AWS GovCloud Quickstart Guide

Last updated November 12, 2024 22:55

This guide is designed to walk you through the quickest way to configure Kion for AWS GovCloud deployments.

For the sake of brevity, we are assuming you have already installed Kion in your environment. Looking for a comprehensive guide for AWS deployment? See the AWS Deployment Guide.

Our application supports a wide range of configurations and customizations, but this guide focuses on the most common setup. If you find yourself with unique requirements, we will point you to other relevant documentation at critical points where alternatives exist.

After you have completed the steps in this guide, users will be able to log in and begin using Kion.

In order for Kion to interpret and manage your AWS accounts, you must first enable access in AWS and add your AWS management account as the billing source in the Kion application.

This process requires both a GovCloud and commercial management account. Billing will be processed through your commercial account.

In the steps below, replace any instance of accountnumber with your commercial AWS management account number.

1. Create an S3 billing bucket in AWS

An S3 billing bucket stores billing data for Kion to access. If you already have monthly billing reports and cost and usage reports set up, you can skip to Add the Kion IAM Role.

Log in to your AWS management account.
Navigate to the AWS CloudFormation service.
Click Create Stack.
Upload this template: billing-bucket.json.
Name the stack: cloudtamer-billing-bucket.
Follow the remainder of the prompts.

To download the .json file, go to the AWS Billing Sources, scroll to the bottom of the article, and download the attached file named billing-bucket.json.

2. Enable monthly reports

Enabling monthly reports allows AWS to send its monthly billing data to the S3 bucket we just created.

Log in to the AWS management account account.
Click your username at the top right.
Click My Billing Dashboard.
Click Billing preferences.
Scroll to the bottom of the page and expand Detailed Billing Reports [Legacy].
Enable Turn on the legacy Detailed Billing Reports feature to receive ongoing reports of your AWS charges.
Name the bucket: cloudtamer-accountnumber-hourly
If you are asked to verify the bucket policy, check the box and click Save.
Select all of the reports.
Click Save preferences.

3. Enable cost and usage reports

Enabling cost and usage reports allows AWS to send its cost and usage billing data to the S3 bucket we created.

Log in to the AWS management account account.
Click your username at the top right.
Click My Billing Dashboard.
Click Cost & Usage Reports.
- For FOCUS setup information, please reference here.
Click Create report.
Name the report: cloudtamer-accountnumber-hourly
Enable Include resource IDs.
Enable Automatically refresh your Cost & Usage Report when charges are detected for previous months with closed bills.
Click Next.
Name the bucket: cloudtamer-accountnumber-hourly
If you are asked to verify the bucket policy, check the box and click Save.
Enter the report prefix: report
For Report Versioning, enter: Create new report version
Enable report data integration for Amazon Redshift and Amazon QuickSight.
Click Next.
Click Review and Complete.

4. Add the "cloudtamer-service-role" IAM role

The IAM role allows Kion to access the data in the S3 bucket and create accounts in AWS. We recommend you use the default govcloud-billing-role-full-access.json file as a best practice. For a list of alternative files with different levels of access, see AWS Billing Sources.

Log in to the AWS management account account.
Navigate to the AWS CloudFormation service.
Click Create Stack.
Upload govcloud-billing-role-full-access.json.
Name the stack: cloudtamer-service-role
Replace the AWS Account with the AWS account number where Kion is installed.
Follow the remainder of the prompts.

To download the .json file, go to the AWS Billing Sources, scroll to the bottom of the article, and download the attached file named govcloud-billing-role-full-access.json.

5. Partition user setup

To configure billing for your new instance of Kion in AWS GovCloud, you must configure a partition user in AWS Commercial. This partition user is used for several operations, including accessing the list of available AWS commercial regions and performing AWS commercial operations.

In Kion, navigate to Settings > System Settings > AWS Settings > AWS Partitions.
Download the AWS CloudFormation template at the top of the page.
Deploy the downloaded AWS CloudFormation template in the AWS commercial account that correlates to your AWS GovCloud installation account. This creates your AWS Commercial partition account.

Do not execute this AWS CloudFormation template in your AWS commercial management (billing) account.

In your AWS commercial partition account, navigate to IAM > Users.
Select the cloudtamer-service-user.
Click Security Credentials.
Generate a new access key for this user. Take note of the Access Key ID and the Secret Access Key.
In the Kion AWS Partitions settings, select AWS Commercial.
Enter the Access Key ID and Secret Access Key that you generated earlier.
Click Save.
Log in to your AWS commercial management account.
Navigate to IAM > Roles.
Select the cloudtamer-service-role.
In the details section, select Trust Relationships.
Edit the trust policy by adding the following code. Replace [ACCOUNTNUMBER] with the account numeber for your AWS commercial partition account.

{ "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::[ACCOUNTNUMBER]:root" }, "Action": "sts:AssumeRole" }
In Kion, navigate to Settings > System Settings > AWS Settings > AWS Regions.
Select the AWS regions you plan to use. Ensure you select the region that contains your S3 billing buckets for your AWS commercial management account.
Click Update.

6. Add a billing source to Kion

Log in to Kion.
Click Accounts on the left menu.
Click Billing Sources.
Click the Add New + button at the top of the page.
For Account Type, select AWS.
Select a Billing Report Type. We recommend using FOCUS or Cost & Usage Report. Select the Detailed Billing Report if you use C2S and SC2S.
Fill in the form with the following information:
- Billing Source Name. Enter AWS management account.
- AWS Account Number. Enter the account number of the commercial AWS management account.
- Billing Start Date. Set the date to when the monthly reports are first available.
- AWS Linked Role. The AWS linked role is the name of the IAM role that AWS Organizations automatically configures during account creation. The linked role is used as the default for any new accounts associated with this billing source.
- Billing Report Type:
  - Selecting FOCUS will generate data from the FOCUS data export
    - Click here for more information on the FOCUS spec
  - Selecting FOCUS and AWS Billing Report will prioritize generating data from the FOCUS export, and the AWS Billing Report will be an alternative option if Kion is unable to find the FOCUS export.
  - Selecting AWS Billing Report will give an option of Cost & Usage Report or Detailed Billing Report. Data will be generated from the option chosen.
The below steps apply to any of the Billing Report Types chosen:
- S3 Bucket. Enter cloudtamer-*accountnumber*hourly.
  - If you are using replication, enter cloudtamer-*accountnumber*hourly-replicated.
- S3 Bucket Region. Select the region where the S3 billing bucket is located.
- Report Prefix. Enter: report.
- S3 Bucket Region. Select the region where the S3 billing bucket is located.
- Report Name. Enter cloudtamer-*accountnumber*hourly.
- AWS Account Number Containing S3 Buckets. Enter the account number of the AWS management account.
  - If you are using replication, enter the AWS account number where Kion is installed.
- Billing S3 Bucket Access Role. Leave this field blank unless you are using replication.
  - If you are using replication, enter: cloudtamer-service-role.
- Select whether Kion can use this management account to create AWS accounts.
- Leave Skip Billing Source validation unchecked.
- Select if you would like to enroll all AWS accounts created in Kion for this billing source in your existing AWS Business or Enterprise Support plan. This option only displays if you already have an AWS support plan.
Click Test Billing Connection. The number of reports found is based on how long reporting has been enabled. If you just enabled reporting, it can take up to 24 hours for your first report to come in from AWS. In this case, it is normal to see a report count of 0.
Click Create Billing Source.

7. Add your GovCloud organization master account

For Kion to support AWS Organizations lookups and account creation, you must configure your billing source to use your AWS GovCloud Organizations master account. This is the top-level of your AWS Organizations structure within AWS GovCloud.

In Kion, navigate to Accounts > Billing Sources.
Click the ellipsis menu next to the billing source you configured earlier and select GovCloud Settings.
Enter a friendly name for the account.
Enter the account number for your GovCloud Organization master account.
Click Save.
Contact Kion Support for the AWS CloudFormation template to create a role in your GovCloud Organization master account.

2. Import IAM Policies into Kion

IAM policies are the permission building blocks used to create cloud rules and cloud access roles. Kion uses native IAM policies within AWS and also allows you to create and manage your own custom policies.

Import AWS managed policies

3. Add Users

We recommend tying to an Identity Management System (IDMS) if you have a large number of user accounts to create, but you can add users one by one. The steps to add an IDMS to Kion depend on what type of IDMS you use.

You’ll want at least one user added in addition to your root account to be able to log in and start using the application, so that’s what we’ll do here.

1. Add a user

2. (Optional) Add a user group

For information about adding an IDMS, see Identity Management.

4. Define Permissions for Users

Permission roles define what a user is allowed to do within the Kion application. Permission schemes are how those roles apply to objects (OUs, projects, funding sources) within Kion.

1. Add a permission role

2. Assign a permission role to a permissions scheme

For more information, see Getting Started with Permissions

5. Build Organizational Hierarchy with OUs

We organize hierarchy within Kion using organizational units (OUs). You can apply funding, cloud rules, and permission schemes to OUs. We recommend structuring your organization’s hierarchy around where funds originate.

Child OUs are defined as any OU that falls below a top-level OU. Child OUs can hold projects and are used to define funding paths. We will create a project and add it to an OU later on in this guide.

Add an OU

For more information, see What is an OU?

6. Set Limits on User Access

Cloud rules limit the services that are accessible by users. These limits ensure your users remain compliant with whichever universal rules you have in place. Cloud rules apply to all users at the level they are placed in the OU hierarchy along with any descendant resources.

Before creating cloud rules, consider what universal limits you want to place on users. For best practice suggestions, see What is a Cloud Rule?

1. Create a cloud rule

2. Assign a cloud rule to an OU

7. Create a Funding Source and Allocate Funds

Funding sources are used to allocate funding to specific OUs and projects. Funding sources represent a single deposit of funds and must be associated with a top-level OU.

After creating a funding source, funds can be disseminated down to destination OUs. A destination OU can be any child OU below the source OU.

1. Add a funding source

2. Allocate funds to a child OU

For more information, see Financial Management Methods.

8. Create Projects and Assign Users and Groups

Projects provide the most granular level of organization in Kion. Permissions are organized at the project level, so, although we support multi-account projects, we recommend a 1:1 ratio between projects and individual cloud accounts for maximum flexibility and control.

Add a new project

For more information, see What is a Project? and What is a Project Spend Plan?

9. Set Budget Enforcement Actions on Project

Enforcement actions control how much money each of your cloud accounts spend. You can set enforcement actions at the funding source level, but we recommend setting them at the project level for more control. You can set triggers to run a cloud rule when significant events occur. Cloud rules triggered by enforcements can do things like pause funding or lock accounts to prevent further spending.

Create a budget enforcement action

For more information, see What is a Financial Enforcement Action?

10. Attach AWS Accounts to Kion Projects

Now we can link the projects you’ve created to existing AWS accounts. Once an account is added, Kion will be able to perform actions inside the account, including accessing billing data, roles, policies, and permissions.

Before you can create accounts via Kion, you must enable account creation for GovCloud. However, accounts created in AWS can be imported into Kion without enabling this feature. For more information, see Enabling AWS GovCloud Account Creation.

Attach an AWS GovCloud account to a project

For more information, see Getting Started with Account Management.

11. Import Existing Policies from AWS

Import your own AWS IAM policies

12. Create Cloud Access Roles for Users

The last step is to create cloud access roles for users. These allow users to access the AWS console or provision AWS API access keys.

Cloud access roles can be applied to OUs to be inherited by multiple projects, or they can be applied to individual projects.

We will create a cloud access role on a project to get you started, but you may want to consider creating cloud access roles on OUs for system administrators, network engineers, or billing managers that need access to the same services in every account.

Create a cloud access role in a project

For more information, see What is a Cloud Access Role?

ZD-main.4.log-399603933.zip
(20 KB)