πŸ“¦AWS

Installing P0 IAM management on AWS takes about 10 minutes.

Before you begin

  • Choose at least one account on which to install P0.

  • Make sure you have the ability to create roles, add trust relationships, and create and assign role polices. You can do this if you have the IAMFullAccess policy attached to your user.

Setting up AWS IAM management

For fine-grained Kubernetes access in EKS use the P0 Kubernetes integration.

  1. Navigate to "Integrations" on p0.app, then select "AWS". Choose the "IAM management" component:

  1. Click the "Add account" button to begin the installation

  1. Enter an AWS numeric account ID, then click "Next".

  1. The next page will display commands you can run using the AWS CLI to provision P0. You can also run these commands using AWS Cloud Shell.

  1. Copy and run these commands or use the Terraform configuration to deploy the changes. Click "Next" to verify the installation. If verification is successful you will be taken to the integration configuration page.

Configuring P0 with AWS

On the configuration page, you define how users are provisioned in AWS:

If users are defined in the account's IAM service, choose "IAs AWS IAM users".

If the user's names equal their email addresses choose "User name is user email".

If users are defined in the account's IAM service, but their user names do not equal their email, you'll need to add a tag to each user you want to allow access via P0. For example, with a tag named "Email":

Setting up AWS resource inventory

Installing P0 resource inventory on AWS takes about 10 minutes.

The resource inventory component extends the IAM management integration and allows requesting fine-grained resource-level access in AWS.

An installed AWS IAM management integration is required

  1. Navigate to "Integrations" on p0.app, then select "AWS". Choose the "Resource inventory" component:

  1. Click "Add account"

  1. Choose one of the AWS accounts already installed for IAM management:

  1. Run the AWS CLI commands to configure Resource Explorer

  1. Click "Next" to validate your setup. You will land on the resource inventory configuration page. Clicking "Next" again takes you back to the Resource inventory overview page.

And that's it. You're all set to start granting just-in-time, least-privileged access to AWS with P0.

Last updated