStackResources",
"cloudformation:GetTemplate"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resource-groups:GetGroup",
"resource-groups:CreateGroup",
"resource-groups:DeleteGroup",
"resource-groups:UpdateGroup",
"resource-groups:Tag",
"resource-groups:Untag",
"resource-groups:GetTags",
"resource-groups:ListGroups",
"resource-groups:ListGroupResources",
"resource-groups:ListResourceTypes",
"resource-groups:AssociateResource",
"resource-groups:DisassociateResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:SetSubnets"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket",
"s3:ListAllMyBuckets",
"s3:CreateBucket",
"s3:DeleteObject",
"s3:DeleteBucket",
"s3:PutBucketPolicy",
"s3:GetBucketPolicy",
"s3:DeleteBucketPolicy",
"s3:PutBucketTagging",
"s3:GetBucketLocation",
"s3:PutLifecycleConfiguration",
"s3:PutBucketPublicAccessBlock",
"s3:PutEncryptionConfiguration"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:PassRole",
"iam:CreateRole",
"iam:GetPolicy",
"iam:PutRolePolicy",
"iam:GetPolicyVersion",
"iam:ListAttachedUserPolicies",
"iam:GetInstanceProfile",
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:CreateServiceLinkedRole",
"iam:AddRoleToInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:SimulatePrincipalPolicy",
"iam:DeleteRole",
"iam:AttachRolePolicy",
"iam:DetachRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfilesForRole"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"tag:GetResources",
"tag:TagResources",
"tag:UntagResources"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
"kms:ListKeys",
"kms:ListAliases"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ssm:SendCommand",
"ssm:StartSession",
"ssm:CreateAssociation",
"ssm:DescribeAssociation",
"ssm:GetCommandInvocation",
"ssm:ListCommandInvocations",
"ssm:DescribeInstanceInformation"
],
"Resource": "*"
}
]
}Create IAM Roles
An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.
By following these steps, you can create an IAM role in AWS that provides temporary security credentials for your role session, allowing access to Horizon Cloud while ensuring secure access to your AWS resources.
- In the IAM Console, navigate to the IAM (Identity and Access Management) section in your AWS account.
- Click Roles in the left pane.
- Click Create role and select Custom trust policy.
- Define a custom trust policy by entering the following JSON script in the Custom trust policy editor.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::211125714243:user/svc.hcs-ng-prod-svc-user"
]
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "{create a custom ExternalId}"
}
}
}
]
}
Was this page helpful?